[FFmpeg-cvslog] r19640 - trunk/libavcodec/dvdsubdec.c

[reimar]

Author: reimar
Date: Sat Aug 15 02:02:42 2009
New Revision: 19640

Log:
Fix cmd_pos bounds check to avoid the overflow case.

Modified:
   trunk/libavcodec/dvdsubdec.c

Modified: trunk/libavcodec/dvdsubdec.c
==============================================================================
--- trunk/libavcodec/dvdsubdec.c	Fri Aug 14 18:41:21 2009	(r19639)
+++ trunk/libavcodec/dvdsubdec.c	Sat Aug 15 02:02:42 2009	(r19640)
@@ -191,7 +191,7 @@ static int decode_dvd_subtitles(AVSubtit
 
     cmd_pos = READ_OFFSET(buf + cmd_pos);
 
-    while ((cmd_pos + 2 + offset_size) < buf_size) {
+    while (cmd_pos > 0 && cmd_pos < buf_size - 2 - offset_size) {
         date = AV_RB16(buf + cmd_pos);
         next_cmd_pos = READ_OFFSET(buf + cmd_pos + 2);
         dprintf(NULL, "cmd_pos=0x%04x next=0x%04x date=%d\n",