Abort if command offset decreases, avoids potential endless loop.
authorReimar Döffinger <Reimar.Doeffinger@gmx.de>
Wed, 3 Aug 2011 18:09:53 +0000 (20:09 +0200)
committerReimar Döffinger <Reimar.Doeffinger@gmx.de>
Wed, 3 Aug 2011 18:09:53 +0000 (20:09 +0200)
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
libavcodec/dvdsubdec.c

index 27a33ea..1c3d75e 100644 (file)
@@ -344,6 +344,10 @@ static int decode_dvd_subtitles(AVSubtitle *sub_header,
                 sub_header->rects[0]->pict.linesize[0] = w;
             }
         }
+        if (next_cmd_pos < cmd_pos) {
+            av_log(NULL, AV_LOG_ERROR, "Invalid command offset\n");
+            break;
+        }
         if (next_cmd_pos == cmd_pos)
             break;
         cmd_pos = next_cmd_pos;