[FFmpeg-cvslog] avformat/icodec: Fix crash probing fuzzed file

[Mark Harris]

ffmpeg | branch: master | Mark Harris <mark.hsj at gmail.com> | Mon Feb 15 23:52:13 2016 -0800| [56e2cd9c042e05255aa28487694c29aaec023263] | committer: Michael Niedermayer

avformat/icodec: Fix crash probing fuzzed file

Avoid invalid memory read/crash when frame offset >= 0xfffffff8.
Base64-encoded example: AAABADAwMDAwMAAAMAAwMDAw/P///w==
(The previous commit verifies that p->buf_size >= 22.)

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=56e2cd9c042e05255aa28487694c29aaec023263
---

 libavformat/icodec.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/icodec.c b/libavformat/icodec.c
index b247cb2..17acfb4 100644
--- a/libavformat/icodec.c
+++ b/libavformat/icodec.c
@@ -63,7 +63,7 @@ static int probe(AVProbeData *p)
         offset = AV_RL32(p->buf + 18 + i * 16);
         if (offset < 22)
             return FFMIN(i, AVPROBE_SCORE_MAX / 4);
-        if (offset + 8 > p->buf_size)
+        if (offset > p->buf_size - 8)
             continue;
         if (p->buf[offset] != 40 && AV_RB64(p->buf + offset) != PNGSIG)
             return FFMIN(i, AVPROBE_SCORE_MAX / 4);