diff --git a/libavformat/dhav.c b/libavformat/dhav.c index e5eef290b8..e6279ea31a 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -279,7 +279,7 @@ static int64_t get_duration(AVFormatContext *s) } } - if (pos < buffer_pos || pos + 20 > buffer_pos + buffer_size) + if (pos < buffer_pos || pos - buffer_pos > buffer_size - 20) goto fail; date = AV_RL32(buffer + (pos - buffer_pos) + 16);