int c;
p = *pp;
- if ((p + 1) >= p_end)
+ if (1 >= p_end - p)
return AVERROR_INVALIDDATA;
c = AV_RB16(p);
p += 2;
len = get8(&p, p_end);
if (len < 0)
return NULL;
- if ((p + len) > p_end)
+ if (len > p_end - p)
return NULL;
str = av_malloc(len + 1);
if (!str)
if (is_start) {
/* pointer field present */
len = *p++;
- if (p + len > p_end)
+ if (len > p_end - p)
return 0;
if (len && cc_ok) {
/* write remaining section bytes */