avformat/ipmovie: check OPCODE_INIT_VIDEO_BUFFERS size more completely

[ffmpeg] / libavformat / diracdec.c

diff --git a/libavformat/diracdec.c b/libavformat/diracdec.c
index 6636ead30d033a1f43f30c8de8565f049bdca54a..e061ba5e8eea22df5ca20c8d4bf11e504a837672 100644 (file)
--- a/libavformat/diracdec.c
+++ b/libavformat/diracdec.c
@@ -25,10 +25,19 @@
 
 static int dirac_probe(AVProbeData *p)
 {
-    if (AV_RL32(p->buf) == MKTAG('B', 'B', 'C', 'D'))
-        return AVPROBE_SCORE_MAX;
-    else
+    unsigned size;
+    if (AV_RL32(p->buf) != MKTAG('B', 'B', 'C', 'D'))
         return 0;
+
+    size = AV_RB32(p->buf+5);
+    if (size < 13)
+        return 0;
+    if (size + 13LL > p->buf_size)
+        return AVPROBE_SCORE_MAX / 4;
+    if (AV_RL32(p->buf + size) != MKTAG('B', 'B', 'C', 'D'))
+        return 0;
+
+    return AVPROBE_SCORE_MAX;
 }
 
 FF_DEF_RAWVIDEO_DEMUXER(dirac, "raw Dirac", dirac_probe, NULL, AV_CODEC_ID_DIRAC)