int remaining_bits;
} VqfContext;
-static int vqf_probe(AVProbeData *probe_packet)
+static int vqf_probe(const AVProbeData *probe_packet)
{
if (AV_RL32(probe_packet->buf) != MKTAG('T','W','I','N'))
return 0;
header_size = avio_rb32(s->pb);
+ if (header_size < 0)
+ return AVERROR_INVALIDDATA;
+
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
st->codecpar->codec_id = AV_CODEC_ID_TWINVQ;
st->start_time = 0;
len = avio_rb32(s->pb);
- if ((unsigned) len > INT_MAX/2) {
+ if ((unsigned) len > INT_MAX/2 || header_size < 8) {
av_log(s, AV_LOG_ERROR, "Malformed header\n");
return -1;
}