X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fsierravmd.c;h=9d069fdff6632ba0c65973e65af9645957dfa9af;hb=ccd17ea13c26d86b0697868f43e848a5a15ab36e;hp=1d21738857ccd1ffc319ae1be17805f7b5b4cba0;hpb=8d6fc274faade5d442d19302bf4650ed2099fd73;p=ffmpeg

diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c
index 1d21738857c..9d069fdff66 100644
--- a/libavformat/sierravmd.c
+++ b/libavformat/sierravmd.c
@@ -20,7 +20,7 @@
  */
 
 /**
- * @file sierravmd.c
+ * @file libavformat/sierravmd.c
  * Sierra VMD file demuxer
  * by Vladimir "VAG" Gneushev (vagsoft at mail.ru)
  * for more information on the Sierra VMD file format, visit:
@@ -61,10 +61,17 @@ typedef struct VmdDemuxContext {
 
 static int vmd_probe(AVProbeData *p)
 {
+    int w, h;
+    if (p->buf_size < 16)
+        return 0;
     /* check if the first 2 bytes of the file contain the appropriate size
      * of a VMD header chunk */
     if (AV_RL16(&p->buf[0]) != VMD_HEADER_SIZE - 2)
         return 0;
+    w = AV_RL16(&p->buf[12]);
+    h = AV_RL16(&p->buf[14]);
+    if (!w || w > 2048 || !h || h > 2048)
+        return 0;
 
     /* only return half certainty since this check is a bit sketchy */
     return AVPROBE_SCORE_MAX / 2;
@@ -82,8 +89,7 @@ static int vmd_read_header(AVFormatContext *s,
     int64_t current_offset;
     int i, j;
     unsigned int total_frames;
-    int64_t pts_inc = 1;
-    int64_t current_video_pts = 0, current_audio_pts = 0;
+    int64_t current_audio_pts = 0;
     unsigned char chunk[BYTES_PER_FRAME_RECORD];
     int num, den;
     int sound_buffers;
@@ -144,7 +150,6 @@ static int vmd_read_header(AVFormatContext *s,
         av_reduce(&den, &num, den, num, (1UL<<31)-1);
         av_set_pts_info(vst, 33, num, den);
         av_set_pts_info(st, 33, num, den);
-        pts_inc = num;
     }
 
     toc_offset = AV_RL32(&vmd->vmd_header[812]);
@@ -156,7 +161,7 @@ static int vmd_read_header(AVFormatContext *s,
     vmd->frame_table = NULL;
     sound_buffers = AV_RL16(&vmd->vmd_header[808]);
     raw_frame_table_size = vmd->frame_count * 6;
-    if(vmd->frame_count * vmd->frames_per_block  >= UINT_MAX / sizeof(vmd_frame)){
+    if(vmd->frame_count * vmd->frames_per_block >= UINT_MAX / sizeof(vmd_frame) - sound_buffers){
         av_log(s, AV_LOG_ERROR, "vmd->frame_count * vmd->frames_per_block too large\n");
         return -1;
     }
@@ -199,20 +204,22 @@ static int vmd_read_header(AVFormatContext *s,
                 memcpy(vmd->frame_table[total_frames].frame_record, chunk, BYTES_PER_FRAME_RECORD);
                 vmd->frame_table[total_frames].pts = current_audio_pts;
                 total_frames++;
-                current_audio_pts += pts_inc;
+                if(!current_audio_pts)
+                    current_audio_pts += sound_buffers;
+                else
+                    current_audio_pts++;
                 break;
             case 2: /* Video Chunk */
                 vmd->frame_table[total_frames].frame_offset = current_offset;
                 vmd->frame_table[total_frames].stream_index = vmd->video_stream_index;
                 vmd->frame_table[total_frames].frame_size = size;
                 memcpy(vmd->frame_table[total_frames].frame_record, chunk, BYTES_PER_FRAME_RECORD);
-                vmd->frame_table[total_frames].pts = current_video_pts;
+                vmd->frame_table[total_frames].pts = i;
                 total_frames++;
                 break;
             }
             current_offset += size;
         }
-        current_video_pts += pts_inc;
     }
 
     av_free(raw_frame_table);
@@ -254,7 +261,7 @@ static int vmd_read_packet(AVFormatContext *s,
     }
     pkt->stream_index = frame->stream_index;
     pkt->pts = frame->pts;
-    av_log(NULL, AV_LOG_DEBUG, " dispatching %s frame with %d bytes and pts %"PRId64"\n",
+    av_log(s, AV_LOG_DEBUG, " dispatching %s frame with %d bytes and pts %"PRId64"\n",
             (frame->frame_record[0] == 0x02) ? "video" : "audio",
             frame->frame_size + BYTES_PER_FRAME_RECORD,
             pkt->pts);