X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fthp.c;h=bcc3febaa1967160c233989225d519016f8c6cda;hb=4236e87f502e68acb949ea4ae6f5ebd889377b60;hp=76b9b3820ce8cd7398af125d4304d5b3a2e3c3d5;hpb=94d98330ed6c5562341315c26c1af92771a2e6de;p=ffmpeg

diff --git a/libavformat/thp.c b/libavformat/thp.c
index 76b9b3820ce..bcc3febaa19 100644
--- a/libavformat/thp.c
+++ b/libavformat/thp.c
@@ -45,7 +45,7 @@ typedef struct ThpDemuxContext {
 } ThpDemuxContext;
 
 
-static int thp_probe(AVProbeData *p)
+static int thp_probe(const AVProbeData *p)
 {
     double d;
     /* check file header */
@@ -75,6 +75,8 @@ static int thp_read_header(AVFormatContext *s)
                            avio_rb32(pb); /* Max samples.  */
 
     thp->fps             = av_d2q(av_int2float(avio_rb32(pb)), INT_MAX);
+    if (thp->fps.den <= 0 || thp->fps.num < 0)
+        return AVERROR_INVALIDDATA;
     thp->framecnt        = avio_rb32(pb);
     thp->first_framesz   = avio_rb32(pb);
     pb->maxsize          = avio_rb32(pb);
@@ -93,6 +95,9 @@ static int thp_read_header(AVFormatContext *s)
     avio_seek (pb, thp->compoff, SEEK_SET);
     thp->compcount       = avio_rb32(pb);
 
+    if (thp->compcount > FF_ARRAY_ELEMS(thp->components))
+        return AVERROR_INVALIDDATA;
+
     /* Read the list of component types.  */
     avio_read(pb, thp->components, 16);
 
@@ -145,6 +150,9 @@ static int thp_read_header(AVFormatContext *s)
         }
     }
 
+    if (!thp->vst)
+        return AVERROR_INVALIDDATA;
+
     return 0;
 }
 
@@ -181,7 +189,6 @@ static int thp_read_packet(AVFormatContext *s,
         if (ret < 0)
             return ret;
         if (ret != size) {
-            av_packet_unref(pkt);
             return AVERROR(EIO);
         }
 
@@ -191,7 +198,6 @@ static int thp_read_packet(AVFormatContext *s,
         if (ret < 0)
             return ret;
         if (ret != thp->audiosize) {
-            av_packet_unref(pkt);
             return AVERROR(EIO);
         }