X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fvc1test.c;h=3c677931fc1f4fc05147101b23687f6f25e62be4;hb=112eb17a2bbf6d02f81fdf0743b353a6b010aedc;hp=a801f4bd22e41cabe4bb08b4b13c04d0bf9a76b9;hpb=aebc5b2284db1f40a5b3e2e9a2bf406f606436c7;p=ffmpeg

diff --git a/libavformat/vc1test.c b/libavformat/vc1test.c
index a801f4bd22e..3c677931fc1 100644
--- a/libavformat/vc1test.c
+++ b/libavformat/vc1test.c
@@ -32,11 +32,16 @@
 
 #define VC1_EXTRADATA_SIZE 4
 
-static int vc1t_probe(AVProbeData *p)
+static int vc1t_probe(const AVProbeData *p)
 {
+    uint32_t size;
+
     if (p->buf_size < 24)
         return 0;
-    if (p->buf[3] != 0xC5 || AV_RL32(&p->buf[4]) != 4 || AV_RL32(&p->buf[20]) != 0xC)
+
+    size = AV_RL32(&p->buf[4]);
+    if (p->buf[3] != 0xC5 || size < 4 || size > p->buf_size - 20 ||
+        AV_RL32(&p->buf[size+16]) != 0xC)
         return 0;
 
     return AVPROBE_SCORE_EXTENSION;
@@ -48,9 +53,10 @@ static int vc1t_read_header(AVFormatContext *s)
     AVStream *st;
     int frames;
     uint32_t fps;
+    uint32_t size;
 
     frames = avio_rl24(pb);
-    if(avio_r8(pb) != 0xC5 || avio_rl32(pb) != 4)
+    if (avio_r8(pb) != 0xC5 || ((size = avio_rl32(pb)) < 4))
         return AVERROR_INVALIDDATA;
 
     /* init video codec */
@@ -63,6 +69,8 @@ static int vc1t_read_header(AVFormatContext *s)
 
     if (ff_get_extradata(s, st->codecpar, pb, VC1_EXTRADATA_SIZE) < 0)
         return AVERROR(ENOMEM);
+
+    avio_skip(pb, size - 4);
     st->codecpar->height = avio_rl32(pb);
     st->codecpar->width = avio_rl32(pb);
     if(avio_rl32(pb) != 0xC)
@@ -114,5 +122,6 @@ AVInputFormat ff_vc1t_demuxer = {
     .read_probe     = vc1t_probe,
     .read_header    = vc1t_read_header,
     .read_packet    = vc1t_read_packet,
+    .extensions     = "rcv",
     .flags          = AVFMT_GENERIC_INDEX,
 };