X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fvc1test.c;h=64a45cd3a71d8fb759aa5fa39c3bdbfcb2ba0e2d;hb=cc82402ed3990853311fd133a3dc03692714d65c;hp=a801f4bd22e41cabe4bb08b4b13c04d0bf9a76b9;hpb=91bcf0b8cdb3cb8046496d470ade25d1c802ca3d;p=ffmpeg

diff --git a/libavformat/vc1test.c b/libavformat/vc1test.c
index a801f4bd22e..64a45cd3a71 100644
--- a/libavformat/vc1test.c
+++ b/libavformat/vc1test.c
@@ -34,9 +34,14 @@
 
 static int vc1t_probe(AVProbeData *p)
 {
+    uint32_t size;
+
     if (p->buf_size < 24)
         return 0;
-    if (p->buf[3] != 0xC5 || AV_RL32(&p->buf[4]) != 4 || AV_RL32(&p->buf[20]) != 0xC)
+
+    size = AV_RL32(&p->buf[4]);
+    if (p->buf[3] != 0xC5 || size < 4 || size > p->buf_size - 20 ||
+        AV_RL32(&p->buf[size+16]) != 0xC)
         return 0;
 
     return AVPROBE_SCORE_EXTENSION;
@@ -48,9 +53,10 @@ static int vc1t_read_header(AVFormatContext *s)
     AVStream *st;
     int frames;
     uint32_t fps;
+    uint32_t size;
 
     frames = avio_rl24(pb);
-    if(avio_r8(pb) != 0xC5 || avio_rl32(pb) != 4)
+    if (avio_r8(pb) != 0xC5 || ((size = avio_rl32(pb)) < 4))
         return AVERROR_INVALIDDATA;
 
     /* init video codec */
@@ -63,6 +69,8 @@ static int vc1t_read_header(AVFormatContext *s)
 
     if (ff_get_extradata(s, st->codecpar, pb, VC1_EXTRADATA_SIZE) < 0)
         return AVERROR(ENOMEM);
+
+    avio_skip(pb, size - 4);
     st->codecpar->height = avio_rl32(pb);
     st->codecpar->width = avio_rl32(pb);
     if(avio_rl32(pb) != 0xC)