X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fvc1test.c;h=90ea729e0bfe40e0642c964f03af2991cecfffef;hb=bc70684e74a185d7b80c8b80bdedda659cb581b8;hp=a801f4bd22e41cabe4bb08b4b13c04d0bf9a76b9;hpb=27e30c73d722ec13e59753dea91be00859c72bf2;p=ffmpeg

diff --git a/libavformat/vc1test.c b/libavformat/vc1test.c
index a801f4bd22e..90ea729e0bf 100644
--- a/libavformat/vc1test.c
+++ b/libavformat/vc1test.c
@@ -32,11 +32,16 @@
 
 #define VC1_EXTRADATA_SIZE 4
 
-static int vc1t_probe(AVProbeData *p)
+static int vc1t_probe(const AVProbeData *p)
 {
+    uint32_t size;
+
     if (p->buf_size < 24)
         return 0;
-    if (p->buf[3] != 0xC5 || AV_RL32(&p->buf[4]) != 4 || AV_RL32(&p->buf[20]) != 0xC)
+
+    size = AV_RL32(&p->buf[4]);
+    if (p->buf[3] != 0xC5 || size < 4 || size > p->buf_size - 20 ||
+        AV_RL32(&p->buf[size+16]) != 0xC)
         return 0;
 
     return AVPROBE_SCORE_EXTENSION;
@@ -46,11 +51,12 @@ static int vc1t_read_header(AVFormatContext *s)
 {
     AVIOContext *pb = s->pb;
     AVStream *st;
-    int frames;
+    int frames, ret;
     uint32_t fps;
+    uint32_t size;
 
     frames = avio_rl24(pb);
-    if(avio_r8(pb) != 0xC5 || avio_rl32(pb) != 4)
+    if (avio_r8(pb) != 0xC5 || ((size = avio_rl32(pb)) < 4))
         return AVERROR_INVALIDDATA;
 
     /* init video codec */
@@ -61,8 +67,10 @@ static int vc1t_read_header(AVFormatContext *s)
     st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO;
     st->codecpar->codec_id = AV_CODEC_ID_WMV3;
 
-    if (ff_get_extradata(s, st->codecpar, pb, VC1_EXTRADATA_SIZE) < 0)
-        return AVERROR(ENOMEM);
+    if ((ret = ff_get_extradata(s, st->codecpar, pb, VC1_EXTRADATA_SIZE)) < 0)
+        return ret;
+
+    avio_skip(pb, size - 4);
     st->codecpar->height = avio_rl32(pb);
     st->codecpar->width = avio_rl32(pb);
     if(avio_rl32(pb) != 0xC)
@@ -108,11 +116,12 @@ static int vc1t_read_packet(AVFormatContext *s,
     return pkt->size;
 }
 
-AVInputFormat ff_vc1t_demuxer = {
+const AVInputFormat ff_vc1t_demuxer = {
     .name           = "vc1test",
     .long_name      = NULL_IF_CONFIG_SMALL("VC-1 test bitstream"),
     .read_probe     = vc1t_probe,
     .read_header    = vc1t_read_header,
     .read_packet    = vc1t_read_packet,
+    .extensions     = "rcv",
     .flags          = AVFMT_GENERIC_INDEX,
 };