X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fvc1test.c;h=d44570988b5541d5565e657c4716e5f53903b499;hb=517573a67088b5c7a25c18373434e3448892ee93;hp=a801f4bd22e41cabe4bb08b4b13c04d0bf9a76b9;hpb=0ff76ca86e0ea4dcf2b392c45f5fac8e5576bb0d;p=ffmpeg

diff --git a/libavformat/vc1test.c b/libavformat/vc1test.c
index a801f4bd22e..d44570988b5 100644
--- a/libavformat/vc1test.c
+++ b/libavformat/vc1test.c
@@ -34,9 +34,14 @@
 
 static int vc1t_probe(AVProbeData *p)
 {
+    uint32_t size;
+
     if (p->buf_size < 24)
         return 0;
-    if (p->buf[3] != 0xC5 || AV_RL32(&p->buf[4]) != 4 || AV_RL32(&p->buf[20]) != 0xC)
+
+    size = AV_RL32(&p->buf[4]);
+    if (p->buf[3] != 0xC5 || size < 4 || size > p->buf_size - 20 ||
+        AV_RL32(&p->buf[size+16]) != 0xC)
         return 0;
 
     return AVPROBE_SCORE_EXTENSION;
@@ -48,9 +53,10 @@ static int vc1t_read_header(AVFormatContext *s)
     AVStream *st;
     int frames;
     uint32_t fps;
+    uint32_t size;
 
     frames = avio_rl24(pb);
-    if(avio_r8(pb) != 0xC5 || avio_rl32(pb) != 4)
+    if (avio_r8(pb) != 0xC5 || ((size = avio_rl32(pb)) < 4))
         return AVERROR_INVALIDDATA;
 
     /* init video codec */
@@ -63,6 +69,8 @@ static int vc1t_read_header(AVFormatContext *s)
 
     if (ff_get_extradata(s, st->codecpar, pb, VC1_EXTRADATA_SIZE) < 0)
         return AVERROR(ENOMEM);
+
+    avio_skip(pb, size - 4);
     st->codecpar->height = avio_rl32(pb);
     st->codecpar->width = avio_rl32(pb);
     if(avio_rl32(pb) != 0xC)
@@ -114,5 +122,6 @@ AVInputFormat ff_vc1t_demuxer = {
     .read_probe     = vc1t_probe,
     .read_header    = vc1t_read_header,
     .read_packet    = vc1t_read_packet,
+    .extensions     = "rcv",
     .flags          = AVFMT_GENERIC_INDEX,
 };