X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fvc1test.c;h=ff57f44b14f3f0f208f95a110114c8a3b51d0ca1;hb=11cb635c84cd5d011abc2aade27c7498bcf29595;hp=a801f4bd22e41cabe4bb08b4b13c04d0bf9a76b9;hpb=6f277e1f76121736baf98aedb2bf55d8bb413fa7;p=ffmpeg

diff --git a/libavformat/vc1test.c b/libavformat/vc1test.c
index a801f4bd22e..ff57f44b14f 100644
--- a/libavformat/vc1test.c
+++ b/libavformat/vc1test.c
@@ -32,11 +32,16 @@
 
 #define VC1_EXTRADATA_SIZE 4
 
-static int vc1t_probe(AVProbeData *p)
+static int vc1t_probe(const AVProbeData *p)
 {
+    uint32_t size;
+
     if (p->buf_size < 24)
         return 0;
-    if (p->buf[3] != 0xC5 || AV_RL32(&p->buf[4]) != 4 || AV_RL32(&p->buf[20]) != 0xC)
+
+    size = AV_RL32(&p->buf[4]);
+    if (p->buf[3] != 0xC5 || size < 4 || size > p->buf_size - 20 ||
+        AV_RL32(&p->buf[size+16]) != 0xC)
         return 0;
 
     return AVPROBE_SCORE_EXTENSION;
@@ -46,11 +51,12 @@ static int vc1t_read_header(AVFormatContext *s)
 {
     AVIOContext *pb = s->pb;
     AVStream *st;
-    int frames;
+    int frames, ret;
     uint32_t fps;
+    uint32_t size;
 
     frames = avio_rl24(pb);
-    if(avio_r8(pb) != 0xC5 || avio_rl32(pb) != 4)
+    if (avio_r8(pb) != 0xC5 || ((size = avio_rl32(pb)) < 4))
         return AVERROR_INVALIDDATA;
 
     /* init video codec */
@@ -61,8 +67,10 @@ static int vc1t_read_header(AVFormatContext *s)
     st->codecpar->codec_type = AVMEDIA_TYPE_VIDEO;
     st->codecpar->codec_id = AV_CODEC_ID_WMV3;
 
-    if (ff_get_extradata(s, st->codecpar, pb, VC1_EXTRADATA_SIZE) < 0)
-        return AVERROR(ENOMEM);
+    if ((ret = ff_get_extradata(s, st->codecpar, pb, VC1_EXTRADATA_SIZE)) < 0)
+        return ret;
+
+    avio_skip(pb, size - 4);
     st->codecpar->height = avio_rl32(pb);
     st->codecpar->width = avio_rl32(pb);
     if(avio_rl32(pb) != 0xC)
@@ -114,5 +122,6 @@ AVInputFormat ff_vc1t_demuxer = {
     .read_probe     = vc1t_probe,
     .read_header    = vc1t_read_header,
     .read_packet    = vc1t_read_packet,
+    .extensions     = "rcv",
     .flags          = AVFMT_GENERIC_INDEX,
 };