X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fvqf.c;h=755849bac74da52b5290420e271837ee67876659;hb=4a660fac9899191d4121cde02f2a98977b1303b6;hp=d00fa5e08c61c609f7670c6263baa6cf72ec400c;hpb=f4cf6ba8c9646814af842a99335c6ee312ded299;p=ffmpeg

diff --git a/libavformat/vqf.c b/libavformat/vqf.c
index d00fa5e08c6..755849bac74 100644
--- a/libavformat/vqf.c
+++ b/libavformat/vqf.c
@@ -32,7 +32,7 @@ typedef struct VqfContext {
     int remaining_bits;
 } VqfContext;
 
-static int vqf_probe(AVProbeData *probe_packet)
+static int vqf_probe(const AVProbeData *probe_packet)
 {
     if (AV_RL32(probe_packet->buf) != MKTAG('T','W','I','N'))
         return 0;
@@ -107,6 +107,9 @@ static int vqf_read_header(AVFormatContext *s)
 
     header_size = avio_rb32(s->pb);
 
+    if (header_size < 0)
+        return AVERROR_INVALIDDATA;
+
     st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
     st->codecpar->codec_id   = AV_CODEC_ID_TWINVQ;
     st->start_time = 0;
@@ -120,7 +123,7 @@ static int vqf_read_header(AVFormatContext *s)
 
         len = avio_rb32(s->pb);
 
-        if ((unsigned) len > INT_MAX/2) {
+        if ((unsigned) len > INT_MAX/2 || header_size < 8) {
             av_log(s, AV_LOG_ERROR, "Malformed header\n");
             return -1;
         }