diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-06 18:22:54 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-09 19:37:27 +0100 |
| commit | 2c60eb6c5a57160c9faacc263f8da4284746e72c (patch) | |
| tree | 263f9ee3ccfab0dd445eef2d92e4c8b5275e3751 | |
| parent | 5552ceaf568915e668679f9581e07eb5507cafc4 (diff) | |
avformat/mov: factor size out of probe code
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/mov.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/libavformat/mov.c b/libavformat/mov.c index 8eacf2cc04..9406e42f49 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -7108,9 +7108,11 @@ static int mov_probe(const AVProbeData *p) /* check file header */ offset = 0; for (;;) { + int64_t size; /* ignore invalid offset */ if ((offset + 8) > (unsigned int)p->buf_size) break; + size = AV_RB32(p->buf + offset); tag = AV_RL32(p->buf + offset + 4); switch(tag) { /* check for obvious tags */ @@ -7120,8 +7122,8 @@ static int mov_probe(const AVProbeData *p) case MKTAG('p','n','o','t'): /* detect movs with preview pics like ew.mov and april.mov */ case MKTAG('u','d','t','a'): /* Packet Video PVAuthor adds this and a lot of more junk */ case MKTAG('f','t','y','p'): - if (AV_RB32(p->buf+offset) < 8 && - (AV_RB32(p->buf+offset) != 1 || + if (size < 8 && + (size != 1 || offset + 12 > (unsigned int)p->buf_size || AV_RB64(p->buf+offset + 8) == 0)) { score = FFMAX(score, AVPROBE_SCORE_EXTENSION); @@ -7133,7 +7135,7 @@ static int mov_probe(const AVProbeData *p) } else { score = AVPROBE_SCORE_MAX; } - offset = FFMAX(4, AV_RB32(p->buf+offset)) + offset; + offset = FFMAX(4, size) + offset; break; /* those are more common words, so rate then a bit less */ case MKTAG('e','d','i','w'): /* xdcam files have reverted first tags */ @@ -7142,7 +7144,7 @@ static int mov_probe(const AVProbeData *p) case MKTAG('j','u','n','k'): case MKTAG('p','i','c','t'): score = FFMAX(score, AVPROBE_SCORE_MAX - 5); - offset = FFMAX(4, AV_RB32(p->buf+offset)) + offset; + offset = FFMAX(4, size) + offset; break; case MKTAG(0x82,0x82,0x7f,0x7d): case MKTAG('s','k','i','p'): @@ -7150,10 +7152,10 @@ static int mov_probe(const AVProbeData *p) case MKTAG('p','r','f','l'): /* if we only find those cause probedata is too small at least rate them */ score = FFMAX(score, AVPROBE_SCORE_EXTENSION); - offset = FFMAX(4, AV_RB32(p->buf+offset)) + offset; + offset = FFMAX(4, size) + offset; break; default: - offset = FFMAX(4, AV_RB32(p->buf+offset)) + offset; + offset = FFMAX(4, size) + offset; } } if (score > AVPROBE_SCORE_MAX - 50 && moov_offset != -1) { |