avformat/avidec: Check required demuxing buffer sizes in guess_ni_flag()

Fixes Ticket3421

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 14 insertions, 3 deletions

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index d44f59f2b6..a4666361de 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -1542,6 +1542,7 @@ static int guess_ni_flag(AVFormatContext *s)
         return 0;
     for (min_pos=pos=0; min_pos!=INT64_MAX; pos= min_pos+1LU) {
         int64_t max_dts = INT64_MIN/2, min_dts= INT64_MAX/2;
+        int64_t max_buffer = 0;
         min_pos = INT64_MAX;
 
         for (i=0; i<s->nb_streams; i++) {
@@ -1554,10 +1555,20 @@ static int guess_ni_flag(AVFormatContext *s)
                 min_dts = FFMIN(min_dts, av_rescale_q(st->index_entries[idx[i]].timestamp/FFMAX(ast->sample_size, 1), st->time_base, AV_TIME_BASE_Q));
                 min_pos = FFMIN(min_pos, st->index_entries[idx[i]].pos);
             }
-            if (idx[i])
-                max_dts = FFMAX(max_dts, av_rescale_q(st->index_entries[idx[i]-1].timestamp/FFMAX(ast->sample_size, 1), st->time_base, AV_TIME_BASE_Q));
         }
-        if (max_dts - min_dts > 2*AV_TIME_BASE) {
+        for (i=0; i<s->nb_streams; i++) {
+            AVStream *st = s->streams[i];
+            AVIStream *ast = st->priv_data;
+
+            if (idx[i] && min_dts != INT64_MAX/2) {
+                int64_t dts = av_rescale_q(st->index_entries[idx[i]-1].timestamp/FFMAX(ast->sample_size, 1), st->time_base, AV_TIME_BASE_Q);
+                max_dts = FFMAX(max_dts, dts);
+                max_buffer = FFMAX(max_buffer, av_rescale(dts - min_dts, st->codec->bit_rate, AV_TIME_BASE));
+            }
+        }
+        if (max_dts - min_dts > 2*AV_TIME_BASE ||
+            max_buffer > 1024 * 1024 * 8 *8
+        ) {
             av_free(idx);
             return 1;
         }