Vastly improved mm_probe function, passes probetest.

Originally committed as revision 19851 to svn://svn.ffmpeg.org/ffmpeg/trunk

1 files changed, 13 insertions, 1 deletions

diff --git a/libavformat/mm.c b/libavformat/mm.c
index 6c621ab493..993aebf32f 100644
--- a/libavformat/mm.c
+++ b/libavformat/mm.c
@@ -58,10 +58,22 @@ typedef struct {
 
 static int mm_probe(AVProbeData *p)
 {
+    int len, type, fps, w, h;
+    if (p->buf_size < MM_HEADER_LEN_AV + MM_PREAMBLE_SIZE)
+        return 0;
     /* the first chunk is always the header */
     if (AV_RL16(&p->buf[0]) != MM_TYPE_HEADER)
         return 0;
-    if (AV_RL32(&p->buf[2]) != MM_HEADER_LEN_V && AV_RL32(&p->buf[2]) != MM_HEADER_LEN_AV)
+    len = AV_RL32(&p->buf[2]);
+    if (len != MM_HEADER_LEN_V && len != MM_HEADER_LEN_AV)
+        return 0;
+    fps = AV_RL16(&p->buf[8]);
+    w = AV_RL16(&p->buf[12]);
+    h = AV_RL16(&p->buf[14]);
+    if (!fps || fps > 60 || !w || w > 2048 || !h || h > 2048)
+        return 0;
+    type = AV_RL16(&p->buf[len]);
+    if (!type || type > 0x31)
         return 0;
 
     /* only return half certainty since this check is a bit sketchy */