1 files changed, 68 insertions, 7 deletions

diff --git a/libavformat/cdxl.c b/libavformat/cdxl.c
index 26a5f8161c..94a063c813 100644
--- a/libavformat/cdxl.c
+++ b/libavformat/cdxl.c
@@ -2,20 +2,20 @@
  * CDXL demuxer
  * Copyright (c) 2011-2012 Paul B Mahol
  *
- * This file is part of Libav.
+ * This file is part of FFmpeg.
  *
- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
@@ -37,8 +37,51 @@ typedef struct CDXLDemuxContext {
     uint8_t     header[CDXL_HEADER_SIZE];
     int         video_stream_index;
     int         audio_stream_index;
+    int64_t     filesize;
 } CDXLDemuxContext;
 
+static int cdxl_read_probe(AVProbeData *p)
+{
+    int score = AVPROBE_SCORE_EXTENSION + 10;
+
+    if (p->buf_size < CDXL_HEADER_SIZE)
+        return 0;
+
+    /* reserved bytes should always be set to 0 */
+    if (AV_RN64(&p->buf[24]) || AV_RN16(&p->buf[10]))
+        return 0;
+
+    /* check type */
+    if (p->buf[0] != 1)
+        return 0;
+
+    /* check palette size */
+    if (AV_RB16(&p->buf[20]) > 512)
+        return 0;
+
+    /* check number of planes */
+    if (p->buf[18] || !p->buf[19])
+        return 0;
+
+    /* check widh and height */
+    if (!AV_RN16(&p->buf[14]) || !AV_RN16(&p->buf[16]))
+        return 0;
+
+    /* chunk size */
+    if (AV_RB32(&p->buf[2]) < AV_RB16(&p->buf[22]) + AV_RB16(&p->buf[20]) + CDXL_HEADER_SIZE)
+        return 0;
+
+    /* previous chunk size */
+    if (AV_RN32(&p->buf[6]))
+        score /= 2;
+
+    /* current frame number, usually starts from 1 */
+    if (AV_RB16(&p->buf[12]) != 1)
+        score /= 2;
+
+    return score;
+}
+
 static int cdxl_read_header(AVFormatContext *s)
 {
     CDXLDemuxContext *cdxl = s->priv_data;
@@ -54,6 +97,8 @@ static int cdxl_read_header(AVFormatContext *s)
     cdxl->video_stream_index = -1;
     cdxl->audio_stream_index = -1;
 
+    cdxl->filesize = avio_size(s->pb);
+
     s->ctx_flags |= AVFMTCTX_NOHEADER;
 
     return 0;
@@ -66,9 +111,9 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
     uint32_t current_size, video_size, image_size;
     uint16_t audio_size, palette_size, width, height;
     int64_t  pos;
-    int      ret;
+    int      format, frames, ret;
 
-    if (pb->eof_reached)
+    if (avio_feof(pb))
         return AVERROR_EOF;
 
     pos = avio_tell(pb);
@@ -80,12 +125,18 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
         return AVERROR_INVALIDDATA;
     }
 
+    format       = cdxl->header[1] & 0xE0;
     current_size = AV_RB32(&cdxl->header[2]);
     width        = AV_RB16(&cdxl->header[14]);
     height       = AV_RB16(&cdxl->header[16]);
     palette_size = AV_RB16(&cdxl->header[20]);
     audio_size   = AV_RB16(&cdxl->header[22]);
-    image_size   = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
+    if (FFALIGN(width, 16) * (uint64_t)height * cdxl->header[19] > INT_MAX)
+        return AVERROR_INVALIDDATA;
+    if (format == 0x20)
+        image_size = width * height * cdxl->header[19] / 8;
+    else
+        image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8;
     video_size   = palette_size + image_size;
 
     if (palette_size > 512)
@@ -133,6 +184,15 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt)
             st->codecpar->codec_id      = AV_CODEC_ID_CDXL;
             st->codecpar->width         = width;
             st->codecpar->height        = height;
+
+            if (audio_size + video_size && cdxl->filesize > 0) {
+                frames = cdxl->filesize / (audio_size + video_size);
+
+                if(cdxl->framerate)
+                    st->duration = frames;
+                else
+                    st->duration = frames * (int64_t)audio_size;
+            }
             st->start_time           = 0;
             cdxl->video_stream_index = st->index;
             if (cdxl->framerate)
@@ -180,6 +240,7 @@ AVInputFormat ff_cdxl_demuxer = {
     .name           = "cdxl",
     .long_name      = NULL_IF_CONFIG_SMALL("Commodore CDXL video"),
     .priv_data_size = sizeof(CDXLDemuxContext),
+    .read_probe     = cdxl_read_probe,
     .read_header    = cdxl_read_header,
     .read_packet    = cdxl_read_packet,
     .extensions     = "cdxl,xl",