1 files changed, 13 insertions, 6 deletions
diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
index cc53409c69..b1fa8cc987 100644
--- a/libavformat/img2dec.c
+++ b/libavformat/img2dec.c
@@ -564,13 +564,20 @@ AVInputFormat ff_image2pipe_demuxer = {
 static int bmp_probe(AVProbeData *p)
 {
     const uint8_t *b = p->buf;
+    int ihsize;
 
-    if (AV_RB16(b) == 0x424d)
-        if (!AV_RN32(b + 6)) {
-            return AVPROBE_SCORE_EXTENSION + 1;
-        } else {
-            return AVPROBE_SCORE_EXTENSION / 4;
-        }
+    if (AV_RB16(b) != 0x424d)
+        return 0;
+
+    ihsize = AV_RL32(b+14);
+    if (ihsize < 12 || ihsize > 255)
+        return 0;
+
+    if (!AV_RN32(b + 6)) {
+        return AVPROBE_SCORE_EXTENSION + 1;
+    } else {
+        return AVPROBE_SCORE_EXTENSION / 4;
+    }
     return 0;
 }