1 files changed, 46 insertions, 12 deletions

diff --git a/libavformat/mtv.c b/libavformat/mtv.c
index aad30d7a41..a91e4c8649 100644
--- a/libavformat/mtv.c
+++ b/libavformat/mtv.c
@@ -2,20 +2,20 @@
  * mtv demuxer
  * Copyright (c) 2006 Reynaldo H. Verdejo Pinochet
  *
- * This file is part of Libav.
+ * This file is part of FFmpeg.
  *
- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
@@ -32,7 +32,8 @@
 #define MTV_ASUBCHUNK_DATA_SIZE 500
 #define MTV_HEADER_SIZE 512
 #define MTV_AUDIO_PADDING_SIZE 12
-#define AUDIO_SAMPLING_RATE 44100
+#define MTV_IMAGE_DEFAULT_BPP 16
+#define MTV_AUDIO_SAMPLING_RATE 44100
 
 typedef struct MTVDemuxContext {
 
@@ -42,20 +43,30 @@ typedef struct MTVDemuxContext {
     unsigned int audio_br;          ///< bitrate of audio channel (mp3)
     unsigned int img_colorfmt;      ///< frame colorfmt rgb 565/555
     unsigned int img_bpp;           ///< frame bits per pixel
-    unsigned int img_width;         //
-    unsigned int img_height;        //
+    unsigned int img_width;
+    unsigned int img_height;
     unsigned int img_segment_size;  ///< size of image segment
-    unsigned int video_fps;         //
+    unsigned int video_fps;
     unsigned int full_segment_size;
 
 } MTVDemuxContext;
 
 static int mtv_probe(AVProbeData *p)
 {
+    /* we need at least 57 bytes from the header
+     * to try parsing all required fields
+     */
+    if (p->buf_size < 57)
+        return 0;
+
     /* Magic is 'AMV' */
     if (*p->buf != 'A' || *(p->buf + 1) != 'M' || *(p->buf + 2) != 'V')
         return 0;
 
+    /* Audio magic is always MP3 */
+    if (p->buf[43] != 'M' || p->buf[44] != 'P' || p->buf[45] != '3')
+        return 0;
+
     /* Check for nonzero in bpp and (width|height) header fields */
     if(!(p->buf[51] && AV_RL16(&p->buf[52]) | AV_RL16(&p->buf[54])))
         return 0;
@@ -69,8 +80,20 @@ static int mtv_probe(AVProbeData *p)
             return 0;
     }
 
-    if(p->buf[51] != 16)
-        return AVPROBE_SCORE_EXTENSION / 2; // But we are going to assume 16bpp anyway ..
+    /* Image bpp is not an absolutely required
+     * field as we latter claim it should be 16
+     * no matter what. All samples in the wild
+     * are RGB565/555.
+     */
+    if(p->buf[51] != MTV_IMAGE_DEFAULT_BPP)
+        return AVPROBE_SCORE_EXTENSION / 2;
+
+    /* We had enough data to parse header values
+     * but we expect to be able to get 512 bytes
+     * of header to be sure.
+     */
+    if (p->buf_size < MTV_HEADER_SIZE)
+        return AVPROBE_SCORE_EXTENSION;
 
     return AVPROBE_SCORE_MAX;
 }
@@ -94,6 +117,15 @@ static int mtv_read_header(AVFormatContext *s)
     mtv->img_height        = avio_rl16(pb);
     mtv->img_segment_size  = avio_rl16(pb);
 
+    /* Assume 16bpp even if claimed otherwise.
+     * We know its going to be RGBG565/555 anyway
+     */
+    if (mtv->img_bpp != MTV_IMAGE_DEFAULT_BPP) {
+        av_log (s, AV_LOG_WARNING, "Header claims %dbpp (!= 16). Ignoring\n",
+                mtv->img_bpp);
+        mtv->img_bpp = MTV_IMAGE_DEFAULT_BPP;
+    }
+
     /* Calculate width and height if missing from header */
 
     if (!mtv->img_width && mtv->img_height > 0 && mtv->img_bpp >= 8)
@@ -104,8 +136,10 @@ static int mtv_read_header(AVFormatContext *s)
         mtv->img_height=mtv->img_segment_size / (mtv->img_bpp>>3)
                         / mtv->img_width;
 
-    if (!mtv->img_width || !mtv->img_height)
+    if(!mtv->img_height || !mtv->img_width || !mtv->img_segment_size){
+        av_log(s, AV_LOG_ERROR, "width or height or segment_size is invalid and I cannot calculate them from other information\n");
         return AVERROR_INVALIDDATA;
+    }
 
     avio_skip(pb, 4);
     audio_subsegments = avio_rl16(pb);
@@ -145,7 +179,7 @@ static int mtv_read_header(AVFormatContext *s)
     if(!st)
         return AVERROR(ENOMEM);
 
-    avpriv_set_pts_info(st, 64, 1, AUDIO_SAMPLING_RATE);
+    avpriv_set_pts_info(st, 64, 1, MTV_AUDIO_SAMPLING_RATE);
     st->codec->codec_type      = AVMEDIA_TYPE_AUDIO;
     st->codec->codec_id        = AV_CODEC_ID_MP3;
     st->codec->bit_rate        = mtv->audio_br;