1 files changed, 7 insertions, 0 deletions
diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c
index 5aa5a04dbb..5660282db2 100644
--- a/libavformat/sierravmd.c
+++ b/libavformat/sierravmd.c
@@ -61,10 +61,17 @@ typedef struct VmdDemuxContext {
 
 static int vmd_probe(AVProbeData *p)
 {
+    int w, h;
+    if (p->buf_size < 16)
+        return 0;
     /* check if the first 2 bytes of the file contain the appropriate size
      * of a VMD header chunk */
     if (AV_RL16(&p->buf[0]) != VMD_HEADER_SIZE - 2)
         return 0;
+    w = AV_RL16(&p->buf[12]);
+    h = AV_RL16(&p->buf[14]);
+    if (!w || w > 2048 || !h || h > 2048)
+        return 0;
 
     /* only return half certainty since this check is a bit sketchy */
     return AVPROBE_SCORE_MAX / 2;