From 4c439f6e3999ae534991ecde943e45b00c80b8d2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 8 Nov 2013 15:03:21 +0100 Subject: avformat/idcin: check the decompressed frame size during probing Fixes probetest failure Signed-off-by: Michael Niedermayer --- libavformat/idcin.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) (limited to 'libavformat/idcin.c') diff --git a/libavformat/idcin.c b/libavformat/idcin.c index 9671fca6f8..f2d5548a4f 100644 --- a/libavformat/idcin.c +++ b/libavformat/idcin.c @@ -94,6 +94,8 @@ typedef struct IdcinDemuxContext { static int idcin_probe(AVProbeData *p) { unsigned int number, sample_rate; + unsigned int w, h; + int i; /* * This is what you could call a "probabilistic" file check: id CIN @@ -108,17 +110,17 @@ static int idcin_probe(AVProbeData *p) /* check we have enough data to do all checks, otherwise the 0-padding may cause a wrong recognition */ - if (p->buf_size < 20) + if (p->buf_size < 20 + HUFFMAN_TABLE_SIZE + 12) return 0; /* check the video width */ - number = AV_RL32(&p->buf[0]); - if ((number == 0) || (number > 1024)) + w = AV_RL32(&p->buf[0]); + if ((w == 0) || (w > 1024)) return 0; /* check the video height */ - number = AV_RL32(&p->buf[4]); - if ((number == 0) || (number > 1024)) + h = AV_RL32(&p->buf[4]); + if ((h == 0) || (h > 1024)) return 0; /* check the audio sample rate */ @@ -136,6 +138,13 @@ static int idcin_probe(AVProbeData *p) if (number > 2 || sample_rate && !number) return 0; + i = 20 + HUFFMAN_TABLE_SIZE; + if (AV_RL32(&p->buf[i]) == 1) + i += 768; + + if (i+12 > p->buf_size || AV_RL32(&p->buf[i+8]) != w*h) + return 1; + /* return half certainty since this check is a bit sketchy */ return AVPROBE_SCORE_EXTENSION; } -- cgit v1.2.3