diff --git a/libavformat/sierravmd.c b/libavformat/sierravmd.c index 5aa5a04dbb..5660282db2 100644 --- a/libavformat/sierravmd.c +++ b/libavformat/sierravmd.c @@ -61,10 +61,17 @@ typedef struct VmdDemuxContext { static int vmd_probe(AVProbeData *p) { + int w, h; + if (p->buf_size < 16) + return 0; /* check if the first 2 bytes of the file contain the appropriate size * of a VMD header chunk */ if (AV_RL16(&p->buf[0]) != VMD_HEADER_SIZE - 2) return 0; + w = AV_RL16(&p->buf[12]); + h = AV_RL16(&p->buf[14]); + if (!w || w > 2048 || !h || h > 2048) + return 0; /* only return half certainty since this check is a bit sketchy */ return AVPROBE_SCORE_MAX / 2;