From 5837e4ca3362bf1d182c1d49a9faff3f4910d00a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Reimar=20D=C3=B6ffinger?= Date: Tue, 15 Sep 2009 09:21:29 +0000 Subject: [PATCH] Vastly improved mm_probe function, passes probetest. Originally committed as revision 19851 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavformat/mm.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/libavformat/mm.c b/libavformat/mm.c index 6c621ab493..993aebf32f 100644 --- a/libavformat/mm.c +++ b/libavformat/mm.c @@ -58,10 +58,22 @@ typedef struct { static int mm_probe(AVProbeData *p) { + int len, type, fps, w, h; + if (p->buf_size < MM_HEADER_LEN_AV + MM_PREAMBLE_SIZE) + return 0; /* the first chunk is always the header */ if (AV_RL16(&p->buf[0]) != MM_TYPE_HEADER) return 0; - if (AV_RL32(&p->buf[2]) != MM_HEADER_LEN_V && AV_RL32(&p->buf[2]) != MM_HEADER_LEN_AV) + len = AV_RL32(&p->buf[2]); + if (len != MM_HEADER_LEN_V && len != MM_HEADER_LEN_AV) + return 0; + fps = AV_RL16(&p->buf[8]); + w = AV_RL16(&p->buf[12]); + h = AV_RL16(&p->buf[14]); + if (!fps || fps > 60 || !w || w > 2048 || !h || h > 2048) + return 0; + type = AV_RL16(&p->buf[len]); + if (!type || type > 0x31) return 0; /* only return half certainty since this check is a bit sketchy */