[FFmpeg-cvslog] ff_dv_frame_profile2: Check input buffer size.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Tue Oct  4 04:21:19 2011 +0200| [51b0694bc051cda2bfed048a35e694d1047c6ef0] | committer: Michael Niedermayer

ff_dv_frame_profile2: Check input buffer size.

Based on code by DivX, Inc. / drffmpeg

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=51b0694bc051cda2bfed048a35e694d1047c6ef0
---

 libavcodec/dvdata.c |    8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavcodec/dvdata.c b/libavcodec/dvdata.c
index 03e8fcc..66265bc 100644
--- a/libavcodec/dvdata.c
+++ b/libavcodec/dvdata.c
@@ -249,11 +249,13 @@ static const DVprofile dv_profiles[] = {
 const DVprofile* ff_dv_frame_profile2(AVCodecContext* codec, const DVprofile *sys,
                                   const uint8_t* frame, unsigned buf_size)
 {
-   int i;
+   int i, dsf, stype;
 
-   int dsf = (frame[3] & 0x80) >> 7;
+   if(buf_size < DV_PROFILE_BYTES)
+       return NULL;
 
-   int stype = frame[80*5 + 48 + 3] & 0x1f;
+   dsf = (frame[3] & 0x80) >> 7;
+   stype = frame[80*5 + 48 + 3] & 0x1f;
 
    /* 576i50 25Mbps 4:1:1 is a special case */
    if (dsf == 1 && stype == 0 && frame[4] & 0x07 /* the APT field */) {