[FFmpeg-cvslog] avformat/idcin: check the decompressed frame size during probing

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Fri Nov  8 15:03:21 2013 +0100| [4c439f6e3999ae534991ecde943e45b00c80b8d2] | committer: Michael Niedermayer

avformat/idcin: check the decompressed frame size during probing

Fixes probetest failure

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4c439f6e3999ae534991ecde943e45b00c80b8d2
---

 libavformat/idcin.c |   19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/libavformat/idcin.c b/libavformat/idcin.c
index 9671fca..f2d5548 100644
--- a/libavformat/idcin.c
+++ b/libavformat/idcin.c
@@ -94,6 +94,8 @@ typedef struct IdcinDemuxContext {
 static int idcin_probe(AVProbeData *p)
 {
     unsigned int number, sample_rate;
+    unsigned int w, h;
+    int i;
 
     /*
      * This is what you could call a "probabilistic" file check: id CIN
@@ -108,17 +110,17 @@ static int idcin_probe(AVProbeData *p)
 
     /* check we have enough data to do all checks, otherwise the
        0-padding may cause a wrong recognition */
-    if (p->buf_size < 20)
+    if (p->buf_size < 20 + HUFFMAN_TABLE_SIZE + 12)
         return 0;
 
     /* check the video width */
-    number = AV_RL32(&p->buf[0]);
-    if ((number == 0) || (number > 1024))
+    w = AV_RL32(&p->buf[0]);
+    if ((w == 0) || (w > 1024))
        return 0;
 
     /* check the video height */
-    number = AV_RL32(&p->buf[4]);
-    if ((number == 0) || (number > 1024))
+    h = AV_RL32(&p->buf[4]);
+    if ((h == 0) || (h > 1024))
        return 0;
 
     /* check the audio sample rate */
@@ -136,6 +138,13 @@ static int idcin_probe(AVProbeData *p)
     if (number > 2 || sample_rate && !number)
         return 0;
 
+    i = 20 + HUFFMAN_TABLE_SIZE;
+    if (AV_RL32(&p->buf[i]) == 1)
+        i += 768;
+
+    if (i+12 > p->buf_size || AV_RL32(&p->buf[i+8]) != w*h)
+        return 1;
+
     /* return half certainty since this check is a bit sketchy */
     return AVPROBE_SCORE_EXTENSION;
 }