[FFmpeg-cvslog] avformat/img2dec: check w/h in dpx_probe

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Dec 21 23:00:36 2014 +0100| [41ee459e88093a0b7ae13b8539ed9ccd0ebd0f0b] | committer: Michael Niedermayer

avformat/img2dec: check w/h in dpx_probe

Fixes probetest failure

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=41ee459e88093a0b7ae13b8539ed9ccd0ebd0f0b
---

 libavformat/img2dec.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/libavformat/img2dec.c b/libavformat/img2dec.c
index a20868c..63de8fe 100644
--- a/libavformat/img2dec.c
+++ b/libavformat/img2dec.c
@@ -606,8 +606,17 @@ static int bmp_probe(AVProbeData *p)
 static int dpx_probe(AVProbeData *p)
 {
     const uint8_t *b = p->buf;
+    int w, h;
+    int is_big = (AV_RN32(b) == AV_RN32("SDPX"));
 
-    if (AV_RN32(b) == AV_RN32("SDPX") || AV_RN32(b) == AV_RN32("XPDS"))
+    if (p->buf_size < 0x304+8)
+        return 0;
+    w = is_big ? AV_RB32(p->buf + 0x304) : AV_RL32(p->buf + 0x304);
+    h = is_big ? AV_RB32(p->buf + 0x308) : AV_RL32(p->buf + 0x308);
+    if (w <= 0 || h <= 0)
+        return 0;
+
+    if (is_big || AV_RN32(b) == AV_RN32("XPDS"))
         return AVPROBE_SCORE_EXTENSION + 1;
     return 0;
 }