diff options
| author | David Goldwich <david.goldwich@gmail.com> | 2011-12-02 05:54:20 +0100 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2011-12-04 15:20:10 +0100 |
| commit | 8ae5eb75df683069b04cf45bfa9d25fbb161c996 (patch) | |
| tree | 6d252825e5fd9adc649c248c84f9f8c013e0331e | |
| parent | e96070074db451b650d214f3e1e9df99ac11773a (diff) | |
| download | ffmpeg-8ae5eb75df683069b04cf45bfa9d25fbb161c996.tar.gz | |
oma: better format detection with small probe buffer
Signed-off-by: David Goldwich <david.goldwich@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
| -rw-r--r-- | libavformat/oma.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/libavformat/oma.c b/libavformat/oma.c index 0d81a43dfd..4f4837d63b 100644 --- a/libavformat/oma.c +++ b/libavformat/oma.c @@ -394,14 +394,20 @@ static int oma_read_probe(AVProbeData *p) unsigned tag_len = 0; buf = p->buf; - /* version must be 3 and flags byte zero */ - if (ff_id3v2_match(buf, ID3v2_EA3_MAGIC) && buf[3] == 3 && !buf[4]) - tag_len = ff_id3v2_tag_len(buf); - // This check cannot overflow as tag_len has at most 28 bits - if (p->buf_size < tag_len + 5) + if (p->buf_size < ID3v2_HEADER_SIZE || + !ff_id3v2_match(buf, ID3v2_EA3_MAGIC) || + buf[3] != 3 || // version must be 3 + buf[4]) // flags byte zero return 0; + tag_len = ff_id3v2_tag_len(buf); + + /* This check cannot overflow as tag_len has at most 28 bits */ + if (p->buf_size < tag_len + 5) + /* EA3 header comes late, might be outside of the probe buffer */ + return AVPROBE_SCORE_MAX / 2; + buf += tag_len; if (!memcmp(buf, "EA3", 3) && !buf[4] && buf[5] == EA3_HEADER_SIZE) |