MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/icodec: ico probe with unknown data

Browse Source 
Fix cases where unknown data (data beyond p->buf_size) could produce a
higher ico probe score than if the unknown data was known and valid.
For example:
    Header:  OK, 2 frames
    Frame 0: Unknown (offset points beyond end of probe buffer)
    Frame 1: Invalid
Previously this example had a score of 25, even though the score would
be 1 if the unknown frame was known to be valid or 0 if it was known
to be invalid.  For this example the score is now 1.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Mark Harris 2016-02-15 23:52:12 -08:00 committed by Michael Niedermayer
parent e6cbe3ffef
commit 1b4fbf8080
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
libavformat/icodec.c
View File

@ -45,11 +45,14 @@ typedef struct {
static int probe(AVProbeData *p)
{
unsigned i, frames = AV_RL16(p->buf + 4);
unsigned i, frames, checked = 0;
if (AV_RL16(p->buf) || AV_RL16(p->buf + 2) != 1 || !frames)
if (p->buf_size < 22 || AV_RL16(p->buf) || AV_RL16(p->buf + 2) != 1)
return 0;
for (i = 0; i < frames; i++) {
frames = AV_RL16(p->buf + 4);
if (!frames)
return 0;
for (i = 0; i < frames && i * 16 + 22 <= p->buf_size; i++) {
unsigned offset;
if (AV_RL16(p->buf + 10 + i * 16) & ~1)
return FFMIN(i, AVPROBE_SCORE_MAX / 4);
@ -61,13 +64,14 @@ static int probe(AVProbeData *p)
if (offset < 22)
return FFMIN(i, AVPROBE_SCORE_MAX / 4);
if (offset + 8 > p->buf_size)
return AVPROBE_SCORE_MAX / 4 + FFMIN(i, 1);
continue;
if (p->buf[offset] != 40 && AV_RB64(p->buf + offset) != PNGSIG)
return FFMIN(i, AVPROBE_SCORE_MAX / 4);
if (i * 16 + 6 > p->buf_size)
return AVPROBE_SCORE_MAX / 4 + FFMIN(i, 1);
checked++;
}
if (checked < frames)
return AVPROBE_SCORE_MAX / 4 + FFMIN(checked, 1);
return AVPROBE_SCORE_MAX / 2 + 1;
}