Check buffer is inside what is passed when probing for flac.

Originally committed as revision 16825 to svn://svn.ffmpeg.org/ffmpeg/trunk
16 years ago · 16f753f43f
parent ca6532f620
commit 16f753f43f
1 changed files with 2 additions and 1 deletions
--- a/libavformat/raw.c
+++ b/libavformat/raw.c
@ -586,11 +586,12 @@ static int eac3_probe(AVProbeData *p)
 static int flac_probe(AVProbeData *p)
 {
    uint8_t *bufptr = p->buf;
+    uint8_t *end    = p->buf + p->buf_size;

    if(ff_id3v2_match(bufptr))
        bufptr += ff_id3v2_tag_len(bufptr);

-    if(memcmp(bufptr, "fLaC", 4)) return 0;
+    if(bufptr > end-4 || memcmp(bufptr, "fLaC", 4)) return 0;
    else                          return AVPROBE_SCORE_MAX / 2;
 }
 #endif