avformat/idcin: check the decompressed frame size during probing

Fixes probetest failure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavformat/idcin.c

@@ -94,6 +94,8 @@ typedef struct IdcinDemuxContext {
 static int idcin_probe(AVProbeData *p)
 {
     unsigned int number, sample_rate;
+    unsigned int w, h;
+    int i;
 
     /*
      * This is what you could call a "probabilistic" file check: id CIN
@@ -108,17 +110,17 @@ static int idcin_probe(AVProbeData *p)
 
     /* check we have enough data to do all checks, otherwise the
        0-padding may cause a wrong recognition */
-    if (p->buf_size < 20)
+    if (p->buf_size < 20 + HUFFMAN_TABLE_SIZE + 12)
         return 0;
 
     /* check the video width */
-    number = AV_RL32(&p->buf[0]);
-    if ((number == 0) || (number > 1024))
+    w = AV_RL32(&p->buf[0]);
+    if ((w == 0) || (w > 1024))
        return 0;
 
     /* check the video height */
-    number = AV_RL32(&p->buf[4]);
-    if ((number == 0) || (number > 1024))
+    h = AV_RL32(&p->buf[4]);
+    if ((h == 0) || (h > 1024))
        return 0;
 
     /* check the audio sample rate */
@@ -136,6 +138,13 @@ static int idcin_probe(AVProbeData *p)
     if (number > 2 || sample_rate && !number)
         return 0;
 
+    i = 20 + HUFFMAN_TABLE_SIZE;
+    if (AV_RL32(&p->buf[i]) == 1)
+        i += 768;
+
+    if (i+12 > p->buf_size || AV_RL32(&p->buf[i+8]) != w*h)
+        return 1;
+
     /* return half certainty since this check is a bit sketchy */
     return AVPROBE_SCORE_EXTENSION;
 }