[CVE-2016-8675]m4vdec: Check for non-startcode 00 00 00 sequences in probe

Change-Id: I0d633b26d2d264625456afd3de35e296bc90c781

diff --git a/libavformat/m4vdec.c b/libavformat/m4vdec.c
old mode 100644 (file)
new mode 100755 (executable)
index 04bd062..3ab8f2c
--- a/libavformat/m4vdec.c
+++ b/libavformat/m4vdec.c
@@ -27,24 +27,31 @@
 
 static int mpeg4video_probe(AVProbeData *probe_packet)
 {
-    uint32_t temp_buffer= -1;
-    int VO=0, VOL=0, VOP = 0, VISO = 0, res=0;
+    uint32_t temp_buffer = -1;
+    int VO = 0, VOL = 0, VOP = 0, VISO = 0, res = 0;
     int i;
 
-    for(i=0; i<probe_packet->buf_size; i++){
-        temp_buffer = (temp_buffer<<8) + probe_packet->buf[i];
-        if ((temp_buffer & 0xffffff00) != 0x100)
+    for (i = 0; i < probe_packet->buf_size; i++) {
+        temp_buffer = (temp_buffer << 8) + probe_packet->buf[i];
+        if (temp_buffer & 0xfffffe00)
+            continue;
+        if (temp_buffer < 2)
             continue;
 
-        if (temp_buffer == VOP_START_CODE)                         VOP++;
-        else if (temp_buffer == VISUAL_OBJECT_START_CODE)          VISO++;
-        else if (temp_buffer < 0x120)                              VO++;
-        else if (temp_buffer < 0x130)                              VOL++;
-        else if (   !(0x1AF < temp_buffer && temp_buffer < 0x1B7)
-                 && !(0x1B9 < temp_buffer && temp_buffer < 0x1C4)) res++;
+        if (temp_buffer == VOP_START_CODE)
+            VOP++;
+        else if (temp_buffer == VISUAL_OBJECT_START_CODE)
+            VISO++;
+        else if (temp_buffer >= 0x100 && temp_buffer < 0x120)
+            VO++;
+        else if (temp_buffer >= 0x120 && temp_buffer < 0x130)
+            VOL++;
+        else if (!(0x1AF < temp_buffer && temp_buffer < 0x1B7) &&
+                 !(0x1B9 < temp_buffer && temp_buffer < 0x1C4))
+            res++;
     }
 
-    if (VOP >= VISO && VOP >= VOL && VO >= VOL && VOL > 0 && res==0)
+    if (VOP >= VISO && VOP >= VOL && VO >= VOL && VOL > 0 && res == 0)
         return AVPROBE_SCORE_EXTENSION;
     return 0;
 }