ff_read_timestamp: check stream_index before using it as array index
[ffmpeg.git] / libavformat / icodec.c
index 9318c16..37909aa 100644 (file)
@@ -49,7 +49,7 @@ static int probe(AVProbeData *p)
     return 0;
 }
 
-static int read_header(AVFormatContext *s, AVFormatParameters *ap)
+static int read_header(AVFormatContext *s)
 {
     IcoDemuxContext *ico = s->priv_data;
     AVIOContext *pb = s->pb;
@@ -64,6 +64,7 @@ static int read_header(AVFormatContext *s, AVFormatParameters *ap)
 
     for (i = 0; i < ico->nb_images; i++) {
         AVStream *st;
+        int tmp;
 
         if (avio_seek(pb, 6 + i * 16, SEEK_SET) < 0)
             break;
@@ -89,16 +90,20 @@ static int read_header(AVFormatContext *s, AVFormatParameters *ap)
 
         switch(avio_rl32(pb)) {
         case MKTAG(0x89, 'P', 'N', 'G'):
-            st->codec->codec_id = CODEC_ID_PNG;
+            st->codec->codec_id = AV_CODEC_ID_PNG;
             st->codec->width    = 0;
             st->codec->height   = 0;
             break;
         case 40:
-            st->codec->codec_id = CODEC_ID_BMP;
-            if (!st->codec->width || !st->codec->height) {
-                st->codec->width  = avio_rl32(pb);
-                st->codec->height = avio_rl32(pb) / 2;
-            }
+            if (ico->images[i].size < 40)
+                return AVERROR_INVALIDDATA;
+            st->codec->codec_id = AV_CODEC_ID_BMP;
+            tmp = avio_rl32(pb);
+            if (tmp)
+                st->codec->width = tmp;
+            tmp = avio_rl32(pb);
+            if (tmp)
+                st->codec->height = tmp / 2;
             break;
         default:
             av_log_ask_for_sample(s, "unsupported codec\n");
@@ -125,7 +130,7 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt)
     if ((ret = avio_seek(pb, image->offset, SEEK_SET)) < 0)
         return ret;
 
-    if (s->streams[ico->current_image]->codec->codec_id == CODEC_ID_PNG) {
+    if (s->streams[ico->current_image]->codec->codec_id == AV_CODEC_ID_PNG) {
         if ((ret = av_get_packet(pb, pkt, image->size)) < 0)
             return ret;
     } else {