From 95f97de146357660b58b6f8642742fc1dceeba9b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Fri, 1 Oct 2004 16:00:00 +0000
Subject: [PATCH] 64bit and reading over the end of the array fixes

Originally committed as revision 3547 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavformat/mpeg.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c
index cf6cb0b375..1208880d0e 100644
--- a/libavformat/mpeg.c
+++ b/libavformat/mpeg.c
@@ -1026,21 +1026,18 @@ static int mpeg_mux_end(AVFormatContext *ctx)
 
 static int mpegps_probe(AVProbeData *p)
 {
-    int code, c, i;
+    int i;
+    int size= FFMIN(20, p->buf_size);
+    uint32_t code=0xFF;
 
-    code = 0xff;
     /* we search the first start code. If it is a packet start code,
        then we decide it is mpeg ps. We do not send highest value to
        give a chance to mpegts */
     /* NOTE: the search range was restricted to avoid too many false
        detections */
 
-    if (p->buf_size < 6)
-        return 0;
-
-    for (i = 0; i < 20; i++) {
-        c = p->buf[i];
-        code = (code << 8) | c;
+    for (i = 0; i < size; i++) {
+        code = (code << 8) | p->buf[i];
         if ((code & 0xffffff00) == 0x100) {
             if (code == PACK_START_CODE ||
                 code == SYSTEM_HEADER_START_CODE ||
-- 
GitLab