asfdec: Account for different Format Data sizes

Some muxers may use the BMP_HEADER Format Data size instead
of the ASF-specific one.

Bug-Id: 1020
CC: libav-stable@libav.org

Signed-off-by: Diego Biurrun <diego@biurrun.de>

5 files changed, 15 insertions, 10 deletions

diff --git a/libavformat/asfdec.c b/libavformat/asfdec.c
index d602af8793..34730b20aa 100644
--- a/libavformat/asfdec.c
+++ b/libavformat/asfdec.c
@@ -691,20 +691,22 @@ static int asf_read_properties(AVFormatContext *s, const GUIDParseTable *g)
 
 static int parse_video_info(AVIOContext *pb, AVStream *st)
 {
-    uint16_t size;
+    uint16_t size_asf; // ASF-specific Format Data size
+    uint32_t size_bmp; // BMP_HEADER-specific Format Data size
     unsigned int tag;
 
     st->codecpar->width  = avio_rl32(pb);
     st->codecpar->height = avio_rl32(pb);
     avio_skip(pb, 1); // skip reserved flags
-    size = avio_rl16(pb); // size of the Format Data
-    tag  = ff_get_bmp_header(pb, st);
+    size_asf = avio_rl16(pb);
+    tag = ff_get_bmp_header(pb, st, &size_bmp);
     st->codecpar->codec_tag = tag;
     st->codecpar->codec_id  = ff_codec_get_id(ff_codec_bmp_tags, tag);
+    size_bmp = FFMAX(size_asf, size_bmp);
 
-    if (size > BMP_HEADER_SIZE) {
+    if (size_bmp > BMP_HEADER_SIZE) {
         int ret;
-        st->codecpar->extradata_size  = size - BMP_HEADER_SIZE;
+        st->codecpar->extradata_size  = size_bmp - BMP_HEADER_SIZE;
         if (!(st->codecpar->extradata = av_malloc(st->codecpar->extradata_size +
                                                AV_INPUT_BUFFER_PADDING_SIZE))) {
             st->codecpar->extradata_size = 0;
diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index 701cccb6b0..870066eb25 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -613,7 +613,7 @@ static int avi_read_header(AVFormatContext *s)
                         avio_skip(pb, size);
                         break;
                     }
-                    tag1 = ff_get_bmp_header(pb, st);
+                    tag1 = ff_get_bmp_header(pb, st, NULL);
 
                     if (tag1 == MKTAG('D', 'X', 'S', 'B') ||
                         tag1 == MKTAG('D', 'X', 'S', 'A')) {
diff --git a/libavformat/riff.h b/libavformat/riff.h
index a45c7f301c..e5f4645c12 100644
--- a/libavformat/riff.h
+++ b/libavformat/riff.h
@@ -41,9 +41,10 @@ void ff_end_tag(AVIOContext *pb, int64_t start);
 /**
  * Read BITMAPINFOHEADER structure and set AVStream codec width, height and
  * bits_per_encoded_sample fields. Does not read extradata.
+ * Writes the size of the BMP file to *size.
  * @return codec tag
  */
-int ff_get_bmp_header(AVIOContext *pb, AVStream *st);
+int ff_get_bmp_header(AVIOContext *pb, AVStream *st, uint32_t *size);
 
 void ff_put_bmp_header(AVIOContext *pb, AVCodecParameters *par, const AVCodecTag *tags, int for_asf);
 int ff_put_wav_header(AVFormatContext *s, AVIOContext *pb, AVCodecParameters *par);
diff --git a/libavformat/riffdec.c b/libavformat/riffdec.c
index 81248355e3..db83b3205a 100644
--- a/libavformat/riffdec.c
+++ b/libavformat/riffdec.c
@@ -180,10 +180,12 @@ enum AVCodecID ff_wav_codec_get_id(unsigned int tag, int bps)
     return id;
 }
 
-int ff_get_bmp_header(AVIOContext *pb, AVStream *st)
+int ff_get_bmp_header(AVIOContext *pb, AVStream *st, uint32_t *size)
 {
     int tag1;
-    avio_rl32(pb); /* size */
+    uint32_t size_ = avio_rl32(pb);
+    if (size)
+        *size = size_;
     st->codecpar->width  = avio_rl32(pb);
     st->codecpar->height = (int32_t)avio_rl32(pb);
     avio_rl16(pb); /* planes */
diff --git a/libavformat/wtv.c b/libavformat/wtv.c
index 794dd4bb71..d750cef647 100644
--- a/libavformat/wtv.c
+++ b/libavformat/wtv.c
@@ -586,7 +586,7 @@ static int parse_videoinfoheader2(AVFormatContext *s, AVStream *st)
     AVIOContext *pb = wtv->pb;
 
     avio_skip(pb, 72);  // picture aspect ratio is unreliable
-    ff_get_bmp_header(pb, st);
+    ff_get_bmp_header(pb, st, NULL);
 
     return 72 + 40;
 }