avformat/utils/av_probe_input_buffer2: fix offset check

[android-x86/external-ffmpeg.git] / libavformat / utils.c

diff --git a/libavformat/utils.c b/libavformat/utils.c
index fc1ab6d..e880650 100644 (file)
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -343,7 +343,7 @@ int av_probe_input_buffer2(AVIOContext *pb, AVInputFormat **fmt,
                           unsigned int offset, unsigned int max_probe_size)
 {
     AVProbeData pd = { filename ? filename : "", NULL, -offset };
-    unsigned char *buf = NULL;
+    uint8_t *buf = NULL;
     uint8_t *mime_type;
     int ret = 0, probe_size, buf_offset = 0;
     int score = 0;
@@ -372,9 +372,6 @@ int av_probe_input_buffer2(AVIOContext *pb, AVInputFormat **fmt,
     for(probe_size= PROBE_BUF_MIN; probe_size<=max_probe_size && !*fmt;
         probe_size = FFMIN(probe_size<<1, FFMAX(max_probe_size, probe_size+1))) {
 
-        if (probe_size < offset) {
-            continue;
-        }
         score = probe_size < max_probe_size ? AVPROBE_SCORE_RETRY : 0;
 
         /* read probe data */
@@ -389,7 +386,10 @@ int av_probe_input_buffer2(AVIOContext *pb, AVInputFormat **fmt,
             score = 0;
             ret = 0;            /* error was end of file, nothing read */
         }
-        pd.buf_size = buf_offset += ret;
+        buf_offset += ret;
+        if (buf_offset < offset)
+            continue;
+        pd.buf_size = buf_offset - offset;
         pd.buf = &buf[offset];
 
         memset(pd.buf + pd.buf_size, 0, AVPROBE_PADDING_SIZE);