Improve PVA probe function.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>

libavformat/pva.c

@@ -31,13 +31,26 @@ typedef struct {
     int continue_pes;
 } PVAContext;
 
+static int pva_check(uint8_t *p) {
+    int length = AV_RB16(p + 6);
+    if (AV_RB16(p) != PVA_MAGIC || !p[2] || p[2] > 2 || p[4] != 0x55 ||
+        (p[5] & 0xe0) || length > PVA_MAX_PAYLOAD_LENGTH)
+        return -1;
+    return length + 8;
+}
+
 static int pva_probe(AVProbeData * pd) {
     unsigned char *buf = pd->buf;
+    int len = pva_check(buf);
 
-    if (AV_RB16(buf) == PVA_MAGIC && buf[2] && buf[2] < 3 && buf[4] == 0x55)
+    if (len < 0)
+        return 0;
+
+    if (pd->buf_size >= len + 8 &&
+        pva_check(buf + len) >= 0)
         return AVPROBE_SCORE_MAX / 2;
 
-    return 0;
+    return AVPROBE_SCORE_MAX / 4;
 }
 
 static int pva_read_header(AVFormatContext *s, AVFormatParameters *ap) {