PhotoRec: stricter check for .evt

1 files changed, 4 insertions, 2 deletions

diff --git a/src/file_evt.c b/src/file_evt.c
index 23773340..8f1af93d 100644
--- a/src/file_evt.c
+++ b/src/file_evt.c
@@ -85,7 +85,10 @@ static data_check_t data_check_evt(const unsigned char *buffer, const unsigned i
 static int header_check_evt(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
 {
   const struct evt_chunk *chunk=(const struct evt_chunk *)buffer;
-  if(le32(chunk->size) < 8)
+  const struct evt_chunk *chunk2=(const struct evt_chunk *)&buffer[le32(chunk->size)];
+  if(le32(chunk->size) != 0x30)
+    return 0;
+  if(le32(chunk2->size) < 8)
     return 0;
   reset_file_recovery(file_recovery_new);
   file_recovery_new->extension=file_hint_evt.extension;
@@ -98,7 +101,6 @@ static int header_check_evt(const unsigned char *buffer, const unsigned int buff
   return 1;
 }
 
-
 static void register_header_check_evt(file_stat_t *file_stat)
 {
   static const unsigned char evt_header[8]= {0x30, 0x00, 0x00, 0x00, 'L', 'f', 'L', 'e'};