diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-25 03:42:45 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-25 11:07:42 +0100 |
| commit | 46f67f4a34cab5f5686baf1605dd77d3c70740b5 (patch) | |
| tree | 349dc48cbaa1192811fd39d61ba07a24a3d08cfc | |
| parent | 82325dbec144114f213a4f29450b7f5153b6ef0f (diff) | |
avcodec/rawdec: Check height and packet size
Avoids potential division by 0
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/rawdec.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c index 0ddb521117..87cda326c0 100644 --- a/libavcodec/rawdec.c +++ b/libavcodec/rawdec.c @@ -156,13 +156,24 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame, RawVideoContext *context = avctx->priv_data; const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; - int avpkt_stride = avpkt->size / avctx->height; int linesize_align = 4; + int avpkt_stride; int res, len; int need_copy; AVFrame *frame = data; + if (avctx->height <= 0) { + av_log(avctx, AV_LOG_ERROR, "height is not set\n"); + return AVERROR_INVALIDDATA; + } + avpkt_stride = avpkt->size / avctx->height; + + if (avpkt_stride == 0) { + av_log(avctx, AV_LOG_ERROR, "Packet too small (%d) height (%d)\n", avpkt->size, avctx->height); + return AVERROR_INVALIDDATA; + } + if ((avctx->bits_per_coded_sample == 8 || avctx->bits_per_coded_sample == 4 || avctx->bits_per_coded_sample == 2 || avctx->bits_per_coded_sample == 1) && avctx->pix_fmt == AV_PIX_FMT_PAL8 && |