diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-19 15:58:59 +0300 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2013-09-19 22:45:16 +0300 |
| commit | 601c2015bc16f0b281160292a6a760cbbbb0eacb (patch) | |
| tree | cfd927d2fd28a5c97bb15f9ecbb29c440287c536 /libavcodec | |
| parent | 7a5a55722749a3ab77941914707277b147322cbe (diff) | |
svq3: Avoid a division by zero
If the height is zero, the decompression will probably end up
failing due to not fitting into the allocated buffer later
anyway, so this doesn't need any more elaborate check.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/svq3.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index 82fa632712..a345788fb5 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -980,7 +980,8 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx) int offset = get_bits_count(&gb) + 7 >> 3; uint8_t *buf; - if ((uint64_t)watermark_width * 4 > UINT_MAX / watermark_height) + if (watermark_height > 0 && + (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height) return -1; buf = av_malloc(buf_len); |