From 46f67f4a34cab5f5686baf1605dd77d3c70740b5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 25 Jan 2016 03:42:45 +0100 Subject: avcodec/rawdec: Check height and packet size Avoids potential division by 0 Signed-off-by: Michael Niedermayer --- libavcodec/rawdec.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'libavcodec/rawdec.c') diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c index 0ddb521117..87cda326c0 100644 --- a/libavcodec/rawdec.c +++ b/libavcodec/rawdec.c @@ -156,13 +156,24 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame, RawVideoContext *context = avctx->priv_data; const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; - int avpkt_stride = avpkt->size / avctx->height; int linesize_align = 4; + int avpkt_stride; int res, len; int need_copy; AVFrame *frame = data; + if (avctx->height <= 0) { + av_log(avctx, AV_LOG_ERROR, "height is not set\n"); + return AVERROR_INVALIDDATA; + } + avpkt_stride = avpkt->size / avctx->height; + + if (avpkt_stride == 0) { + av_log(avctx, AV_LOG_ERROR, "Packet too small (%d) height (%d)\n", avpkt->size, avctx->height); + return AVERROR_INVALIDDATA; + } + if ((avctx->bits_per_coded_sample == 8 || avctx->bits_per_coded_sample == 4 || avctx->bits_per_coded_sample == 2 || avctx->bits_per_coded_sample == 1) && avctx->pix_fmt == AV_PIX_FMT_PAL8 && -- cgit v1.2.3