From 25012c56448a48487cdc9699465e640871dbcd60 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Sun, 13 Nov 2016 18:22:12 +0100 Subject: filmstripdec: correctly check image dimensions This prevents a division by zero in read_packet. Reviewed-by: Paul B Mahol Signed-off-by: Andreas Cadhalpun --- libavformat/filmstripdec.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'libavformat') diff --git a/libavformat/filmstripdec.c b/libavformat/filmstripdec.c index 414e276bfe..0aeb5947b0 100644 --- a/libavformat/filmstripdec.c +++ b/libavformat/filmstripdec.c @@ -25,6 +25,7 @@ */ #include "libavutil/intreadwrite.h" +#include "libavutil/imgutils.h" #include "avformat.h" #include "internal.h" @@ -68,10 +69,8 @@ static int read_header(AVFormatContext *s) st->codecpar->height = avio_rb16(pb); film->leading = avio_rb16(pb); - if (st->codecpar->width * 4LL * st->codecpar->height >= INT_MAX) { - av_log(s, AV_LOG_ERROR, "dimensions too large\n"); - return AVERROR_PATCHWELCOME; - } + if (av_image_check_size(st->codecpar->width, st->codecpar->height, 0, s) < 0) + return AVERROR_INVALIDDATA; avpriv_set_pts_info(st, 64, 1, avio_rb16(pb)); -- cgit v1.2.3