diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-15 00:26:14 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-03 18:17:02 +0100 |
| commit | 09453e6bd363da877d0ad7cf8b6df02e6d747116 (patch) | |
| tree | 0bb6a95bf3110d5744fe490466e2be3ff31cd2af | |
| parent | bf9af661b8647c9ecbfe75e24b0aa3497c4ddd73 (diff) | |
| download | ffmpeg-09453e6bd363da877d0ad7cf8b6df02e6d747116.tar.gz | |
mtv: Fix FPE with 0 dimensions.
Fixes Ticket755
Bug Found by: Diana Elena Muscalu
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8b9b6332dfeb169098c8ab1351d66fc5b474dd55)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mtv.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/libavformat/mtv.c b/libavformat/mtv.c index 00da9a1e49..b31e4cb88f 100644 --- a/libavformat/mtv.c +++ b/libavformat/mtv.c @@ -96,16 +96,26 @@ static int mtv_read_header(AVFormatContext *s, AVFormatParameters *ap) /* Calculate width and height if missing from header */ - if(!mtv->img_width) + if(mtv->img_bpp>>3){ + if(!mtv->img_width && mtv->img_height) mtv->img_width=mtv->img_segment_size / (mtv->img_bpp>>3) / mtv->img_height; - if(!mtv->img_height) + if(!mtv->img_height && mtv->img_width) mtv->img_height=mtv->img_segment_size / (mtv->img_bpp>>3) / mtv->img_width; + } + if(!mtv->img_height || !mtv->img_width){ + av_log(s, AV_LOG_ERROR, "width or height is invalid and I cannot calculate them from other information\n"); + return AVERROR(EINVAL); + } avio_skip(pb, 4); audio_subsegments = avio_rl16(pb); + if(!audio_subsegments){ + av_log(s, AV_LOG_ERROR, "audio_subsegments is 0\n"); + return AVERROR(EINVAL); + } mtv->full_segment_size = audio_subsegments * (MTV_AUDIO_PADDING_SIZE + MTV_ASUBCHUNK_DATA_SIZE) + mtv->img_segment_size; |