diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-19 15:58:59 +0300 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-10-04 04:45:34 +0200 |
| commit | 3ee5458aa8b2d789d7abedf2a4cb6aed61d09c8b (patch) | |
| tree | ac6abca0c454a2820c0388bfdb0e9ea7f1b827a3 | |
| parent | 99f953b3fe4bc43783208186a64fc38ca71ca2ea (diff) | |
| download | ffmpeg-3ee5458aa8b2d789d7abedf2a4cb6aed61d09c8b.tar.gz | |
svq3: Avoid a division by zero
If the height is zero, the decompression will probably end up
failing due to not fitting into the allocated buffer later
anyway, so this doesn't need any more elaborate check.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 601c2015bc16f0b281160292a6a760cbbbb0eacb)
| -rw-r--r-- | libavcodec/svq3.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index 683b9dc948..34cda3283c 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -956,7 +956,8 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx) int offset = get_bits_count(&gb) + 7 >> 3; uint8_t *buf; - if ((uint64_t)watermark_width * 4 > UINT_MAX / watermark_height) + if (watermark_height > 0 && + (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height) return -1; buf = av_malloc(buf_len); |