diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-11-13 18:22:12 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-11-27 00:46:36 +0100 |
| commit | d8ec9e97b93eddd1b44e22356e3e242649476cc9 (patch) | |
| tree | 2f1d919864a74f37bee17a3f9bcbc10b97e8f46e | |
| parent | 028c87be95dd85329f5c68d78e152d859afec7e9 (diff) | |
| download | ffmpeg-d8ec9e97b93eddd1b44e22356e3e242649476cc9.tar.gz | |
filmstripdec: correctly check image dimensions
This prevents a division by zero in read_packet.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 25012c56448a48487cdc9699465e640871dbcd60)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavformat/filmstripdec.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/libavformat/filmstripdec.c b/libavformat/filmstripdec.c index cdbb93b11a..b28854fa5e 100644 --- a/libavformat/filmstripdec.c +++ b/libavformat/filmstripdec.c @@ -25,6 +25,7 @@ */ #include "libavutil/intreadwrite.h" +#include "libavutil/imgutils.h" #include "avformat.h" #include "internal.h" @@ -68,10 +69,8 @@ static int read_header(AVFormatContext *s) st->codec->height = avio_rb16(pb); film->leading = avio_rb16(pb); - if (st->codec->width * 4LL * st->codec->height >= INT_MAX) { - av_log(s, AV_LOG_ERROR, "dimensions too large\n"); - return AVERROR_PATCHWELCOME; - } + if (av_image_check_size(st->codec->width, st->codec->height, 0, s) < 0) + return AVERROR_INVALIDDATA; avpriv_set_pts_info(st, 64, 1, avio_rb16(pb)); |