diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-10-08 01:56:25 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-10-08 02:03:40 +0200 |
| commit | 829e43017fa733479a72e6518bb9c1f0da441dc5 (patch) | |
| tree | 3aed439a815c447314574ea29481938ea1f76e97 /libavformat/r3d.c | |
| parent | 8d14e1d64ee1780f839e05c22fc633b3cf1b8579 (diff) | |
| parent | 494f2d4f9e834db1eaf1a7d0160d497f9802013d (diff) | |
| download | ffmpeg-829e43017fa733479a72e6518bb9c1f0da441dc5.tar.gz | |
Merge commit '494f2d4f9e834db1eaf1a7d0160d497f9802013d' into release/1.1
* commit '494f2d4f9e834db1eaf1a7d0160d497f9802013d':
vc1dec: Make sure last_picture is initialized in vc1_decode_skip_blocks
r3d: Add more input value validation
fraps: Make the input buffer size checks more strict
svq3: Avoid a division by zero
rmdec: Validate the fps value
twinvqdec: Check the ibps parameter separately
asfdec: Check the return value of asf_read_stream_properties
mxfdec: set audio timebase to 1/samplerate
Conflicts:
libavcodec/fraps.c
libavcodec/svq3.c
libavformat/mxfdec.c
tests/ref/fate/mxf-demux
tests/ref/seek/lavf-mxf
tests/ref/seek/lavf-mxf_d10
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/r3d.c')
| -rw-r--r-- | libavformat/r3d.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavformat/r3d.c b/libavformat/r3d.c index 35da81eff1..1c673e3720 100644 --- a/libavformat/r3d.c +++ b/libavformat/r3d.c @@ -87,7 +87,7 @@ static int r3d_read_red1(AVFormatContext *s) framerate.num = avio_rb16(s->pb); framerate.den = avio_rb16(s->pb); - if (framerate.num && framerate.den) { + if (framerate.num > 0 && framerate.den > 0) { #if FF_API_R_FRAME_RATE st->r_frame_rate = #endif @@ -285,6 +285,10 @@ static int r3d_read_reda(AVFormatContext *s, AVPacket *pkt, Atom *atom) dts = avio_rb32(s->pb); st->codec->sample_rate = avio_rb32(s->pb); + if (st->codec->sample_rate <= 0) { + av_log(s, AV_LOG_ERROR, "Bad sample rate\n"); + return AVERROR_INVALIDDATA; + } samples = avio_rb32(s->pb); |