diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c index 0ddb52111740d861708038d21a856575233794c1..87cda326c0c355f6c8c62971637ae0b48bd65e30 100644 --- a/libavcodec/rawdec.c +++ b/libavcodec/rawdec.c @@ -156,13 +156,24 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame, RawVideoContext *context = avctx->priv_data; const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; - int avpkt_stride = avpkt->size / avctx->height; int linesize_align = 4; + int avpkt_stride; int res, len; int need_copy; AVFrame *frame = data; + if (avctx->height <= 0) { + av_log(avctx, AV_LOG_ERROR, "height is not set\n"); + return AVERROR_INVALIDDATA; + } + avpkt_stride = avpkt->size / avctx->height; + + if (avpkt_stride == 0) { + av_log(avctx, AV_LOG_ERROR, "Packet too small (%d) height (%d)\n", avpkt->size, avctx->height); + return AVERROR_INVALIDDATA; + } + if ((avctx->bits_per_coded_sample == 8 || avctx->bits_per_coded_sample == 4 || avctx->bits_per_coded_sample == 2 || avctx->bits_per_coded_sample == 1) && avctx->pix_fmt == AV_PIX_FMT_PAL8 &&