From 46f67f4a34cab5f5686baf1605dd77d3c70740b5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 25 Jan 2016 03:42:45 +0100
Subject: [PATCH] avcodec/rawdec: Check height and packet size
Avoids potential division by 0
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/rawdec.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c
index 0ddb5211174..87cda326c0c 100644
--- a/libavcodec/rawdec.c
+++ b/libavcodec/rawdec.c
@@ -156,13 +156,24 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
RawVideoContext *context = avctx->priv_data;
const uint8_t *buf = avpkt->data;
int buf_size = avpkt->size;
- int avpkt_stride = avpkt->size / avctx->height;
int linesize_align = 4;
+ int avpkt_stride;
int res, len;
int need_copy;
AVFrame *frame = data;
+ if (avctx->height <= 0) {
+ av_log(avctx, AV_LOG_ERROR, "height is not set\n");
+ return AVERROR_INVALIDDATA;
+ }
+ avpkt_stride = avpkt->size / avctx->height;
+
+ if (avpkt_stride == 0) {
+ av_log(avctx, AV_LOG_ERROR, "Packet too small (%d) height (%d)\n", avpkt->size, avctx->height);
+ return AVERROR_INVALIDDATA;
+ }
+
if ((avctx->bits_per_coded_sample == 8 || avctx->bits_per_coded_sample == 4
|| avctx->bits_per_coded_sample == 2 || avctx->bits_per_coded_sample == 1) &&
avctx->pix_fmt == AV_PIX_FMT_PAL8 &&
--
GitLab