| Message ID | 20201020205619.7939-8-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,01/11] avcodec/notchlc: Check uncompressed size against input for LZ4 | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
On Tue, 20 Oct 2020, Michael Niedermayer wrote: > Fixes: division by zero > Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/mpegts.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c > index f750989629..3085371c58 100644 > --- a/libavformat/mpegts.c > +++ b/libavformat/mpegts.c > @@ -3139,8 +3139,10 @@ static int mpegts_read_header(AVFormatContext *s) > /* NOTE2: it is only the bitrate of the start of the stream */ > ts->pcr_incr = (pcrs[1] - pcrs[0]) / (packet_count[1] - packet_count[0]); Can't this cause division by zero as well? Thanks, Marton > ts->cur_pcr = pcrs[0] - ts->pcr_incr * packet_count[0]; > - s->bit_rate = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr; > - st->codecpar->bit_rate = s->bit_rate; > + if (ts->pcr_incr) { > + s->bit_rate = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr; > + st->codecpar->bit_rate = s->bit_rate; > + } > st->start_time = ts->cur_pcr; > av_log(ts->stream, AV_LOG_TRACE, "start=%0.3f pcr=%0.3f incr=%d\n", > st->start_time / 1000000.0, pcrs[0] / 27e6, ts->pcr_incr); > -- > 2.17.1 > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
On Wed, Oct 28, 2020 at 11:54:16PM +0100, Marton Balint wrote: > > > On Tue, 20 Oct 2020, Michael Niedermayer wrote: > > > Fixes: division by zero > > Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavformat/mpegts.c | 6 ++++-- > > 1 file changed, 4 insertions(+), 2 deletions(-) > > > > diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c > > index f750989629..3085371c58 100644 > > --- a/libavformat/mpegts.c > > +++ b/libavformat/mpegts.c > > @@ -3139,8 +3139,10 @@ static int mpegts_read_header(AVFormatContext *s) > > /* NOTE2: it is only the bitrate of the start of the stream */ > > ts->pcr_incr = (pcrs[1] - pcrs[0]) / (packet_count[1] - packet_count[0]); > > Can't this cause division by zero as well? i think not but the patch has another issue, iwill post a better one [...]
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index f750989629..3085371c58 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -3139,8 +3139,10 @@ static int mpegts_read_header(AVFormatContext *s) /* NOTE2: it is only the bitrate of the start of the stream */ ts->pcr_incr = (pcrs[1] - pcrs[0]) / (packet_count[1] - packet_count[0]); ts->cur_pcr = pcrs[0] - ts->pcr_incr * packet_count[0]; - s->bit_rate = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr; - st->codecpar->bit_rate = s->bit_rate; + if (ts->pcr_incr) { + s->bit_rate = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr; + st->codecpar->bit_rate = s->bit_rate; + } st->start_time = ts->cur_pcr; av_log(ts->stream, AV_LOG_TRACE, "start=%0.3f pcr=%0.3f incr=%d\n", st->start_time / 1000000.0, pcrs[0] / 27e6, ts->pcr_incr);
Fixes: division by zero Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/mpegts.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)