diff mbox series

[FFmpeg-devel,08/11] avformat/mpegts: Check pcr_incr before setting bitrate

Message ID 20201020205619.7939-8-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,01/11] avcodec/notchlc: Check uncompressed size against input for LZ4
Related show

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished

Commit Message

Michael Niedermayer Oct. 20, 2020, 8:56 p.m. UTC
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/mpegts.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Marton Balint Oct. 28, 2020, 10:54 p.m. UTC | #1
On Tue, 20 Oct 2020, Michael Niedermayer wrote:

> Fixes: division by zero
> Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
>
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> libavformat/mpegts.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
> index f750989629..3085371c58 100644
> --- a/libavformat/mpegts.c
> +++ b/libavformat/mpegts.c
> @@ -3139,8 +3139,10 @@ static int mpegts_read_header(AVFormatContext *s)
>         /* NOTE2: it is only the bitrate of the start of the stream */
>         ts->pcr_incr = (pcrs[1] - pcrs[0]) / (packet_count[1] - packet_count[0]);

Can't this cause division by zero as well?

Thanks,
Marton

>         ts->cur_pcr  = pcrs[0] - ts->pcr_incr * packet_count[0];
> -        s->bit_rate  = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr;
> -        st->codecpar->bit_rate = s->bit_rate;
> +        if (ts->pcr_incr) {
> +            s->bit_rate  = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr;
> +            st->codecpar->bit_rate = s->bit_rate;
> +        }
>         st->start_time      = ts->cur_pcr;
>         av_log(ts->stream, AV_LOG_TRACE, "start=%0.3f pcr=%0.3f incr=%d\n",
>                 st->start_time / 1000000.0, pcrs[0] / 27e6, ts->pcr_incr);
> -- 
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
diff mbox series

Patch

diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index f750989629..3085371c58 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -3139,8 +3139,10 @@  static int mpegts_read_header(AVFormatContext *s)
         /* NOTE2: it is only the bitrate of the start of the stream */
         ts->pcr_incr = (pcrs[1] - pcrs[0]) / (packet_count[1] - packet_count[0]);
         ts->cur_pcr  = pcrs[0] - ts->pcr_incr * packet_count[0];
-        s->bit_rate  = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr;
-        st->codecpar->bit_rate = s->bit_rate;
+        if (ts->pcr_incr) {
+            s->bit_rate  = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr;
+            st->codecpar->bit_rate = s->bit_rate;
+        }
         st->start_time      = ts->cur_pcr;
         av_log(ts->stream, AV_LOG_TRACE, "start=%0.3f pcr=%0.3f incr=%d\n",
                 st->start_time / 1000000.0, pcrs[0] / 27e6, ts->pcr_incr);