@@ -3140,8 +3140,10 @@ static int mpegts_read_header(AVFormatContext *s)
/* NOTE2: it is only the bitrate of the start of the stream */
ts->pcr_incr = (pcrs[1] - pcrs[0]) / (packet_count[1] - packet_count[0]);
ts->cur_pcr = pcrs[0] - ts->pcr_incr * packet_count[0];
- s->bit_rate = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr;
- st->codecpar->bit_rate = s->bit_rate;
+ if (ts->pcr_incr) {
+ s->bit_rate = TS_PACKET_SIZE * 8 * 27000000LL / ts->pcr_incr;
+ st->codecpar->bit_rate = s->bit_rate;
+ }
st->start_time = ts->cur_pcr;
av_log(ts->stream, AV_LOG_TRACE, "start=%0.3f pcr=%0.3f incr=%d\n",
st->start_time / 1000000.0, pcrs[0] / 27e6, ts->pcr_incr);
Fixes: division by zero Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176 Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/mpegts.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)