diff mbox

[FFmpeg-devel] astdec: fix division by zero

Message ID aec628c8-ef4a-fd07-196a-726188333932@googlemail.com
State Accepted
Commit 9959a52b14bcfa3e5baeb3fc8a86c04bbc0d3d5d
Headers show

Commit Message

Andreas Cadhalpun Oct. 16, 2016, 8:41 p.m. UTC 
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
---
 libavformat/astdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Michael Niedermayer Oct. 17, 2016, 3:45 a.m. UTC | #1 
On Sun, Oct 16, 2016 at 10:41:32PM +0200, Andreas Cadhalpun wrote:
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
> ---
>  libavformat/astdec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/astdec.c b/libavformat/astdec.c
> index f3ca721..7a53d0b 100644
> --- a/libavformat/astdec.c
> +++ b/libavformat/astdec.c
> @@ -90,7 +90,7 @@ static int ast_read_packet(AVFormatContext *s, AVPacket *pkt)
>      pos  = avio_tell(s->pb);
>      type = avio_rl32(s->pb);
>      size = avio_rb32(s->pb);
> -    if (size > INT_MAX / s->streams[0]->codecpar->channels)
> +    if (!s->streams[0]->codecpar->channels || size > INT_MAX / s->streams[0]->codecpar->channels)

channels seems already checked in ast_read_header()

[...]
diff mbox

Patch

diff --git a/libavformat/astdec.c b/libavformat/astdec.c
index f3ca721..7a53d0b 100644
--- a/libavformat/astdec.c
+++ b/libavformat/astdec.c
@@ -90,7 +90,7 @@  static int ast_read_packet(AVFormatContext *s, AVPacket *pkt)
     pos  = avio_tell(s->pb);
     type = avio_rl32(s->pb);
     size = avio_rb32(s->pb);
-    if (size > INT_MAX / s->streams[0]->codecpar->channels)
+    if (!s->streams[0]->codecpar->channels || size > INT_MAX / s->streams[0]->codecpar->channels)
         return AVERROR_INVALIDDATA;
 
     size *= s->streams[0]->codecpar->channels;