From 8b9b6332dfeb169098c8ab1351d66fc5b474dd55 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 15 Dec 2011 00:26:14 +0100 Subject: [PATCH] mtv: Fix FPE with 0 dimensions. Fixes Ticket755 Bug Found by: Diana Elena Muscalu Signed-off-by: Michael Niedermayer --- libavformat/mtv.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/libavformat/mtv.c b/libavformat/mtv.c index 00da9a1e49..b31e4cb88f 100644 --- a/libavformat/mtv.c +++ b/libavformat/mtv.c @@ -96,16 +96,26 @@ static int mtv_read_header(AVFormatContext *s, AVFormatParameters *ap) /* Calculate width and height if missing from header */ - if(!mtv->img_width) + if(mtv->img_bpp>>3){ + if(!mtv->img_width && mtv->img_height) mtv->img_width=mtv->img_segment_size / (mtv->img_bpp>>3) / mtv->img_height; - if(!mtv->img_height) + if(!mtv->img_height && mtv->img_width) mtv->img_height=mtv->img_segment_size / (mtv->img_bpp>>3) / mtv->img_width; + } + if(!mtv->img_height || !mtv->img_width){ + av_log(s, AV_LOG_ERROR, "width or height is invalid and I cannot calculate them from other information\n"); + return AVERROR(EINVAL); + } avio_skip(pb, 4); audio_subsegments = avio_rl16(pb); + if(!audio_subsegments){ + av_log(s, AV_LOG_ERROR, "audio_subsegments is 0\n"); + return AVERROR(EINVAL); + } mtv->full_segment_size = audio_subsegments * (MTV_AUDIO_PADDING_SIZE + MTV_ASUBCHUNK_DATA_SIZE) + mtv->img_segment_size;