Browse Source

svq3: Avoid a division by zero

If the height is zero, the decompression will probably end up
failing due to not fitting into the allocated buffer later
anyway, so this doesn't need any more elaborate check.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
tags/n2.1
Martin Storsjö 12 years ago
parent
commit
601c2015bc
1 changed files with 2 additions and 1 deletions
  1. +2
    -1
      libavcodec/svq3.c

+ 2
- 1
libavcodec/svq3.c View File

@@ -980,7 +980,8 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
int offset = get_bits_count(&gb) + 7 >> 3;
uint8_t *buf;

if ((uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
if (watermark_height > 0 &&
(uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
return -1;

buf = av_malloc(buf_len);


Loading…
Cancel
Save