[libav-stable] svq3: Avoid a division by zero

Martin Storsjö git at libav.org
Thu Sep 19 21:49:08 CEST 2013


Module: libav
Branch: master
Commit: 601c2015bc16f0b281160292a6a760cbbbb0eacb

Author:    Martin Storsjö <martin at martin.st>
Committer: Martin Storsjö <martin at martin.st>
Date:      Thu Sep 19 15:58:59 2013 +0300

svq3: Avoid a division by zero

If the height is zero, the decompression will probably end up
failing due to not fitting into the allocated buffer later
anyway, so this doesn't need any more elaborate check.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>

---

 libavcodec/svq3.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index 82fa632..a345788 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -980,7 +980,8 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
             int offset                = get_bits_count(&gb) + 7 >> 3;
             uint8_t *buf;
 
-            if ((uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
+            if (watermark_height > 0 &&
+                (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
                 return -1;
 
             buf = av_malloc(buf_len);



More information about the libav-stable mailing list