This prevents a division by zero in read_packet.
Unified · Split
| @@ -25,6 +25,7 @@ · 24 unmodified lines | ||
| 25 | 25 | */ |
| 26 | 26 | |
| 27 | 27 | #include "libavutil/intreadwrite.h" |
| 28 | +#include "libavutil/imgutils.h" | |
| 28 | 29 | #include "avformat.h" |
| 29 | 30 | #include "internal.h" |
| 30 | 31 | |
| @@ -68,10 +69,8 @@ static int read_header(AVFormatContext *s) · 37 unmodified lines | ||
| 68 | 69 | st->codecpar->height = avio_rb16(pb); |
| 69 | 70 | film->leading = avio_rb16(pb); |
| 70 | 71 | |
| 71 | − if (st->codecpar->width * 4LL * st->codecpar->height >= INT_MAX) { | |
| 72 | − av_log(s, AV_LOG_ERROR, "dimensions too large\n"); | |
| 73 | − return AVERROR_PATCHWELCOME; | |
| 74 | − } | |
| 72 | + if (av_image_check_size(st->codecpar->width, st->codecpar->height, 0, s) < 0) | |
| 73 | + return AVERROR_INVALIDDATA; | |
| 75 | 74 | |
| 76 | 75 | avpriv_set_pts_info(st, 64, 1, avio_rb16(pb)); |
| 77 | 76 | |