This prevents a division by zero in read_packet.
Unified · Split
| @@ -25,6 +25,7 @@ · 24 unmodified lines | |||
| 25 | */ | 25 | */ |
| 26 | 26 | ||
| 27 | #include "libavutil/intreadwrite.h" | 27 | #include "libavutil/intreadwrite.h" |
| 28 | #include "libavutil/imgutils.h" | ||
| 28 | #include "avformat.h" | 29 | #include "avformat.h" |
| 29 | #include "internal.h" | 30 | #include "internal.h" |
| 30 | 31 | ||
| @@ -68,10 +69,8 @@ static int read_header(AVFormatContext *s) · 37 unmodified lines | |||
| 68 | st->codecpar->height = avio_rb16(pb); | 69 | st->codecpar->height = avio_rb16(pb); |
| 69 | film->leading = avio_rb16(pb); | 70 | film->leading = avio_rb16(pb); |
| 70 | 71 | ||
| 71 | if (st->codecpar->width * 4LL * st->codecpar->height >= INT_MAX) { | 72 | if (av_image_check_size(st->codecpar->width, st->codecpar->height, 0, s) < 0) |
| 72 | av_log(s, AV_LOG_ERROR, "dimensions too large\n"); | 73 | return AVERROR_INVALIDDATA; |
| 73 | return AVERROR_PATCHWELCOME; | ||
| 74 | } | ||
| 75 | 74 | ||
| 76 | avpriv_set_pts_info(st, 64, 1, avio_rb16(pb)); | 75 | avpriv_set_pts_info(st, 64, 1, avio_rb16(pb)); |
| 77 | 76 | ||