[05/11] svq3: Avoid a division by zero
diff mbox

Message ID 1379599756-27062-5-git-send-email-martin@martin.st
State Committed
Commit 601c2015bc16f0b281160292a6a760cbbbb0eacb
Headers show

Commit Message

Martin Storsjö Sept. 19, 2013, 2:09 p.m. 
If the height is zero, the decompression will probably end up
failing due to not fitting into the allocated buffer later
anyway, so this doesn't need any more elaborate check.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
---
 libavcodec/svq3.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Kostya Shishkov Sept. 19, 2013, 2:21 p.m. | #1 
On Thu, Sep 19, 2013 at 05:09:10PM +0300, Martin Storsjö wrote:
> If the height is zero, the decompression will probably end up
> failing due to not fitting into the allocated buffer later
> anyway, so this doesn't need any more elaborate check.
> 
> Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
> CC: libav-stable@libav.org
> ---
>  libavcodec/svq3.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
> index 82fa632..a345788 100644
> --- a/libavcodec/svq3.c
> +++ b/libavcodec/svq3.c
> @@ -980,7 +980,8 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
>              int offset                = get_bits_count(&gb) + 7 >> 3;
>              uint8_t *buf;
>  
> -            if ((uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
> +            if (watermark_height > 0 &&
> +                (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
>                  return -1;
>  
>              buf = av_malloc(buf_len);
> -- 

looks OK

Patch
diff mbox 

diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index 82fa632..a345788 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -980,7 +980,8 @@  static av_cold int svq3_decode_init(AVCodecContext *avctx)
             int offset                = get_bits_count(&gb) + 7 >> 3;
             uint8_t *buf;
 
-            if ((uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
+            if (watermark_height > 0 &&
+                (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
                 return -1;
 
             buf = av_malloc(buf_len);