Browse code

filmstripdec: correctly check image dimensions

This prevents a division by zero in read_packet.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

Andreas Cadhalpun authored on 2016/11/14 02:22:12
Showing 1 changed files
... ...
@@ -25,6 +25,7 @@
25 25
  */
26 26
 
27 27
 #include "libavutil/intreadwrite.h"
28
+#include "libavutil/imgutils.h"
28 29
 #include "avformat.h"
29 30
 #include "internal.h"
30 31
 
... ...
@@ -68,10 +69,8 @@ static int read_header(AVFormatContext *s)
68 68
     st->codecpar->height     = avio_rb16(pb);
69 69
     film->leading         = avio_rb16(pb);
70 70
 
71
-    if (st->codecpar->width * 4LL * st->codecpar->height >= INT_MAX) {
72
-        av_log(s, AV_LOG_ERROR, "dimensions too large\n");
73
-        return AVERROR_PATCHWELCOME;
74
-    }
71
+    if (av_image_check_size(st->codecpar->width, st->codecpar->height, 0, s) < 0)
72
+        return AVERROR_INVALIDDATA;
75 73
 
76 74
     avpriv_set_pts_info(st, 64, 1, avio_rb16(pb));
77 75