This prevents a division by zero in read_packet.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
... | ... |
@@ -25,6 +25,7 @@ |
25 | 25 |
*/ |
26 | 26 |
|
27 | 27 |
#include "libavutil/intreadwrite.h" |
28 |
+#include "libavutil/imgutils.h" |
|
28 | 29 |
#include "avformat.h" |
29 | 30 |
#include "internal.h" |
30 | 31 |
|
... | ... |
@@ -68,10 +69,8 @@ static int read_header(AVFormatContext *s) |
68 | 68 |
st->codecpar->height = avio_rb16(pb); |
69 | 69 |
film->leading = avio_rb16(pb); |
70 | 70 |
|
71 |
- if (st->codecpar->width * 4LL * st->codecpar->height >= INT_MAX) { |
|
72 |
- av_log(s, AV_LOG_ERROR, "dimensions too large\n"); |
|
73 |
- return AVERROR_PATCHWELCOME; |
|
74 |
- } |
|
71 |
+ if (av_image_check_size(st->codecpar->width, st->codecpar->height, 0, s) < 0) |
|
72 |
+ return AVERROR_INVALIDDATA; |
|
75 | 73 |
|
76 | 74 |
avpriv_set_pts_info(st, 64, 1, avio_rb16(pb)); |
77 | 75 |
|