1. ffmpeg
  2. Commit a613dd627cee6de5f37222f227e214a32b702412
Browse code

ffmdec: make sure the time base is valid

A negative time base can trigger assertions.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c91d81be23ffacfa3897b2bcfa77445bb0c2f89)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Andreas Cadhalpun authored on 2015/03/09 07:12:59
Showing 1 changed files
libavformat/ffmdec.c
History View file @ a613dd6
... ... 
@@ -331,6 +331,12 @@ static int ffm2_read_header(AVFormatContext *s)
331 331 
             }
332 332 
             codec->time_base.num = avio_rb32(pb);
333 333 
             codec->time_base.den = avio_rb32(pb);
334 
+            if (codec->time_base.num <= 0 || codec->time_base.den <= 0) {
335 
+                av_log(s, AV_LOG_ERROR, "Invalid time base %d/%d\n",
336 
+                       codec->time_base.num, codec->time_base.den);
337 
+                ret = AVERROR_INVALIDDATA;
338 
+                goto fail;
339 
+            }
334 340 
             codec->width = avio_rb16(pb);
335 341 
             codec->height = avio_rb16(pb);
336 342 
             codec->gop_size = avio_rb16(pb);
... ... 
@@ -503,6 +509,11 @@ static int ffm_read_header(AVFormatContext *s)
503 503 
         case AVMEDIA_TYPE_VIDEO:
504 504 
             codec->time_base.num = avio_rb32(pb);
505 505 
             codec->time_base.den = avio_rb32(pb);
506 
+            if (codec->time_base.num <= 0 || codec->time_base.den <= 0) {
507 
+                av_log(s, AV_LOG_ERROR, "Invalid time base %d/%d\n",
508 
+                       codec->time_base.num, codec->time_base.den);
509 
+                goto fail;
510 
+            }
506 511 
             codec->width = avio_rb16(pb);
507 512 
             codec->height = avio_rb16(pb);
508 513 
             codec->gop_size = avio_rb16(pb);