svq3: Avoid a division by zero
authorMartin Storsjö <martin@martin.st>
Thu, 19 Sep 2013 12:58:59 +0000 (15:58 +0300)
committerLuca Barbato <lu_zero@gentoo.org>
Tue, 7 Jan 2014 08:43:58 +0000 (09:43 +0100)
If the height is zero, the decompression will probably end up
failing due to not fitting into the allocated buffer later
anyway, so this doesn't need any more elaborate check.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 601c2015bc16f0b281160292a6a760cbbbb0eacb)

libavcodec/svq3.c

index 5097af5..601afb6 100644 (file)
@@ -902,7 +902,8 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
                 int offset = (get_bits_count(&gb)+7)>>3;
                 uint8_t *buf;
 
-                if ((uint64_t)watermark_width*4 > UINT_MAX/watermark_height)
+                if (watermark_height > 0 &&
+                    (uint64_t)watermark_width * 4 > UINT_MAX / watermark_height)
                     return -1;
 
                 buf = av_malloc(buf_len);