On 09.03.2015 03:59, Michael Niedermayer wrote:
is anything using a 0/n timebase ?
I don't think so.
if not i would extend this to also disallow 0/n
OK, new patch attached.
Best regards,
Andreas
>From be6482e2ecf8ea109e9d18f578dc5a17085dde43 Mon Sep 17 00:00:00 2001
From: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
Date: Sun, 8 Mar 2015 23:12:59 +0100
Subject: [PATCH 3/8] ffmdec: make sure the time base is valid
A negative time base can trigger assertions.
Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
libavformat/ffmdec.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/libavformat/ffmdec.c b/libavformat/ffmdec.c
index 96527a3..ee34e73 100644
--- a/libavformat/ffmdec.c
+++ b/libavformat/ffmdec.c
@@ -331,6 +331,12 @@ static int ffm2_read_header(AVFormatContext *s)
}
codec->time_base.num = avio_rb32(pb);
codec->time_base.den = avio_rb32(pb);
+ if (codec->time_base.num <= 0 || codec->time_base.den <= 0) {
+ av_log(s, AV_LOG_ERROR, "Invalid time base %d/%d\n",
+ codec->time_base.num, codec->time_base.den);
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
codec->width = avio_rb16(pb);
codec->height = avio_rb16(pb);
codec->gop_size = avio_rb16(pb);
@@ -503,6 +509,11 @@ static int ffm_read_header(AVFormatContext *s)
case AVMEDIA_TYPE_VIDEO:
codec->time_base.num = avio_rb32(pb);
codec->time_base.den = avio_rb32(pb);
+ if (codec->time_base.num <= 0 || codec->time_base.den <= 0) {
+ av_log(s, AV_LOG_ERROR, "Invalid time base %d/%d\n",
+ codec->time_base.num, codec->time_base.den);
+ goto fail;
+ }
codec->width = avio_rb16(pb);
codec->height = avio_rb16(pb);
codec->gop_size = avio_rb16(pb);
--
2.1.4
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
