From ebf5264cd6bbda6c0c379dfeaaba3b9afc3279a8 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 14 Nov 2015 18:06:37 +0100 Subject: [PATCH] avcodec/pgssubdec: Check dimensions for 0 Fixes division by 0 Fixes: b293a6479bb4b5286cff24d356bfd955/asan_generic_225c3c9_7819_cc526b657450c6cdef1371b526499626.mkv Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/pgssubdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/pgssubdec.c b/libavcodec/pgssubdec.c index a70c84b4b0..61dc2adf95 100644 --- a/libavcodec/pgssubdec.c +++ b/libavcodec/pgssubdec.c @@ -290,8 +290,8 @@ static int parse_object_segment(AVCodecContext *avctx, height = bytestream_get_be16(&buf); /* Make sure the bitmap is not too large */ - if (avctx->width < width || avctx->height < height) { - av_log(avctx, AV_LOG_ERROR, "Bitmap dimensions larger than video.\n"); + if (avctx->width < width || avctx->height < height || !width || !height) { + av_log(avctx, AV_LOG_ERROR, "Bitmap dimensions (%dx%d) invalid.\n", width, height); return AVERROR_INVALIDDATA; }