[FFmpeg-devel] [PATCH] validate theora time_base

[Reimar Döffinger]

Hello,
oggparsetheora reads time_base without any checks, which cause the crash
(division by 0) in issue1240, ogv/smclock.ogv.1.0.ogv.
I also have some doubts if the values are ever properly reduced, but that is a
different issue.
This patch fixes the issue, though the default time_base from the ogg container
(IIRC corresponds to 100000 fps or something like that) is quite off, so it might
be better to just ignore the st->time_base and override it to 25 fps instead.
I leave all that to the maintainer...
Index: libavformat/oggparsetheora.c
===================================================================
--- libavformat/oggparsetheora.c	(revision 19325)
+++ libavformat/oggparsetheora.c	(working copy)
@@ -86,7 +86,10 @@
         }
         st->codec->time_base.den = get_bits_long(&gb, 32);
         st->codec->time_base.num = get_bits_long(&gb, 32);
+        if (st->codec->time_base.num > 0 && st->codec->time_base.den > 0) {
         st->time_base = st->codec->time_base;
+        } else
+            st->codec->time_base = st->time_base;
 
         st->sample_aspect_ratio.num = get_bits_long(&gb, 24);
         st->sample_aspect_ratio.den = get_bits_long(&gb, 24);