[FFmpeg-cvslog] avcodec/rawdec: Check height and packet size

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon Jan 25 03:42:45 2016 +0100| [46f67f4a34cab5f5686baf1605dd77d3c70740b5] | committer: Michael Niedermayer

avcodec/rawdec: Check height and packet size

Avoids potential division by 0

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=46f67f4a34cab5f5686baf1605dd77d3c70740b5
---

 libavcodec/rawdec.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c
index 0ddb521..87cda32 100644
--- a/libavcodec/rawdec.c
+++ b/libavcodec/rawdec.c
@@ -156,13 +156,24 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
     RawVideoContext *context       = avctx->priv_data;
     const uint8_t *buf             = avpkt->data;
     int buf_size                   = avpkt->size;
-    int avpkt_stride               = avpkt->size / avctx->height;
     int linesize_align             = 4;
+    int avpkt_stride;
     int res, len;
     int need_copy;
 
     AVFrame   *frame   = data;
 
+    if (avctx->height <= 0) {
+        av_log(avctx, AV_LOG_ERROR, "height is not set\n");
+        return AVERROR_INVALIDDATA;
+    }
+    avpkt_stride = avpkt->size / avctx->height;
+
+    if (avpkt_stride == 0) {
+        av_log(avctx, AV_LOG_ERROR, "Packet too small (%d) height (%d)\n", avpkt->size, avctx->height);
+        return AVERROR_INVALIDDATA;
+    }
+
     if ((avctx->bits_per_coded_sample == 8 || avctx->bits_per_coded_sample == 4
             || avctx->bits_per_coded_sample == 2 || avctx->bits_per_coded_sample == 1) &&
         avctx->pix_fmt == AV_PIX_FMT_PAL8 &&