[FFmpeg-devel] [PATCH 2/3] avcodec/cbs_h266_syntax_template: Check num_subpic_cols for 0

[Michael Niedermayer]

Fixes: division by zero
Fixes: 60306/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5538913553612800

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/cbs_h266_syntax_template.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
index dce0216fbc..18ecf17e3b 100644
--- a/libavcodec/cbs_h266_syntax_template.c
+++ b/libavcodec/cbs_h266_syntax_template.c
@@ -1187,6 +1187,8 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
                 } else {
                     int num_subpic_cols = tmp_width_val /
                                      (current->sps_subpic_width_minus1[0] + 1);
+                    if (!num_subpic_cols)
+                        return AVERROR_INVALIDDATA;
                     infer(sps_subpic_ctu_top_left_x[i],
                           (i % num_subpic_cols) *
                           (current->sps_subpic_width_minus1[0] + 1));
-- 
2.17.1