[FFmpeg-devel] [PATCH] lavc/hevc: check framerate num/den to be strictly positive

[Anton Khirnov]

Rather than just != 0. These values are read as uint32 and can become
negative when cast to int.
---
The only issue I see triggered by the sample is fixed by this patch. I
do not see any refPicList=NULL crashes
---
 libavcodec/hevc/hevcdec.c | 2 +-
 libavcodec/hevc/parser.c  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index 4077ed3ac5..09f7e1d31f 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -369,7 +369,7 @@ static void export_stream_params(HEVCContext *s, const HEVCSPS *sps)
         den = sps->vui.vui_time_scale;
     }
 
-    if (num != 0 && den != 0)
+    if (num > 0 && den > 0)
         av_reduce(&avctx->framerate.den, &avctx->framerate.num,
                   num, den, 1 << 30);
 }
diff --git a/libavcodec/hevc/parser.c b/libavcodec/hevc/parser.c
index 8db56e259e..2d14b4fae2 100644
--- a/libavcodec/hevc/parser.c
+++ b/libavcodec/hevc/parser.c
@@ -101,7 +101,7 @@ static int hevc_parse_slice_header(AVCodecParserContext *s, H2645NAL *nal,
         den = sps->vui.vui_time_scale;
     }
 
-    if (num != 0 && den != 0)
+    if (num > 0 && den > 0)
         av_reduce(&avctx->framerate.den, &avctx->framerate.num,
                   num, den, 1 << 30);
 
-- 
2.43.0