diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-02-05 20:37:22 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-03-28 23:18:55 +0200 |
| commit | 0a5feebc5743a647712f5eac332782ca025dcc64 (patch) | |
| tree | 051c09a08a1b8b9dc7ccfdc0bf52309f8c96ad9e | |
| parent | ba92c416afdcc1f293c79ce1f57c3ff93dbe1e37 (diff) | |
| download | ffmpeg-0a5feebc5743a647712f5eac332782ca025dcc64.tar.gz | |
avformat/matroskadec: Check desc_bytes
Fixes: Division by 0
Fixes: 44035/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4826721386364928
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5038933977d06d1048b41d71e0ada4d1ac536ddc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/matroskadec.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index cb0254cc42..c70c05c55f 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -4178,12 +4178,16 @@ static int64_t webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t do { int64_t desc_bytes = desc_end.end_offset - desc_beg.start_offset; int64_t desc_ns = desc_end.end_time_ns - desc_beg.start_time_ns; - double desc_sec = desc_ns / nano_seconds_per_second; - double calc_bits_per_second = (desc_bytes * 8) / desc_sec; + double desc_sec, calc_bits_per_second, percent, mod_bits_per_second; + if (desc_bytes <= 0) + return -1; + + desc_sec = desc_ns / nano_seconds_per_second; + calc_bits_per_second = (desc_bytes * 8) / desc_sec; // Drop the bps by the percentage of bytes buffered. - double percent = (desc_bytes - prebuffer_bytes) / desc_bytes; - double mod_bits_per_second = calc_bits_per_second * percent; + percent = (desc_bytes - prebuffer_bytes) / desc_bytes; + mod_bits_per_second = calc_bits_per_second * percent; if (prebuffer < desc_sec) { double search_sec = |