On Mon, Dec 17, 2012 at 12:55:34PM +0100, Piotr Bandurski wrote:
fixes ticket #1937
diff --git a/libavformat/cdxl.c b/libavformat/cdxl.c index 185b745..5f608bf 100644 --- a/libavformat/cdxl.c +++ b/libavformat/cdxl.c @@ -37,6 +37,7 @@ typedef struct CDXLDemuxContext { uint8_t header[CDXL_HEADER_SIZE]; int video_stream_index; int audio_stream_index; + int64_t filesize; } CDXLDemuxContext;
static int cdxl_read_probe(AVProbeData *p) @@ -95,6 +96,8 @@ static int cdxl_read_header(AVFormatContext *s) cdxl->read_chunk = 0; cdxl->video_stream_index = -1; cdxl->audio_stream_index = -1; + + cdxl->filesize = avio_size(s->pb);
s->ctx_flags |= AVFMTCTX_NOHEADER;
@@ -108,7 +111,7 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt) uint32_t current_size, video_size, image_size; uint16_t audio_size, palette_size, width, height; int64_t pos; - int ret; + int frames, ret;
if (url_feof(pb)) return AVERROR_EOF;
@@ -129,6 +132,8 @@ static int cdxl_read_packet(AVFormatContext *s, AVPacket *pkt) audio_size = AV_RB16(&cdxl->header[22]); image_size = FFALIGN(width, 16) * height * cdxl->header[19] / 8; video_size = palette_size + image_size; + + frames = cdxl->filesize / (audio_size + video_size);
i think this could cause a division by 0 [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB DNS cache poisoning attacks, popular search engine, Google internet authority dont be evil, please