mtv: Fix FPE with 0 dimensions.

Fixes Ticket755
Bug Found by: Diana Elena Muscalu

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavformat/mtv.c b/libavformat/mtv.c
index 00da9a1..b31e4cb 100644 (file)
--- a/libavformat/mtv.c
+++ b/libavformat/mtv.c
@@ -96,16 +96,26 @@ static int mtv_read_header(AVFormatContext *s, AVFormatParameters *ap)
 
     /* Calculate width and height if missing from header */
 
-    if(!mtv->img_width)
+    if(mtv->img_bpp>>3){
+    if(!mtv->img_width && mtv->img_height)
         mtv->img_width=mtv->img_segment_size / (mtv->img_bpp>>3)
                         / mtv->img_height;
 
-    if(!mtv->img_height)
+    if(!mtv->img_height && mtv->img_width)
         mtv->img_height=mtv->img_segment_size / (mtv->img_bpp>>3)
                         / mtv->img_width;
+    }
+    if(!mtv->img_height || !mtv->img_width){
+        av_log(s, AV_LOG_ERROR, "width or height is invalid and I cannot calculate them from other information\n");
+        return AVERROR(EINVAL);
+    }
 
     avio_skip(pb, 4);
     audio_subsegments = avio_rl16(pb);
+    if(!audio_subsegments){
+        av_log(s, AV_LOG_ERROR, "audio_subsegments is 0\n");
+        return AVERROR(EINVAL);
+    }
     mtv->full_segment_size =
         audio_subsegments * (MTV_AUDIO_PADDING_SIZE + MTV_ASUBCHUNK_DATA_SIZE) +
         mtv->img_segment_size;