* [FFmpeg-devel] [PATCH] avformat/segafilmenc: Fix division by zero with malformed Cinepak data
@ 2025-11-14 20:35 Shubin123 via ffmpeg-devel
0 siblings, 0 replies; 2+ messages in thread
From: Shubin123 via ffmpeg-devel @ 2025-11-14 20:35 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Shubin123
The film_write_packet() function reads encoded_buf_size from packet
data via AV_RB24() and uses it in a modulo operation without validation.
When the data contains zeros at this position, it causes division by zero.
Add validation to return AVERROR_INVALIDDATA when encoded_buf_size is zero.
Signed-off-by: Shubin123 <wangshubin130@gmail.com>
---
libavformat/segafilmenc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavformat/segafilmenc.c b/libavformat/segafilmenc.c
index 88a5b9f972..2206ff9033 100644
--- a/libavformat/segafilmenc.c
+++ b/libavformat/segafilmenc.c
@@ -58,6 +58,10 @@ static int film_write_packet(AVFormatContext *format_context, AVPacket *pkt)
if (codec_id == AV_CODEC_ID_CINEPAK) {
encoded_buf_size = AV_RB24(&pkt->data[1]);
/* Already Sega Cinepak, so no need to reformat the packets */
+ if (encoded_buf_size == 0) {
+ av_log(format_context, AV_LOG_ERROR, "Invalid encoded_buf_size 0\n");
+ return AVERROR_INVALIDDATA;
+ }
if (encoded_buf_size != pkt->size && (pkt->size % encoded_buf_size) != 0) {
avio_write(pb, pkt->data, pkt->size);
} else {
--
2.34.1
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 2+ messages in thread
* [FFmpeg-devel] [PATCH] avformat/segafilmenc: Fix division by zero with malformed Cinepak data
@ 2025-11-13 21:10 Shubin123 via ffmpeg-devel
0 siblings, 0 replies; 2+ messages in thread
From: Shubin123 via ffmpeg-devel @ 2025-11-13 21:10 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: Shubin123
The film_write_packet() function reads encoded_buf_size from packet
data via AV_RB24() and uses it in a modulo operation without validation.
When the data contains zeros at this position, it causes division by zero.
Add validation to return AVERROR_INVALIDDATA when encoded_buf_size is zero.
Signed-off-by: Shubin123 <wangshubin130@gmail.com>
---
libavformat/segafilmenc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavformat/segafilmenc.c b/libavformat/segafilmenc.c
index 88a5b9f972..2206ff9033 100644
--- a/libavformat/segafilmenc.c
+++ b/libavformat/segafilmenc.c
@@ -58,6 +58,10 @@ static int film_write_packet(AVFormatContext *format_context, AVPacket *pkt)
if (codec_id == AV_CODEC_ID_CINEPAK) {
encoded_buf_size = AV_RB24(&pkt->data[1]);
/* Already Sega Cinepak, so no need to reformat the packets */
+ if (encoded_buf_size == 0) {
+ av_log(format_context, AV_LOG_ERROR, "Invalid encoded_buf_size 0\n");
+ return AVERROR_INVALIDDATA;
+ }
if (encoded_buf_size != pkt->size && (pkt->size % encoded_buf_size) != 0) {
avio_write(pb, pkt->data, pkt->size);
} else {
--
2.34.1
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-11-16 6:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-11-14 20:35 [FFmpeg-devel] [PATCH] avformat/segafilmenc: Fix division by zero with malformed Cinepak data Shubin123 via ffmpeg-devel
-- strict thread matches above, loose matches on Subject: below --
2025-11-13 21:10 Shubin123 via ffmpeg-devel
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git