X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fswfenc.c;h=8d5933e9bf05ef0aa1f8c09bd1d196f31258ec14;hb=dd6ee019ea828a2700e38366983ef343612021c6;hp=56d9879017717be2b06efcb595fd2dfcf9f76647;hpb=61344c04ca89a3eeea473dd0855a47f770a3c67b;p=ffmpeg

diff --git a/libavformat/swfenc.c b/libavformat/swfenc.c
index 56d98790177..8d5933e9bf0 100644
--- a/libavformat/swfenc.c
+++ b/libavformat/swfenc.c
@@ -256,6 +256,10 @@ static int swf_write_header(AVFormatContext *s)
                                       (will be patched if not streamed) */
 
     put_swf_rect(pb, 0, width * 20, 0, height * 20);
+    if ((rate * 256LL) / rate_base >= (1<<16)) {
+        av_log(s, AV_LOG_ERROR, "Invalid (too large) frame rate %d/%d\n", rate, rate_base);
+        return AVERROR(EINVAL);
+    }
     avio_wl16(pb, (rate * 256) / rate_base); /* frame rate */
     swf->duration_pos = avio_tell(pb);
     avio_wl16(pb, (uint16_t)(DUMMY_DURATION * (int64_t)rate / rate_base)); /* frame count */