Fix PlayResX/Y calculations

Avoid that PlayResY is set to 0 when only PlayResX is specified and
set to 1. Setting PlayResY to 0 results in divide-by-zero errors.
Also fix PlayResX calculations in case only PlayResY is specified,
for completeness.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1474.

diff --git a/libass/ass.c b/libass/ass.c
index 159391d77a4e20a139510b454deceb65fd54812c..c3bc6e52102af3dbe59fb7d246e43c75540409ac 100644 (file)
--- a/libass/ass.c
+++ b/libass/ass.c
@@ -1345,7 +1345,7 @@ void ass_lazy_track_init(ASS_Library *lib, ASS_Track *track)
             ass_msg(lib, MSGL_WARN,
                    "PlayResY undefined, setting to %d", track->PlayResY);
         } else if (track->PlayResY <= 0) {
-            track->PlayResY = track->PlayResX * 3 / 4;
+            track->PlayResY = FFMAX(1, track->PlayResX * 3 / 4);
             ass_msg(lib, MSGL_WARN,
                    "PlayResY undefined, setting to %d", track->PlayResY);
         } else if (track->PlayResX <= 0 && track->PlayResY == 1024) {
@@ -1353,7 +1353,7 @@ void ass_lazy_track_init(ASS_Library *lib, ASS_Track *track)
             ass_msg(lib, MSGL_WARN,
                    "PlayResX undefined, setting to %d", track->PlayResX);
         } else if (track->PlayResX <= 0) {
-            track->PlayResX = track->PlayResY * 4 / 3;
+            track->PlayResX = FFMAX(1, track->PlayResY * 4 / 3);
             ass_msg(lib, MSGL_WARN,
                    "PlayResX undefined, setting to %d", track->PlayResX);
         }