CVE-2023-4678: Divide By Zero (CWE-369)
value: Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2023-08-31T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/dasher.c, src/filters/dmx_avi.c, src/filters/reframe_mhas.c, src/scene_manager/swf_parse.c
Commit date: 2023-08-31 17:11:12 +0200
Commit message: fixed #2576

Diff: diff --git a/src/filters/dasher.c b/src/filters/dasher.c
index bc768804fd..22e8af5665 100644
--- a/src/filters/dasher.c
+++ b/src/filters/dasher.c
@@ -1171,10 +1171,15 @@ static GF_Err dasher_configure_pid(GF_Filter *filter, GF_FilterPid *pid, Bool is
 		}
 
 		CHECK_PROP(GF_PROP_PID_CODECID, ds->codec_id, GF_NOT_SUPPORTED)
 		CHECK_PROP(GF_PROP_PID_TIMESCALE, ds->timescale, GF_NOT_SUPPORTED)
 
+		if (!ds->timescale) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[Dasher] Input PID %s has no timescale, cannot dash\n", gf_filter_pid_get_name(pid) ));
+			return GF_NON_COMPLIANT_BITSTREAM;
+		}
+
 		if (ds->stream_type==GF_STREAM_VISUAL) {
 			CHECK_PROP(GF_PROP_PID_WIDTH, ds->width, GF_EOS)
 			CHECK_PROP(GF_PROP_PID_HEIGHT, ds->height, GF_EOS)
 			//don't return if not defined
 			CHECK_PROP_FRAC(GF_PROP_PID_SAR, ds->sar, GF_EOS)
diff --git a/src/filters/dmx_avi.c b/src/filters/dmx_avi.c
index 866a793f20..d5343e6884 100644
--- a/src/filters/dmx_avi.c
+++ b/src/filters/dmx_avi.c
@@ -79,10 +79,11 @@ static void avidmx_setup(GF_Filter *filter, GF_AVIDmxCtx *ctx)
 	char *comp;
 
 	if (ctx->use_file_fps) {
 		Double fps = AVI_frame_rate(ctx->avi);
 		gf_media_get_video_timing(fps, &ctx->fps.num, &ctx->fps.den);
+		if (!ctx->fps.num) ctx->fps.num = ctx->fps.den = 1000;
 	}
 
 	dur.den = ctx->fps.num;
 	dur.num = (u64) (ctx->fps.den * AVI_video_frames(ctx->avi));
 
diff --git a/src/filters/reframe_mhas.c b/src/filters/reframe_mhas.c
index 0e2bcd0a41..1b920c7177 100644
--- a/src/filters/reframe_mhas.c
+++ b/src/filters/reframe_mhas.c
@@ -636,14 +636,15 @@ GF_Err mhas_dmx_process(GF_Filter *filter)
 				CICPspeakerLayoutIdx = gf_bs_read_int(ctx->bs, 6);
 			} else {
 				numSpeakers = (s32) gf_mpegh_escaped_value(ctx->bs, 5, 8, 16) + 1;
 				//TODO ...
 			}
+			if (sr) {
+				mhas_dmx_check_pid(filter, ctx, pl, sr, frame_len, CICPspeakerLayoutIdx, numSpeakers, start + pay_start, (u32) mhas_size);
 
-			mhas_dmx_check_pid(filter, ctx, pl, sr, frame_len, CICPspeakerLayoutIdx, numSpeakers, start + pay_start, (u32) mhas_size);
-
-			has_cfg = GF_TRUE;
+				has_cfg = GF_TRUE;
+			}
 		}
 		//audio truncation
 		else if (mhas_type==17) {
 			Bool isActive = gf_bs_read_int(ctx->bs, 1);
 			/*Bool ati_reserved = */gf_bs_read_int(ctx->bs, 1);
diff --git a/src/scene_manager/swf_parse.c b/src/scene_manager/swf_parse.c
index a714500d2b..77044548c7 100644
--- a/src/scene_manager/swf_parse.c
+++ b/src/scene_manager/swf_parse.c
@@ -1436,11 +1436,11 @@ static GF_Err swf_def_font(SWFReader *read, u32 revision)
 	if (!ft) return GF_OUT_OF_MEM;
 
 	ft->glyphs = gf_list_new();
 	ft->fontID = swf_get_16(read);
 	e = GF_OK;
-
+	gf_list_add(read->fonts, ft);
 
 	if (revision==0) {
 		start = swf_get_file_pos(read);
 
 		count = swf_get_16(read);
@@ -1536,12 +1536,10 @@ static GF_Err swf_def_font(SWFReader *read, u32 revision)
 				}
 				swf_get_s16(read);
 			}
 		}
 	}
-
-	gf_list_add(read->fonts, ft);
 	return GF_OK;
 }
 
 static GF_Err swf_def_font_info(SWFReader *read)
 {
@@ -2640,10 +2638,11 @@ GF_Err gf_swf_read_header(SWFReader *read)
 
 	swf_align(read);
 	read->frame_rate = swf_get_16(read)>>8;
 	read->frame_count = swf_get_16(read);
 	GF_LOG(GF_LOG_INFO, GF_LOG_PARSER, ("SWF Import - Scene Size %gx%g - %d frames @ %d FPS\n", read->width, read->height, read->frame_count, read->frame_rate));
+	if (!read->frame_rate) read->frame_rate = 1;
 	return GF_OK;
 }
 
 GF_Err gf_swf_get_duration(SWFReader *read, u32 *frame_rate, u32 *frame_count)
 {

Vulnerable code: 			mhas_dmx_check_pid(filter, ctx, pl, sr, frame_len, CICPspeakerLayoutIdx, numSpeakers, start + pay_start, (u32) mhas_size);

			has_cfg = GF_TRUE;


	gf_list_add(read->fonts, ft);
Fixed code: 		if (!ds->timescale) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[Dasher] Input PID %s has no timescale, cannot dash\n", gf_filter_pid_get_name(pid) ));
			return GF_NON_COMPLIANT_BITSTREAM;
		}

		if (!ctx->fps.num) ctx->fps.num = ctx->fps.den = 1000;
			if (sr) {
				mhas_dmx_check_pid(filter, ctx, pl, sr, frame_len, CICPspeakerLayoutIdx, numSpeakers, start + pay_start, (u32) mhas_size);
				has_cfg = GF_TRUE;
			}
	gf_list_add(read->fonts, ft);
	if (!read->frame_rate) read->frame_rate = 1;