[FFmpeg-cvslog] tiff: Check buffer allocation and pointer increment more carefully in shorts2str () and double2str()
Michael Niedermayer
git at videolan.org
Tue Feb 12 23:52:13 CET 2013
ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Tue Feb 12 23:40:24 2013 +0100| [e1219cdaf9fb4bc8cea410e1caf802373c1bfe51] | committer: Michael Niedermayer
tiff: Check buffer allocation and pointer increment more carefully in shorts2str() and double2str()
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e1219cdaf9fb4bc8cea410e1caf802373c1bfe51
---
libavcodec/tiff.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 9829e92..939cfb2 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -218,10 +218,12 @@ static char *doubles2str(double *dp, int count, const char *sep)
{
int i;
char *ap, *ap0;
- int component_len;
+ uint64_t component_len;
if (!sep) sep = ", ";
- component_len = 15 + strlen(sep);
- ap = av_malloc(component_len * count);
+ component_len = 15LL + strlen(sep);
+ if (count >= (INT_MAX - 1)/component_len)
+ return NULL;
+ ap = av_malloc(component_len * count + 1);
if (!ap)
return NULL;
ap0 = ap;
@@ -242,14 +244,22 @@ static char *shorts2str(int16_t *sp, int count, const char *sep)
{
int i;
char *ap, *ap0;
+ uint64_t component_len;
if (!sep) sep = ", ";
- ap = av_malloc((5 + strlen(sep)) * count);
+ component_len = 7LL + strlen(sep);
+ if (count >= (INT_MAX - 1)/component_len)
+ return NULL;
+ ap = av_malloc(component_len * count + 1);
if (!ap)
return NULL;
ap0 = ap;
ap[0] = '\0';
for (i = 0; i < count; i++) {
- int l = snprintf(ap, 5 + strlen(sep), "%d%s", sp[i], sep);
+ unsigned l = snprintf(ap, component_len, "%d%s", sp[i], sep);
+ if (l >= component_len) {
+ av_free(ap0);
+ return NULL;
+ }
ap += l;
}
ap0[strlen(ap0) - strlen(sep)] = '\0';
More information about the ffmpeg-cvslog
mailing list