[FFmpeg-cvslog] avcodec/tiff: more completely check bpp/bppcount
Michael Niedermayer
git at videolan.org
Fri Nov 28 20:02:26 CET 2014
ffmpeg | branch: release/2.1 | Michael Niedermayer <michaelni at gmx.at> | Fri Oct 3 16:08:32 2014 +0200| [ceb9d67a0ad1a4076ef349c8756ce8b732d03a34] | committer: Michael Niedermayer
avcodec/tiff: more completely check bpp/bppcount
Fixes pixel format selection
Fixes out of array accesses
Fixes: asan_heap-oob_1766029_6_asan_heap-oob_20aa045_332_cov_1823216757_m2-d1d366d7965db766c19a66c7a2ccbb6b.tif
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit e1c0cfaa419aa5d320540d5a1b3f8fd9b82ab7e5)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ceb9d67a0ad1a4076ef349c8756ce8b732d03a34
---
libavcodec/tiff.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 80c6d6e..cedab34 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -604,13 +604,13 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
s->height = value;
break;
case TIFF_BPP:
- s->bppcount = count;
- if (count > 4) {
+ if (count > 4U) {
av_log(s->avctx, AV_LOG_ERROR,
"This format is not supported (bpp=%d, %d components)\n",
- s->bpp, count);
+ value, count);
return AVERROR_INVALIDDATA;
}
+ s->bppcount = count;
if (count == 1)
s->bpp = value;
else {
@@ -628,6 +628,13 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
s->bpp = -1;
}
}
+ if (s->bpp > 64U) {
+ av_log(s->avctx, AV_LOG_ERROR,
+ "This format is not supported (bpp=%d, %d components)\n",
+ s->bpp, count);
+ s->bpp = 0;
+ return AVERROR_INVALIDDATA;
+ }
break;
case TIFF_SAMPLES_PER_PIXEL:
if (count != 1) {
More information about the ffmpeg-cvslog
mailing list