[FFmpeg-cvslog] tiff: Check that there is no aliasing in pixel format selection

[Anton Khirnov]

ffmpeg | branch: release/2.4 | Anton Khirnov <anton at khirnov.net> | Sat Mar  7 22:06:59 2015 +0100| [77eb3d9a60a9c2bb6d87c960ac186af242bbcc9e] | committer: Luca Barbato

tiff: Check that there is no aliasing in pixel format selection

Fixes possible issues with unexpected bpp/bppcount values.

CC: libav-stable at libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-8544
(cherry picked from commit ae5e1f3d663a8c9a532d89e588cbc61f171c9186)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=77eb3d9a60a9c2bb6d87c960ac186af242bbcc9e
---

 libavcodec/tiff.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 3b2fc7d..4732e67 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -248,6 +248,14 @@ static int init_image(TiffContext *s, AVFrame *frame)
 {
     int ret;
 
+    // make sure there is no aliasing in the following switch
+    if (s->bpp >= 100 || s->bppcount >= 10) {
+        av_log(s->avctx, AV_LOG_ERROR,
+               "Unsupported image parameters: bpp=%d, bppcount=%d\n",
+               s->bpp, s->bppcount);
+        return AVERROR_INVALIDDATA;
+    }
+
     switch (s->bpp * 10 + s->bppcount) {
     case 11:
         s->avctx->pix_fmt = AV_PIX_FMT_MONOBLACK;