From 55ef890b29ac47f0f5abdea166cddf853c4179df Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 6 Jul 2016 10:50:22 +0200 Subject: [PATCH] avcodec/iff: Print error for cols/bpp/bytes being bad in decode_delta_j() Signed-off-by: Michael Niedermayer --- libavcodec/iff.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/libavcodec/iff.c b/libavcodec/iff.c index 677de0fb38..90a167583b 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -865,8 +865,10 @@ static void decode_delta_j(uint8_t *dst, for (g = 0; g < groups; g++) { offset = bytestream2_get_be16(&gb); - if (cols * bpp == 0 || bytestream2_get_bytes_left(&gb) < cols * bpp) + if (cols * bpp == 0 || bytestream2_get_bytes_left(&gb) < cols * bpp) { + av_log(NULL, AV_LOG_ERROR, "cols*bpp is invalid (%d*%d)", cols, bpp); return; + } if (kludge_j) offset = ((offset / (320 / 8)) * pitch) + (offset % (320 / 8)) - kludge_j; @@ -911,8 +913,10 @@ static void decode_delta_j(uint8_t *dst, for (d = 0; d < bpp; d++) { unsigned noffset = offset + (r * pitch) + d * planepitch; - if (!bytes || bytestream2_get_bytes_left(&gb) < bytes) + if (!bytes || bytestream2_get_bytes_left(&gb) < bytes) { + av_log(NULL, AV_LOG_ERROR, "bytes %d is invalid", bytes); return; + } for (b = 0; b < bytes; b++) { uint8_t value = bytestream2_get_byte(&gb);