virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-15 14:13:16 +02:00
Code Issues Releases Activity

tiffdec: check count in metadata reading.

Browse Source 
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2012-11-09 12:13:30 +01:00
parent ce1ebb31a9
commit 6d1c5ea04a
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/tiff.c
View File

@@ -254,7 +254,7 @@ static int add_doubles_metadata(int count,
int i; int i;
double *dp; double *dp;
if (count >= INT_MAX / sizeof(int64_t)) if (count >= INT_MAX / sizeof(int64_t) || count <= 0)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int64_t)) if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int64_t))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
@@ -280,7 +280,7 @@ static int add_shorts_metadata(int count, const char *name,
int i; int i;
int16_t *sp; int16_t *sp;
if (count >= INT_MAX / sizeof(int16_t)) if (count >= INT_MAX / sizeof(int16_t) || count <= 0)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int16_t)) if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int16_t))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;