virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-28 20:53:54 +02:00
Code Issues Releases Activity

avcodec/tiff: Check bpp/bppcount for 0

Browse Source 
Fixes: division by zero
Fixes: 24253/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-6250318007107584

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit be090da25f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-08-06 21:42:43 +02:00
parent d5a63d5da4
commit 9aad7acc4e
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/tiff.c
View File

@ -819,7 +819,7 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
s->height = value;
break;
case TIFF_BPP:
if (count > 4U) {
if (count > 4 || count <= 0) {
av_log(s->avctx, AV_LOG_ERROR,
"This format is not supported (bpp=%d, %d components)\n",
value, count);
@ -850,9 +850,9 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
"Samples per pixel requires a single value, many provided\n");
return AVERROR_INVALIDDATA;
}
if (value > 4U) {
if (value > 4 || value <= 0) {
av_log(s->avctx, AV_LOG_ERROR,
"Samples per pixel %d is too large\n", value);
"Invalid samples per pixel %d\n", value);
return AVERROR_INVALIDDATA;
}
if (s->bppcount == 1)