virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-24 13:56:33 +02:00
Code Issues Releases Activity

tiff: do not overread the source buffer

Browse Source 
At least 2 bytes from the source are read every loop.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Luca Barbato 2013-06-03 04:53:02 +02:00
parent 999ccd2d0a
commit 9c22169769
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/tiff.c
View File

@ -224,10 +224,13 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride,
break; break;
case TIFF_PACKBITS: case TIFF_PACKBITS:
for (pixels = 0; pixels < width;) { for (pixels = 0; pixels < width;) {
if (ssrc + size - src < 2)
return AVERROR_INVALIDDATA;
code = (int8_t) *src++; code = (int8_t) *src++;
if (code >= 0) { if (code >= 0) {
code++; code++;
if (pixels + code > width) { if (pixels + code > width ||
ssrc + size - src < code) {
av_log(s->avctx, AV_LOG_ERROR, av_log(s->avctx, AV_LOG_ERROR,
"Copy went out of bounds\n"); "Copy went out of bounds\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;