virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-26 19:01:44 +02:00
Code Issues Releases Activity

avcodec/tiff: assert that raw tiff dng blit does not write over the end of a line

Browse Source 
Found-by: 黄宁 <tsukimurarin@163.com>
Reviewed-by: Nick Renieris <velocityra@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-02-15 17:12:38 +01:00
parent 61e6eddc57
commit e444e5bb1a
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/tiff.c
View File

@ -704,18 +704,20 @@ static int tiff_unpack_strip(TiffContext *s, AVFrame *p, uint8_t *dst, int strid
/* Color processing for DNG images with uncompressed strips (non-tiled) */
if (is_dng) {
int is_u16, pixel_size_bytes, pixel_size_bits;
int is_u16, pixel_size_bytes, pixel_size_bits, elements;
is_u16 = (s->bpp > 8);
pixel_size_bits = (is_u16 ? 16 : 8);
pixel_size_bytes = (is_u16 ? sizeof(uint16_t) : sizeof(uint8_t));
elements = width / pixel_size_bytes * pixel_size_bits / s->bpp * s->bppcount; // need to account for [1, 16] bpp
av_assert0 (elements * pixel_size_bytes <= FFABS(stride));
dng_blit(s,
dst,
0, // no stride, only 1 line
dst,
0, // no stride, only 1 line
width / pixel_size_bytes * pixel_size_bits / s->bpp * s->bppcount, // need to account for [1, 16] bpp
elements,
1,
0, // single-component variation is only preset in JPEG-encoded DNGs
is_u16);