diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-05-25 19:29:18 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-05-27 17:43:40 +0200 |
| commit | 26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777 (patch) | |
| tree | 06663fe078ab1105601eca924fa73b2852b9a240 /libavcodec/exr.c | |
| parent | 48342aa0750f83006582d1598b5f22297f6dbf83 (diff) | |
avcodec/exr: More strictly check dc_count
Fixes: out of array access
Fixes: exr/deneme
Found-by: Burak Çarıkçı <burakcarikci@crypttech.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/exr.c')
| -rw-r--r-- | libavcodec/exr.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/exr.c b/libavcodec/exr.c index 9377a89169..4648ed7d62 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -1059,11 +1059,11 @@ static int dwa_uncompress(EXRContext *s, const uint8_t *src, int compressed_size bytestream2_skip(&gb, ac_size); } - if (dc_size > 0) { + { unsigned long dest_len = dc_count * 2LL; GetByteContext agb = gb; - if (dc_count > (6LL * td->xsize * td->ysize + 63) / 64) + if (dc_count != dc_w * dc_h * 3) return AVERROR_INVALIDDATA; av_fast_padded_malloc(&td->dc_data, &td->dc_size, FFALIGN(dest_len, 64) * 2); |