diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-05-28 17:13:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-05-28 17:24:13 +0200 |
| commit | 849d4b041351ef8d77c4231cf417f997e79f9ab7 (patch) | |
| tree | a45647c0cb360ae6461843b25046ec81f9f0b7de /libavcodec/iff.c | |
| parent | 77a4c8b959fa9bc6bcaa42b40a0b046cdf3fec38 (diff) | |
iff_ilbm: fix null ptr deref
Fixes Ticket1362
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/iff.c')
| -rw-r--r-- | libavcodec/iff.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c index 0a4a983955..8946bf9858 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -191,7 +191,13 @@ static int extract_header(AVCodecContext *const avctx, const uint8_t *buf; unsigned buf_size; IffContext *s = avctx->priv_data; - int palette_size = avctx->extradata_size - AV_RB16(avctx->extradata); + int palette_size; + + if (avctx->extradata_size < 2) { + av_log(avctx, AV_LOG_ERROR, "not enough extradata\n"); + return AVERROR_INVALIDDATA; + } + palette_size = avctx->extradata_size - AV_RB16(avctx->extradata); if (avpkt) { int image_size; @@ -207,8 +213,6 @@ static int extract_header(AVCodecContext *const avctx, return AVERROR_INVALIDDATA; } } else { - if (avctx->extradata_size < 2) - return AVERROR_INVALIDDATA; buf = avctx->extradata; buf_size = bytestream_get_be16(&buf); if (buf_size <= 1 || palette_size < 0) { |