diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-27 22:15:32 +0000 |
|---|---|---|
| committer | Janne Grunau <janne-libav@jannau.net> | 2011-11-10 12:32:26 +0100 |
| commit | 2305742b2a0fd64cccbdfe12c9e90555c8bb798e (patch) | |
| tree | f4c34358177a478dde2fd881e224e2f7cd3d5003 /libavcodec/sunrast.c | |
| parent | 6149485f6c6c2e600987a2759d97c546d4cf5da0 (diff) | |
sunrast: Check for invalid/corrupted bitstream
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
Diffstat (limited to 'libavcodec/sunrast.c')
| -rw-r--r-- | libavcodec/sunrast.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c index 9ec1df8ae1..455619e39e 100644 --- a/libavcodec/sunrast.c +++ b/libavcodec/sunrast.c @@ -68,21 +68,25 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data, type = AV_RB32(buf+20); maptype = AV_RB32(buf+24); maplength = AV_RB32(buf+28); + buf += 32; if (type == RT_FORMAT_TIFF || type == RT_FORMAT_IFF) { av_log(avctx, AV_LOG_ERROR, "unsupported (compression) type\n"); return -1; } - if (type > RT_FORMAT_IFF) { + if (type < RT_OLD || type > RT_FORMAT_IFF) { av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n"); return -1; } + if (av_image_check_size(w, h, 0, avctx)) { + av_log(avctx, AV_LOG_ERROR, "invalid image size\n"); + return -1; + } if (maptype & ~1) { av_log(avctx, AV_LOG_ERROR, "invalid colormap type\n"); return -1; } - buf += 32; switch (depth) { case 1: @@ -102,8 +106,6 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data, if (p->data[0]) avctx->release_buffer(avctx, p); - if (av_image_check_size(w, h, 0, avctx)) - return -1; if (w != avctx->width || h != avctx->height) avcodec_set_dimensions(avctx, w, h); if (avctx->get_buffer(avctx, p) < 0) { |