diff options
author | Michael Niedermayer <michael@niedermayer.cc> | 2020-02-19 15:15:42 +0100 |
---|---|---|
committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-05-21 13:08:23 +0200 |
commit | 70faa9f618183956d42d520f516b6d0c8e3d81ce (patch) | |
tree | 14f34190367f3de71356b0688de6081b3c35da36 /libavcodec/tiff.c | |
parent | 49459aca47d4803b2188fbf12b758bd2b01e91d7 (diff) |
avcodec/tiff: Check for Tiled and Stripped TIFFs
TIFF 6 spec: "Do not use both strip-oriented and tile-oriented fields in the same TIFF file."
Fixes: null pointer use, crash
Fixes: crash-762680f9d1b27f9b9085e12887ad44893fb2b020
Found-by: Shiziru <lunasl@protonmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/tiff.c')
-rw-r--r-- | libavcodec/tiff.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 5e4f424b67..010943c38c 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1758,6 +1758,7 @@ static int decode_frame(AVCodecContext *avctx, GetByteContext stripdata; int retry_for_subifd, retry_for_page; int is_dng; + int has_tile_bits, has_strip_bits; bytestream2_init(&s->gb, avpkt->data, avpkt->size); @@ -1885,6 +1886,14 @@ again: return AVERROR_INVALIDDATA; } + has_tile_bits = s->is_tiled || s->tile_byte_counts_offset || s->tile_offsets_offset || s->tile_width || s->tile_length || s->tile_count; + has_strip_bits = s->strippos || s->strips || s->stripoff || s->rps || s->sot || s->sstype || s->stripsize || s->stripsizesoff; + + if (has_tile_bits && has_strip_bits) { + av_log(avctx, AV_LOG_ERROR, "Tiled TIFF is not allowed to strip\n"); + return AVERROR_INVALIDDATA; + } + /* now we have the data and may start decoding */ if ((ret = init_image(s, &frame)) < 0) return ret; |