diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-06-08 12:21:14 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-06-08 12:21:14 +0200 |
| commit | d0b27eab925cf5fb372840706a009b173418963f (patch) | |
| tree | 59ee75837a3a31532d682dd563852c62c1584413 /libavcodec/tiff.c | |
| parent | dc318505d010c600f58ab67224940b3dacf97bcd (diff) | |
| parent | 9c2216976907336dfae0e8e38a4d70ca2465a92c (diff) | |
Merge commit '9c2216976907336dfae0e8e38a4d70ca2465a92c'
* commit '9c2216976907336dfae0e8e38a4d70ca2465a92c':
tiff: do not overread the source buffer
Conflicts:
libavcodec/tiff.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/tiff.c')
| -rw-r--r-- | libavcodec/tiff.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 436d9374aa..fdfa8f2b9e 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -577,15 +577,12 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride, code = s->fill_order ? (int8_t) ff_reverse[*src++]: (int8_t) *src++; if (code >= 0) { code++; - if (pixels + code > width) { + if (pixels + code > width || + ssrc + size - src < code) { av_log(s->avctx, AV_LOG_ERROR, "Copy went out of bounds\n"); return AVERROR_INVALIDDATA; } - if (ssrc + size - src < code) { - av_log(s->avctx, AV_LOG_ERROR, "Read went out of bounds\n"); - return AVERROR_INVALIDDATA; - } horizontal_fill(s->bpp * (s->avctx->pix_fmt == AV_PIX_FMT_PAL8), dst, 1, src, 0, code, pixels); src += code; |