diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-02-15 16:19:08 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-04-29 23:42:35 +0200 |
| commit | 071e22312947d28032d68c3465779cbfe9532f55 (patch) | |
| tree | abdbcfeab4302a1c2b13d9f7018521825134efcc /libavcodec/tiff.c | |
| parent | aeb4e435847e0c970bcb1a835fe5eda17a4e1ce3 (diff) | |
avcodec/tiff: Some checks on bpp for DNG
dng spec 1.5.0.0
"BitsPerSample
Supported values are from 8 to 32 bits/sample. The depth must be the same for each sample if
SamplesPerPixel is not equal to 1."
Fixes: eg_crash
Found-by: 黄宁 <tsukimurarin@163.com>
Reviewed-by: Nick Renieris <velocityra@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/tiff.c')
| -rw-r--r-- | libavcodec/tiff.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 3b5985ed1e..5bdcac2006 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1858,6 +1858,8 @@ again: } if (is_dng) { + int bps; + if (s->white_level == 0) s->white_level = (1 << s->bpp) - 1; /* Default value as per the spec */ @@ -1866,6 +1868,12 @@ again: s->black_level, s->white_level); return AVERROR_INVALIDDATA; } + + if (s->bpp % s->bppcount) + return AVERROR_INVALIDDATA; + bps = s->bpp / s->bppcount; + if (bps < 8 || bps > 32) + return AVERROR_INVALIDDATA; } if (!s->is_tiled && !s->strippos && !s->stripoff) { |