summaryrefslogtreecommitdiff
path: root/libavcodec/tiff.c
diff options
context:
space:
mode:
Diffstat (limited to 'libavcodec/tiff.c')
-rw-r--r--libavcodec/tiff.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index edef8308b8..735eafe721 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -224,10 +224,13 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride,
break;
case TIFF_PACKBITS:
for (pixels = 0; pixels < width;) {
+ if (ssrc + size - src < 2)
+ return AVERROR_INVALIDDATA;
code = (int8_t) *src++;
if (code >= 0) {
code++;
- if (pixels + code > width) {
+ if (pixels + code > width ||
+ ssrc + size - src < code) {
av_log(s->avctx, AV_LOG_ERROR,
"Copy went out of bounds\n");
return AVERROR_INVALIDDATA;