generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tiffdec: check rps, fix infinite loop.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-09 19:28:23 +01:00
parent b8dc5f8bb3
commit 02a325cb6f
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/tiff.c
View File

@ -1089,6 +1089,11 @@ static int decode_frame(AVCodecContext *avctx,
bytestream2_init(&stripdata, avpkt->data + s->strippos, avpkt->size - s->strippos);
}
if (s->rps <= 0) {
av_log(avctx, AV_LOG_ERROR, "rps %d invalid\n", s->rps);
return AVERROR_INVALIDDATA;
}
for (i = 0; i < s->height; i += s->rps) {
if (s->stripsizesoff)
ssize = tget(&stripsizes, s->sstype, s->le);