generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tiffdec: check count in metadata reading.

Browse Source 
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6d1c5ea04a)
This commit is contained in:
Michael Niedermayer
2012-11-09 12:13:30 +01:00
parent 18817d4b80
commit 0b9be54e97
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/tiff.c
View File

@@ -250,7 +250,7 @@ static int add_doubles_metadata(int count,
int i;
double *dp;
if (count >= INT_MAX / sizeof(int64_t))
if (count >= INT_MAX / sizeof(int64_t) || count <= 0)
return AVERROR_INVALIDDATA;
if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int64_t))
return AVERROR_INVALIDDATA;
@@ -276,7 +276,7 @@ static int add_shorts_metadata(int count, const char *name,
int i;
int16_t *sp;
if (count >= INT_MAX / sizeof(int16_t))
if (count >= INT_MAX / sizeof(int16_t) || count <= 0)
return AVERROR_INVALIDDATA;
if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int16_t))
return AVERROR_INVALIDDATA;