generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

iffdec: Fix integer overflow.

Browse Source 
Found-by: durandal_1707
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-07-24 05:17:36 +02:00
parent 22ce78a95e
commit 0e1925ddc4
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/iff.c
View File

@ -238,6 +238,11 @@ static int extract_header(AVCodecContext *const avctx,
s->mask_buf = av_malloc((s->planesize * 32) + FF_INPUT_BUFFER_PADDING_SIZE); s->mask_buf = av_malloc((s->planesize * 32) + FF_INPUT_BUFFER_PADDING_SIZE);
if (!s->mask_buf) if (!s->mask_buf)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
if (s->bpp > 16) {
av_log(avctx, AV_LOG_ERROR, "bpp %d too large for palette\n", s->bpp);
av_freep(&s->mask_buf);
return AVERROR(ENOMEM);
}
s->mask_palbuf = av_malloc((2 << s->bpp) * sizeof(uint32_t) + FF_INPUT_BUFFER_PADDING_SIZE); s->mask_palbuf = av_malloc((2 << s->bpp) * sizeof(uint32_t) + FF_INPUT_BUFFER_PADDING_SIZE);
if (!s->mask_palbuf) { if (!s->mask_palbuf) {
av_freep(&s->mask_buf); av_freep(&s->mask_buf);