RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

sunrast: Check for invalid/corrupted bitstream 

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
This commit is contained in:
Laurent Aimar 2011-09-27 22:15:32 +00:00 committed by Janne Grunau
parent 6149485f6c
commit 2305742b2a
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/sunrast.c
View File

@ -68,21 +68,25 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
type = AV_RB32(buf+20);
maptype = AV_RB32(buf+24);
maplength = AV_RB32(buf+28);
buf += 32;
if (type == RT_FORMAT_TIFF || type == RT_FORMAT_IFF) {
av_log(avctx, AV_LOG_ERROR, "unsupported (compression) type\n");
return -1;
}
if (type > RT_FORMAT_IFF) {
if (type < RT_OLD || type > RT_FORMAT_IFF) {
av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n");
return -1;
}
if (av_image_check_size(w, h, 0, avctx)) {
av_log(avctx, AV_LOG_ERROR, "invalid image size\n");
return -1;
}
if (maptype & ~1) {
av_log(avctx, AV_LOG_ERROR, "invalid colormap type\n");
return -1;
}
buf += 32;
switch (depth) {
case 1:
@ -102,8 +106,6 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
if (p->data[0])
avctx->release_buffer(avctx, p);
if (av_image_check_size(w, h, 0, avctx))
return -1;
if (w != avctx->width || h != avctx->height)
avcodec_set_dimensions(avctx, w, h);
if (avctx->get_buffer(avctx, p) < 0) {