RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

tiffdec: check count in metadata reading. 

Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-09 12:13:30 +01:00
parent ce1ebb31a9
commit 6d1c5ea04a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/tiff.c
View File

@ -254,7 +254,7 @@ static int add_doubles_metadata(int count,
int i;
double *dp;
if (count >= INT_MAX / sizeof(int64_t))
if (count >= INT_MAX / sizeof(int64_t) || count <= 0)
return AVERROR_INVALIDDATA;
if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int64_t))
return AVERROR_INVALIDDATA;
@ -280,7 +280,7 @@ static int add_shorts_metadata(int count, const char *name,
int i;
int16_t *sp;
if (count >= INT_MAX / sizeof(int16_t))
if (count >= INT_MAX / sizeof(int16_t) || count <= 0)
return AVERROR_INVALIDDATA;
if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int16_t))
return AVERROR_INVALIDDATA;