RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-30 03:12:08 +00:00
Code Issues Projects Releases Wiki Activity

tiff: Prevent overreads in the type_sizes array.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Alex Converse 2012-02-23 10:47:50 -08:00
parent e32548d133
commit 447363870f
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/tiff.c
View File

@ -289,6 +289,11 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
count = tget_long(&buf, s->le);
off = tget_long(&buf, s->le);
if (type == 0 || type >= FF_ARRAY_ELEMS(type_sizes)) {
av_log(s->avctx, AV_LOG_DEBUG, "Unknown tiff type (%u) encountered\n", type);
return 0;
}
if(count == 1){
switch(type){
case TIFF_BYTE:
@ -310,11 +315,13 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
value = UINT_MAX;
buf = start + off;
}
}else if(type_sizes[type] * count <= 4){
} else {
if (count <= 4 && type_sizes[type] * count <= 4) {
buf -= 4;
}else{
} else {
buf = start + off;
}
}
if(buf && (buf < start || buf > end_buf)){
av_log(s->avctx, AV_LOG_ERROR, "Tag referencing position outside the image\n");