RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-10 17:39:56 +00:00
Code Issues Projects Releases Wiki Activity

iff_ilbm: fix null ptr deref

Browse Source 
Fixes Ticket1362

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-05-28 17:13:10 +02:00
parent 77a4c8b959
commit 849d4b0413
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/iff.c
View File

@ -191,7 +191,13 @@ static int extract_header(AVCodecContext *const avctx,
const uint8_t *buf; const uint8_t *buf;
unsigned buf_size; unsigned buf_size;
IffContext *s = avctx->priv_data; IffContext *s = avctx->priv_data;
int palette_size = avctx->extradata_size - AV_RB16(avctx->extradata); int palette_size;
if (avctx->extradata_size < 2) {
av_log(avctx, AV_LOG_ERROR, "not enough extradata\n");
return AVERROR_INVALIDDATA;
}
palette_size = avctx->extradata_size - AV_RB16(avctx->extradata);
if (avpkt) { if (avpkt) {
int image_size; int image_size;
@ -207,8 +213,6 @@ static int extract_header(AVCodecContext *const avctx,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
} else { } else {
if (avctx->extradata_size < 2)
return AVERROR_INVALIDDATA;
buf = avctx->extradata; buf = avctx->extradata;
buf_size = bytestream_get_be16(&buf); buf_size = bytestream_get_be16(&buf);
if (buf_size <= 1 || palette_size < 0) { if (buf_size <= 1 || palette_size < 0) {