RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Check for invalid/corrupted bitstream in sun raster decoder. 

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Laurent Aimar 2011-09-27 21:24:03 +02:00 committed by Michael Niedermayer
parent 19e95b8845
commit b9596a5037
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
libavcodec/sunrast.c
View File

@ -68,13 +68,14 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
type = AV_RB32(buf+20); type = AV_RB32(buf+20);
maptype = AV_RB32(buf+24); maptype = AV_RB32(buf+24);
maplength = AV_RB32(buf+28); maplength = AV_RB32(buf+28);
buf += 32;
if (type == RT_FORMAT_TIFF || type == RT_FORMAT_IFF) { if (type < RT_OLD || type > RT_FORMAT_IFF) {
av_log(avctx, AV_LOG_ERROR, "unsupported (compression) type\n"); av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n");
return -1; return -1;
} }
if (type > RT_FORMAT_IFF) { if (av_image_check_size(w, h, 0, avctx)) {
av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n"); av_log(avctx, AV_LOG_ERROR, "invalid image size\n");
return -1; return -1;
} }
if (maptype & ~1) { if (maptype & ~1) {
@ -82,7 +83,10 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
return -1; return -1;
} }
buf += 32; if (type == RT_FORMAT_TIFF || type == RT_FORMAT_IFF) {
av_log(avctx, AV_LOG_ERROR, "unsupported (compression) type\n");
return -1;
}
switch (depth) { switch (depth) {
case 1: case 1:
@ -102,8 +106,6 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
if (p->data[0]) if (p->data[0])
avctx->release_buffer(avctx, p); avctx->release_buffer(avctx, p);
if (av_image_check_size(w, h, 0, avctx))
return -1;
if (w != avctx->width || h != avctx->height) if (w != avctx->width || h != avctx->height)
avcodec_set_dimensions(avctx, w, h); avcodec_set_dimensions(avctx, w, h);
if (avctx->get_buffer(avctx, p) < 0) { if (avctx->get_buffer(avctx, p) < 0) {