diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-04-12 18:22:07 -0700 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2012-04-13 09:49:13 -0700 |
| commit | 90a43060077dbbca7ef161a584e95cbc7466264d (patch) | |
| tree | 3aab88a3471257167b5dcb96a207acd9155aa6d2 | |
| parent | 99a335299ff3541f89e6e3be4b9ae84257288fcc (diff) | |
| download | ffmpeg-90a43060077dbbca7ef161a584e95cbc7466264d.tar.gz | |
tiffdec: Add a malloc check and refactor another.
| -rw-r--r-- | libavcodec/tiff.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index cafd98b0fa..26304ca3fe 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -106,13 +106,18 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uin int c, line, pixels, code; const uint8_t *ssrc = src; int width = ((s->width * s->bpp) + 7) >> 3; -#if CONFIG_ZLIB - uint8_t *zbuf; unsigned long outlen; + if (size <= 0) + return AVERROR_INVALIDDATA; + +#if CONFIG_ZLIB if(s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE){ + uint8_t *zbuf; unsigned long outlen; int ret; outlen = width * lines; zbuf = av_malloc(outlen); + if (!zbuf) + return AVERROR(ENOMEM); ret = tiff_uncompress(zbuf, &outlen, src, size); if(ret != Z_OK){ av_log(s->avctx, AV_LOG_ERROR, "Uncompressing failed (%lu of %lu) with error %d\n", outlen, (unsigned long)width * lines, ret); @@ -137,11 +142,11 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uin } if(s->compr == TIFF_CCITT_RLE || s->compr == TIFF_G3 || s->compr == TIFF_G4){ int i, ret = 0; - uint8_t *src2 = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE); + uint8_t *src2 = av_malloc((unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE); - if(!src2 || (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE < (unsigned)size){ + if (!src2) { av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n"); - return -1; + return AVERROR(ENOMEM); } if(s->fax_opts & 2){ av_log(s->avctx, AV_LOG_ERROR, "Uncompressed fax mode is not supported (yet)\n"); |