diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-06-09 11:06:28 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-06-09 11:06:28 +0200 |
| commit | 01580c0955f9fba6a1a04b85eaa2f2ec5e234bf6 (patch) | |
| tree | 53a3afc35b316c74018be1781ae82983dc6a7a28 | |
| parent | 2fae70db2ac2ffaf7968637fe4f111a24e7e4351 (diff) | |
| parent | 8eb7c2566ca20392315618cda4a635b19cbb8e21 (diff) | |
| download | ffmpeg-01580c0955f9fba6a1a04b85eaa2f2ec5e234bf6.tar.gz | |
Merge remote-tracking branch 'qatar/release/9' into release/1.1
* qatar/release/9:
tiff: do not overread the source buffer
apetag: use int64_t for filesize
Conflicts:
libavcodec/tiff.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/tiff.c | 7 | ||||
| -rw-r--r-- | libavformat/apetag.c | 2 |
2 files changed, 3 insertions, 6 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 1011116f41..0824934025 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -548,15 +548,12 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride, code = (int8_t) * src++; if (code >= 0) { code++; - if (pixels + code > width) { + if (pixels + code > width || + ssrc + size - src < code) { av_log(s->avctx, AV_LOG_ERROR, "Copy went out of bounds\n"); return -1; } - if (ssrc + size - src < code) { - av_log(s->avctx, AV_LOG_ERROR, "Read went out of bounds\n"); - return AVERROR_INVALIDDATA; - } horizontal_fill(s->bpp * (s->avctx->pix_fmt == AV_PIX_FMT_PAL8), dst, 1, src, 0, code, pixels); src += code; diff --git a/libavformat/apetag.c b/libavformat/apetag.c index a445c84aef..60d06395de 100644 --- a/libavformat/apetag.c +++ b/libavformat/apetag.c @@ -114,7 +114,7 @@ static int ape_tag_read_field(AVFormatContext *s) int64_t ff_ape_parse_tag(AVFormatContext *s) { AVIOContext *pb = s->pb; - int file_size = avio_size(pb); + int64_t file_size = avio_size(pb); uint32_t val, fields, tag_bytes; uint8_t buf[8]; int64_t tag_start; |