diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-16 22:42:14 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-02-02 14:18:20 +0100 |
| commit | 0263257062bdef53dedfa59161483c76dc84c47a (patch) | |
| tree | a48890feb2c54f4855d61900750c11b9058c86ec | |
| parent | 0874afcfce90db5b54555b2e163323779794e3ce (diff) | |
| download | ffmpeg-0263257062bdef53dedfa59161483c76dc84c47a.tar.gz | |
avcodec/tiff: Fix default white level
According to the spec bits per sample should be used
Fix invalid shift with bpp=32
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 23507/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4815432665268224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d54c24acde88a214489d5ef410982eedac7ffc29)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/tiff.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 8a42e677ce..59a993ec8b 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1898,8 +1898,14 @@ again: if (is_dng) { int bps; + if (s->bpp % s->bppcount) + return AVERROR_INVALIDDATA; + bps = s->bpp / s->bppcount; + if (bps < 8 || bps > 32) + return AVERROR_INVALIDDATA; + if (s->white_level == 0) - s->white_level = (1 << s->bpp) - 1; /* Default value as per the spec */ + s->white_level = (1LL << bps) - 1; /* Default value as per the spec */ if (s->white_level <= s->black_level) { av_log(avctx, AV_LOG_ERROR, "BlackLevel (%"PRId32") must be less than WhiteLevel (%"PRId32")\n", @@ -1907,11 +1913,6 @@ again: return AVERROR_INVALIDDATA; } - if (s->bpp % s->bppcount) - return AVERROR_INVALIDDATA; - bps = s->bpp / s->bppcount; - if (bps < 8 || bps > 32) - return AVERROR_INVALIDDATA; if (s->planar) return AVERROR_PATCHWELCOME; } |