diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-11-02 10:46:04 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-12-28 19:36:57 +0100 |
| commit | 292e41ce650a7b5ca5de4ae87fff0d6a90d9fc97 (patch) | |
| tree | fb6ea7e693066c99e79eb95f93127a1a27cc3aed | |
| parent | 654b21ef176a807bf4e8359a4ed52c629d766100 (diff) | |
| download | ffmpeg-292e41ce650a7b5ca5de4ae87fff0d6a90d9fc97.tar.gz | |
avcodec/tiff: Disallow striped and tiled tiffs except for DNG
strips + tiles is not allowed in TIFF
DNG uses a separate codepath
Regression since da5b3d002862d1e105002a6dc1567e6551860896.
Fixes: NULL pointer dereference
Fixes: poc1
Fixes: Ticket8960
Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/tiff.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index fa1f44ce1d..f68f9818ad 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1923,14 +1923,17 @@ again: has_strip_bits = s->strippos || s->strips || s->stripoff || s->rps || s->sot || s->sstype || s->stripsize || s->stripsizesoff; if (has_tile_bits && has_strip_bits) { - av_log(avctx, AV_LOG_WARNING, "Tiled TIFF is not allowed to strip\n"); + int tiled_dng = s->is_tiled && is_dng; + av_log(avctx, tiled_dng ? AV_LOG_WARNING : AV_LOG_ERROR, "Tiled TIFF is not allowed to strip\n"); + if (!tiled_dng) + return AVERROR_INVALIDDATA; } /* now we have the data and may start decoding */ if ((ret = init_image(s, &frame)) < 0) return ret; - if (!s->is_tiled) { + if (!s->is_tiled || has_strip_bits) { if (s->strips == 1 && !s->stripsize) { av_log(avctx, AV_LOG_WARNING, "Image data size missing\n"); s->stripsize = avpkt->size - s->stripoff; |