diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-12 23:40:24 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-19 01:28:46 +0100 |
| commit | 75211f2b8cfb8b4a3f47c514e55585651eeb2767 (patch) | |
| tree | 36e25bf0675797cd842bc675386347bd6ff0f0f8 | |
| parent | f6687bbb6464532f14b3246cdb7b03f6d04b25cb (diff) | |
| download | ffmpeg-75211f2b8cfb8b4a3f47c514e55585651eeb2767.tar.gz | |
tiff: Check buffer allocation and pointer increment more carefully in shorts2str() and double2str()
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e1219cdaf9fb4bc8cea410e1caf802373c1bfe51)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/tiff.c | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 85a5823c35..1011116f41 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -212,10 +212,12 @@ static char *doubles2str(double *dp, int count, const char *sep) { int i; char *ap, *ap0; - int component_len; + uint64_t component_len; if (!sep) sep = ", "; - component_len = 15 + strlen(sep); - ap = av_malloc(component_len * count); + component_len = 15LL + strlen(sep); + if (count >= (INT_MAX - 1)/component_len) + return NULL; + ap = av_malloc(component_len * count + 1); if (!ap) return NULL; ap0 = ap; @@ -236,14 +238,22 @@ static char *shorts2str(int16_t *sp, int count, const char *sep) { int i; char *ap, *ap0; + uint64_t component_len; if (!sep) sep = ", "; - ap = av_malloc((5 + strlen(sep)) * count); + component_len = 7LL + strlen(sep); + if (count >= (INT_MAX - 1)/component_len) + return NULL; + ap = av_malloc(component_len * count + 1); if (!ap) return NULL; ap0 = ap; ap[0] = '\0'; for (i = 0; i < count; i++) { - int l = snprintf(ap, 5 + strlen(sep), "%d%s", sp[i], sep); + unsigned l = snprintf(ap, component_len, "%d%s", sp[i], sep); + if (l >= component_len) { + av_free(ap0); + return NULL; + } ap += l; } ap0[strlen(ap0) - strlen(sep)] = '\0'; |