diff options
| author | Anton Khirnov <anton@khirnov.net> | 2015-03-07 22:06:59 +0100 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2015-03-08 19:16:16 +0100 |
| commit | 77eb3d9a60a9c2bb6d87c960ac186af242bbcc9e (patch) | |
| tree | 097e15bc7c9f389892da402554b8141c008ef785 | |
| parent | f3dafb63d05896aacf84caf0e4c81c216476d60e (diff) | |
| download | ffmpeg-77eb3d9a60a9c2bb6d87c960ac186af242bbcc9e.tar.gz | |
tiff: Check that there is no aliasing in pixel format selection
Fixes possible issues with unexpected bpp/bppcount values.
CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-8544
(cherry picked from commit ae5e1f3d663a8c9a532d89e588cbc61f171c9186)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| -rw-r--r-- | libavcodec/tiff.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 3b2fc7d900..4732e67abf 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -248,6 +248,14 @@ static int init_image(TiffContext *s, AVFrame *frame) { int ret; + // make sure there is no aliasing in the following switch + if (s->bpp >= 100 || s->bppcount >= 10) { + av_log(s->avctx, AV_LOG_ERROR, + "Unsupported image parameters: bpp=%d, bppcount=%d\n", + s->bpp, s->bppcount); + return AVERROR_INVALIDDATA; + } + switch (s->bpp * 10 + s->bppcount) { case 11: s->avctx->pix_fmt = AV_PIX_FMT_MONOBLACK; |