diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-09-12 19:55:09 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-10-09 21:33:05 +0200 |
| commit | b14de343c7ebed2a3946e9db39fca28a61206680 (patch) | |
| tree | a9734b3c344e984f8ced09cbfd6e3151d3c75a94 | |
| parent | 3b184fab451647a68cee42da3453658faf73f246 (diff) | |
| download | ffmpeg-b14de343c7ebed2a3946e9db39fca28a61206680.tar.gz | |
avcodec/tiff: Fix loop detection
Fixes regression with tickets/4364/L1004220.DNG
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43a4854510a3d596e114d899177a5b3b323ca9fb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/tiff.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 0a0dd44710..1e7e0d697d 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1406,7 +1406,7 @@ static int decode_frame(AVCodecContext *avctx, TiffContext *const s = avctx->priv_data; AVFrame *const p = data; ThreadFrame frame = { .f = data }; - unsigned off, last_off; + unsigned off, last_off = 0; int le, ret, plane, planes; int i, j, entries, stride; unsigned soff, ssize; @@ -1462,7 +1462,6 @@ again: /** whether we should process this multi-page IFD's next page */ retry_for_page = s->get_page && s->cur_page + 1 < s->get_page; // get_page is 1-indexed - last_off = off; if (retry_for_page) { // set offset to the next IFD off = ff_tget_long(&s->gb, le); @@ -1480,6 +1479,7 @@ again: avpriv_request_sample(s->avctx, "non increasing IFD offset\n"); return AVERROR_INVALIDDATA; } + last_off = off; if (off >= UINT_MAX - 14 || avpkt->size < off + 14) { av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n"); return AVERROR_INVALIDDATA; |