diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2020-07-16 22:42:14 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-09-19 00:40:56 +0200 |
| commit | d54c24acde88a214489d5ef410982eedac7ffc29 (patch) | |
| tree | df79910e5b3d48be4be2818c901c22610a506538 | |
| parent | ca3c6c981aa5b0af8a5576020b79fdd3cdf9ae9e (diff) | |
| download | ffmpeg-d54c24acde88a214489d5ef410982eedac7ffc29.tar.gz | |
avcodec/tiff: Fix default white level
According to the spec bits per sample should be used
Fix invalid shift with bpp=32
Fixes: shift exponent 32 is too large for 32-bit type 'unsigned int'
Fixes: 23507/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4815432665268224
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/tiff.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 7d0a78cb3c..359d613bb3 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1895,8 +1895,14 @@ again: if (is_dng) { int bps; + if (s->bpp % s->bppcount) + return AVERROR_INVALIDDATA; + bps = s->bpp / s->bppcount; + if (bps < 8 || bps > 32) + return AVERROR_INVALIDDATA; + if (s->white_level == 0) - s->white_level = (1 << s->bpp) - 1; /* Default value as per the spec */ + s->white_level = (1LL << bps) - 1; /* Default value as per the spec */ if (s->white_level <= s->black_level) { av_log(avctx, AV_LOG_ERROR, "BlackLevel (%"PRId32") must be less than WhiteLevel (%"PRId32")\n", @@ -1904,11 +1910,6 @@ again: return AVERROR_INVALIDDATA; } - if (s->bpp % s->bppcount) - return AVERROR_INVALIDDATA; - bps = s->bpp / s->bppcount; - if (bps < 8 || bps > 32) - return AVERROR_INVALIDDATA; if (s->planar) return AVERROR_PATCHWELCOME; } |