diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-27 21:24:03 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-10-01 20:44:46 +0200 |
| commit | df0d418ce0efd2d59c60518c4b09995948bd5faf (patch) | |
| tree | 31cd0ea79edf7fcd2630b61dcc139309f86a0b19 | |
| parent | 6b0565e5b8f4a39e8348cbb61c21727d098013a5 (diff) | |
| download | ffmpeg-df0d418ce0efd2d59c60518c4b09995948bd5faf.tar.gz | |
Check for invalid/corrupted bitstream in sun raster decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b9596a503760ccbd82ca3c03d1c0d5b9449be12b)
| -rw-r--r-- | libavcodec/sunrast.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c index 7ab8e2c3f6..209d2c0ad3 100644 --- a/libavcodec/sunrast.c +++ b/libavcodec/sunrast.c @@ -68,13 +68,14 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data, type = AV_RB32(buf+20); maptype = AV_RB32(buf+24); maplength = AV_RB32(buf+28); + buf += 32; - if (type == RT_FORMAT_TIFF || type == RT_FORMAT_IFF) { - av_log(avctx, AV_LOG_ERROR, "unsupported (compression) type\n"); + if (type < RT_OLD || type > RT_FORMAT_IFF) { + av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n"); return -1; } - if (type > RT_FORMAT_IFF) { - av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n"); + if (av_image_check_size(w, h, 0, avctx)) { + av_log(avctx, AV_LOG_ERROR, "invalid image size\n"); return -1; } if (maptype & ~1) { @@ -82,7 +83,10 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data, return -1; } - buf += 32; + if (type == RT_FORMAT_TIFF || type == RT_FORMAT_IFF) { + av_log(avctx, AV_LOG_ERROR, "unsupported (compression) type\n"); + return -1; + } switch (depth) { case 1: @@ -102,8 +106,6 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data, if (p->data[0]) avctx->release_buffer(avctx, p); - if (av_image_check_size(w, h, 0, avctx)) - return -1; if (w != avctx->width || h != avctx->height) avcodec_set_dimensions(avctx, w, h); if (avctx->get_buffer(avctx, p) < 0) { |