diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-07-29 03:55:03 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-07-29 03:56:26 +0200 |
| commit | a3539d26eceebe69d890ad39e2ab0dcc19433246 (patch) | |
| tree | 7ec11a6b7101dbb1876a6d9c43229a919fec70a9 /libavcodec/tiff.c | |
| parent | 7118358a950e20a4439d796f16892b27dad6c754 (diff) | |
| parent | 4ff5167ee7fdee6d35c1bb2558172329ae6ec770 (diff) | |
| download | ffmpeg-a3539d26eceebe69d890ad39e2ab0dcc19433246.tar.gz | |
Merge commit '4ff5167ee7fdee6d35c1bb2558172329ae6ec770' into release/0.10
* commit '4ff5167ee7fdee6d35c1bb2558172329ae6ec770':
wmapro: make sure there is room to store the current packet
lavc: move put_bits_left in put_bits.h
4xm: do not overread the source buffer in decode_p_block
4xm: check bitstream_size boundary before using it
4xm: reject frames not compatible with the declared version
4xm: use the correct logging context
4xm: check the return value of read_huffman_tables().
4xm: don't rely on get_buffer() initializing the frame.
vmdav: convert to bytestream2
smacker: check frame size validity
smacker: pad the extradata allocation
smacker: check the return value of smacker_decode_tree
smacker: fix an off by one in huff.length computation
Prepare for 0.8.8 Release
tiff: do not overread the source buffer
apetag: use int64_t for filesize
wavpack: return meaningful errors
Conflicts:
RELEASE
libavcodec/4xm.c
libavcodec/vmdav.c
libavformat/smacker.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/tiff.c')
| -rw-r--r-- | libavcodec/tiff.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index c4da35d8e2..19408322ef 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -235,10 +235,13 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uin break; case TIFF_PACKBITS: for(pixels = 0; pixels < width;){ + if (ssrc + size - src < 2) + return AVERROR_INVALIDDATA; code = (int8_t)*src++; if(code >= 0){ code++; - if(pixels + code > width){ + if (pixels + code > width || + ssrc + size - src < code) { av_log(s->avctx, AV_LOG_ERROR, "Copy went out of bounds\n"); return -1; } |