diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-07 20:47:24 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-15 01:59:40 +0200 |
| commit | 66d6b8033b4bf8e9b33f26729c4ab9f9b328c5a2 (patch) | |
| tree | 1835c8bc1357cfb5944f9fbfb0e067fb4200e124 /libavcodec/tiff.c | |
| parent | 19a5a8997c93d72d6fe169c42a2a04ad4bb6e03a (diff) | |
| download | ffmpeg-66d6b8033b4bf8e9b33f26729c4ab9f9b328c5a2.tar.gz | |
avcodec/tiff: Check value on positive signed targets
Fixes: CID1604593 Overflowed constant
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/tiff.c')
| -rw-r--r-- | libavcodec/tiff.c | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index fd4116aec4..37b56e9757 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1298,9 +1298,13 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame) s->is_thumbnail = (value != 0); break; case TIFF_WIDTH: + if (value > INT_MAX) + return AVERROR_INVALIDDATA; s->width = value; break; case TIFF_HEIGHT: + if (value > INT_MAX) + return AVERROR_INVALIDDATA; s->height = value; break; case TIFF_BPP: @@ -1432,12 +1436,18 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame) s->tile_byte_counts_offset = off; break; case TIFF_TILE_LENGTH: + if (value > INT_MAX) + return AVERROR_INVALIDDATA; s->tile_length = value; break; case TIFF_TILE_WIDTH: + if (value > INT_MAX) + return AVERROR_INVALIDDATA; s->tile_width = value; break; case TIFF_PREDICTOR: + if (value > INT_MAX) + return AVERROR_INVALIDDATA; s->predictor = value; break; case TIFF_SUB_IFDS: @@ -1582,12 +1592,18 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame) } break; case TIFF_T4OPTIONS: - if (s->compr == TIFF_G3) + if (s->compr == TIFF_G3) { + if (value > INT_MAX) + return AVERROR_INVALIDDATA; s->fax_opts = value; + } break; case TIFF_T6OPTIONS: - if (s->compr == TIFF_G4) + if (s->compr == TIFF_G4) { + if (value > INT_MAX) + return AVERROR_INVALIDDATA; s->fax_opts = value; + } break; #define ADD_METADATA(count, name, sep)\ if ((ret = add_metadata(count, type, name, sep, s, frame)) < 0) {\ |