diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-09 12:13:30 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-09 12:14:28 +0100 |
| commit | 6d1c5ea04af3e345232aa70c944de961061dab2d (patch) | |
| tree | c58697e9e44d9f6147b84bf253c3f5764824c5c4 /libavcodec/tiff.c | |
| parent | ce1ebb31a9a0e556a89cd7681082af19fbc1cced (diff) | |
| download | ffmpeg-6d1c5ea04af3e345232aa70c944de961061dab2d.tar.gz | |
tiffdec: check count in metadata reading.
Fixes out of array access
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/tiff.c')
| -rw-r--r-- | libavcodec/tiff.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 5d9f80105e..45c247694e 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -254,7 +254,7 @@ static int add_doubles_metadata(int count, int i; double *dp; - if (count >= INT_MAX / sizeof(int64_t)) + if (count >= INT_MAX / sizeof(int64_t) || count <= 0) return AVERROR_INVALIDDATA; if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int64_t)) return AVERROR_INVALIDDATA; @@ -280,7 +280,7 @@ static int add_shorts_metadata(int count, const char *name, int i; int16_t *sp; - if (count >= INT_MAX / sizeof(int16_t)) + if (count >= INT_MAX / sizeof(int16_t) || count <= 0) return AVERROR_INVALIDDATA; if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int16_t)) return AVERROR_INVALIDDATA; |