diff options
| author | Daniel Kang <[email protected]> | 2011-01-09 19:29:39 +0000 |
|---|---|---|
| committer | Carl Eugen Hoyos <[email protected]> | 2011-01-09 19:29:39 +0000 |
| commit | a4db272a92a5556ff45ecd15735fe578ec6e81c5 (patch) | |
| tree | 8f78c65d1109e3247e102883ebd79c54c1ff01b0 /libavcodec/tiff.c | |
| parent | 31561a98ae4cda1481e549ae5aef5c01b808926f (diff) | |
Return on negative soff sizes, fixes issue 2515.
Patch by Daniel Kang, daniel.d.kang at gmail
Originally committed as revision 26288 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/tiff.c')
| -rw-r--r-- | libavcodec/tiff.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index c1b71dc99a..f5d922a980 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -540,6 +540,10 @@ static int decode_frame(AVCodecContext *avctx, soff = tget(&s->stripdata, s->sot, s->le); }else soff = s->stripoff; + if (soff < 0) { + av_log(avctx, AV_LOG_ERROR, "Invalid stripoff: %d\n", soff); + return AVERROR(EINVAL); + } if(tiff_unpack_strip(s, dst, stride, orig_buf + soff, ssize, FFMIN(s->rps, s->height - i)) < 0) break; dst += s->rps * stride; |