diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-08-07 20:58:25 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-08-07 21:06:40 +0200 |
| commit | 0049af262825254705bdbb97c28004dd7c7c2b24 (patch) | |
| tree | 967e3d148bda432a70535a8b9fee1fd7392cb468 /libavcodec | |
| parent | bb7744a45bf50b4685babebfbd9702ca20680a00 (diff) | |
| download | ffmpeg-0049af262825254705bdbb97c28004dd7c7c2b24.tar.gz | |
pnmdec: make ff_pnm_decode_header() more robust
Fixes ticket1321
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/pnm.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/libavcodec/pnm.c b/libavcodec/pnm.c index a20051e200..8c0f21887f 100644 --- a/libavcodec/pnm.c +++ b/libavcodec/pnm.c @@ -104,7 +104,7 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s) } } /* check that all tags are present */ - if (w <= 0 || h <= 0 || maxval <= 0 || depth <= 0 || tuple_type[0] == '\0' || av_image_check_size(w, h, 0, avctx)) + if (w <= 0 || h <= 0 || maxval <= 0 || depth <= 0 || tuple_type[0] == '\0' || av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end) return -1; avctx->width = w; @@ -141,13 +141,15 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s) return -1; } pnm_get(s, buf1, sizeof(buf1)); - avctx->width = atoi(buf1); - if (avctx->width <= 0) - return -1; + w = atoi(buf1); pnm_get(s, buf1, sizeof(buf1)); - avctx->height = atoi(buf1); - if(avctx->height <= 0 || av_image_check_size(avctx->width, avctx->height, 0, avctx)) + h = atoi(buf1); + if(w <= 0 || h <= 0 || av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end) return -1; + + avctx->width = w; + avctx->height = h; + if (avctx->pix_fmt != PIX_FMT_MONOWHITE && avctx->pix_fmt != PIX_FMT_MONOBLACK) { pnm_get(s, buf1, sizeof(buf1)); s->maxval = atoi(buf1); |