diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-29 15:34:29 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-29 15:35:05 +0100 |
| commit | 27eada287af5505a93a4b9410412c0a916117731 (patch) | |
| tree | 06f47c6f6518b560e2791de788d0564e34211d08 /libavcodec | |
| parent | 3ae610451170cd5a28b33950006ff0bd23036845 (diff) | |
| download | ffmpeg-27eada287af5505a93a4b9410412c0a916117731.tar.gz | |
tiffdec: better checks for bitstream offsets, fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/tiff.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index f00b1adc37..34fb10999d 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1079,12 +1079,12 @@ static int decode_frame(AVCodecContext *avctx, dst = p->data[0]; if (s->stripsizesoff) { - if (s->stripsizesoff >= avpkt->size) + if (s->stripsizesoff >= (unsigned)avpkt->size) return AVERROR_INVALIDDATA; bytestream2_init(&stripsizes, avpkt->data + s->stripsizesoff, avpkt->size - s->stripsizesoff); } if (s->strippos) { - if (s->strippos >= avpkt->size) + if (s->strippos >= (unsigned)avpkt->size) return AVERROR_INVALIDDATA; bytestream2_init(&stripdata, avpkt->data + s->strippos, avpkt->size - s->strippos); } |