diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-19 17:48:56 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-20 01:23:54 +0100 |
| commit | 8aedb751567457d6f0d16ba3c5b6400f99791fb7 (patch) | |
| tree | 84590f70bb0410aeb2ecc7d807d3e716eba26c9c /libavcodec | |
| parent | 1fd86f9a2136165205b0370d5a6e916499f1da7f (diff) | |
| download | ffmpeg-8aedb751567457d6f0d16ba3c5b6400f99791fb7.tar.gz | |
tiff: check bppcount
Fixes division by 0
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a34418c28e0accd1468ca15fff4d4f138a609f4e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/tiff.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 2ca6d5ca62..d26135ecda 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -360,6 +360,11 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t * "Samples per pixel requires a single value, many provided\n"); return AVERROR_INVALIDDATA; } + if (value > 4U) { + av_log(s->avctx, AV_LOG_ERROR, + "Samples per pixel %d is too large\n", value); + return AVERROR_INVALIDDATA; + } if (s->bppcount == 1) s->bpp *= value; s->bppcount = value; |