diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-12 23:40:24 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-12 23:49:41 +0100 |
| commit | e1219cdaf9fb4bc8cea410e1caf802373c1bfe51 (patch) | |
| tree | a439c0ec8bef6905768e3f8b2728f34f8df8ac4a /libavcodec | |
| parent | 6f9ae391deeab618fc9c0080d05b97afa29ddf81 (diff) | |
| download | ffmpeg-e1219cdaf9fb4bc8cea410e1caf802373c1bfe51.tar.gz | |
tiff: Check buffer allocation and pointer increment more carefully in shorts2str() and double2str()
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/tiff.c | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 9829e92bf8..939cfb2dca 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -218,10 +218,12 @@ static char *doubles2str(double *dp, int count, const char *sep) { int i; char *ap, *ap0; - int component_len; + uint64_t component_len; if (!sep) sep = ", "; - component_len = 15 + strlen(sep); - ap = av_malloc(component_len * count); + component_len = 15LL + strlen(sep); + if (count >= (INT_MAX - 1)/component_len) + return NULL; + ap = av_malloc(component_len * count + 1); if (!ap) return NULL; ap0 = ap; @@ -242,14 +244,22 @@ static char *shorts2str(int16_t *sp, int count, const char *sep) { int i; char *ap, *ap0; + uint64_t component_len; if (!sep) sep = ", "; - ap = av_malloc((5 + strlen(sep)) * count); + component_len = 7LL + strlen(sep); + if (count >= (INT_MAX - 1)/component_len) + return NULL; + ap = av_malloc(component_len * count + 1); if (!ap) return NULL; ap0 = ap; ap[0] = '\0'; for (i = 0; i < count; i++) { - int l = snprintf(ap, 5 + strlen(sep), "%d%s", sp[i], sep); + unsigned l = snprintf(ap, component_len, "%d%s", sp[i], sep); + if (l >= component_len) { + av_free(ap0); + return NULL; + } ap += l; } ap0[strlen(ap0) - strlen(sep)] = '\0'; |