videolan/ffmpeg
1
Fork 0
mirror of https://git.videolan.org/git/ffmpeg.git synced 2024-08-05 18:59:59 +02:00
Code Releases Activity

tiff: Prevent overreads in the type_sizes array.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Alex Converse 2012-02-23 10:47:50 -08:00
parent e32548d133
commit 447363870f
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/tiff.c
View File

@ -289,6 +289,11 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
count = tget_long(&buf, s->le); count = tget_long(&buf, s->le);
off = tget_long(&buf, s->le); off = tget_long(&buf, s->le);
if (type == 0 || type >= FF_ARRAY_ELEMS(type_sizes)) {
av_log(s->avctx, AV_LOG_DEBUG, "Unknown tiff type (%u) encountered\n", type);
return 0;
}
if(count == 1){ if(count == 1){
switch(type){ switch(type){
case TIFF_BYTE: case TIFF_BYTE:
@ -310,10 +315,12 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
value = UINT_MAX; value = UINT_MAX;
buf = start + off; buf = start + off;
} }
}else if(type_sizes[type] * count <= 4){ } else {
buf -= 4; if (count <= 4 && type_sizes[type] * count <= 4) {
}else{ buf -= 4;
buf = start + off; } else {
buf = start + off;
}
} }
if(buf && (buf < start || buf > end_buf)){ if(buf && (buf < start || buf > end_buf)){