From 27eada287af5505a93a4b9410412c0a916117731 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 29 Nov 2012 15:34:29 +0100 Subject: [PATCH] tiffdec: better checks for bitstream offsets, fixes out of array reads Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/tiff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index f00b1adc37..34fb10999d 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -1079,12 +1079,12 @@ static int decode_frame(AVCodecContext *avctx, dst = p->data[0]; if (s->stripsizesoff) { - if (s->stripsizesoff >= avpkt->size) + if (s->stripsizesoff >= (unsigned)avpkt->size) return AVERROR_INVALIDDATA; bytestream2_init(&stripsizes, avpkt->data + s->stripsizesoff, avpkt->size - s->stripsizesoff); } if (s->strippos) { - if (s->strippos >= avpkt->size) + if (s->strippos >= (unsigned)avpkt->size) return AVERROR_INVALIDDATA; bytestream2_init(&stripdata, avpkt->data + s->strippos, avpkt->size - s->strippos); }