|
|
@ -1930,8 +1930,10 @@ static int decode_header(EXRContext *s, AVFrame *frame) |
|
|
|
|
|
|
|
|
|
|
|
bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size)); |
|
|
|
bytestream2_get_buffer(gb, key, FFMIN(sizeof(key) - 1, var_size)); |
|
|
|
if (strncmp("scanlineimage", key, var_size) && |
|
|
|
if (strncmp("scanlineimage", key, var_size) && |
|
|
|
strncmp("tiledimage", key, var_size)) |
|
|
|
strncmp("tiledimage", key, var_size)) { |
|
|
|
return AVERROR_PATCHWELCOME; |
|
|
|
ret = AVERROR_PATCHWELCOME; |
|
|
|
|
|
|
|
goto fail; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
continue; |
|
|
|
continue; |
|
|
|
} else if ((var_size = check_header_variable(s, "preview", |
|
|
|
} else if ((var_size = check_header_variable(s, "preview", |
|
|
@ -1939,12 +1941,16 @@ static int decode_header(EXRContext *s, AVFrame *frame) |
|
|
|
uint32_t pw = bytestream2_get_le32(gb); |
|
|
|
uint32_t pw = bytestream2_get_le32(gb); |
|
|
|
uint32_t ph = bytestream2_get_le32(gb); |
|
|
|
uint32_t ph = bytestream2_get_le32(gb); |
|
|
|
uint64_t psize = pw * ph; |
|
|
|
uint64_t psize = pw * ph; |
|
|
|
if (psize > INT64_MAX / 4) |
|
|
|
if (psize > INT64_MAX / 4) { |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
ret = AVERROR_INVALIDDATA; |
|
|
|
|
|
|
|
goto fail; |
|
|
|
|
|
|
|
} |
|
|
|
psize *= 4; |
|
|
|
psize *= 4; |
|
|
|
|
|
|
|
|
|
|
|
if ((int64_t)psize >= bytestream2_get_bytes_left(gb)) |
|
|
|
if ((int64_t)psize >= bytestream2_get_bytes_left(gb)) { |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
ret = AVERROR_INVALIDDATA; |
|
|
|
|
|
|
|
goto fail; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
bytestream2_skip(gb, psize); |
|
|
|
bytestream2_skip(gb, psize); |
|
|
|
|
|
|
|
|
|
|
|