tiff: Check that there is no aliasing in pixel format selection

Fixes possible issues with unexpected bpp/bppcount values.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-8544
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
pull/124/merge
Anton Khirnov 10 years ago committed by Luca Barbato
parent 6448f15af0
commit ae5e1f3d66
  1. 8
      libavcodec/tiff.c

@ -252,6 +252,14 @@ static int init_image(TiffContext *s, AVFrame *frame)
{ {
int ret; int ret;
// make sure there is no aliasing in the following switch
if (s->bpp >= 100 || s->bppcount >= 10) {
av_log(s->avctx, AV_LOG_ERROR,
"Unsupported image parameters: bpp=%d, bppcount=%d\n",
s->bpp, s->bppcount);
return AVERROR_INVALIDDATA;
}
switch (s->planar * 1000 + s->bpp * 10 + s->bppcount) { switch (s->planar * 1000 + s->bpp * 10 + s->bppcount) {
case 11: case 11:
s->avctx->pix_fmt = AV_PIX_FMT_MONOBLACK; s->avctx->pix_fmt = AV_PIX_FMT_MONOBLACK;

Loading…
Cancel
Save