Fix a crash when decoding tiff by moving check

for invalid header up before reading data.
Fixes issue 2500.

Patch by Daniel Kang, daniel.d.kang at gmail

Originally committed as revision 26248 to svn://svn.ffmpeg.org/ffmpeg/trunk
oldabi
Daniel Kang 14 years ago committed by Carl Eugen Hoyos
parent 35ca5c0b6b
commit d381249bb8
  1. 8
      libavcodec/tiff.c

@ -263,6 +263,10 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
s->height = value; s->height = value;
break; break;
case TIFF_BPP: case TIFF_BPP:
if(count > 4){
av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
return -1;
}
if(count == 1) s->bpp = value; if(count == 1) s->bpp = value;
else{ else{
switch(type){ switch(type){
@ -278,10 +282,6 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
s->bpp = -1; s->bpp = -1;
} }
} }
if(count > 4){
av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
return -1;
}
switch(s->bpp*10 + count){ switch(s->bpp*10 + count){
case 11: case 11:
s->avctx->pix_fmt = PIX_FMT_MONOBLACK; s->avctx->pix_fmt = PIX_FMT_MONOBLACK;

Loading…
Cancel
Save