From e444e5bb1ad9434ab79790a5aececcd6b783360b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 15 Feb 2020 17:12:38 +0100 Subject: [PATCH] avcodec/tiff: assert that raw tiff dng blit does not write over the end of a line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found-by: 黄宁 Reviewed-by: Nick Renieris Signed-off-by: Michael Niedermayer --- libavcodec/tiff.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 176bfc274b..45cb225d0a 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -704,18 +704,20 @@ static int tiff_unpack_strip(TiffContext *s, AVFrame *p, uint8_t *dst, int strid /* Color processing for DNG images with uncompressed strips (non-tiled) */ if (is_dng) { - int is_u16, pixel_size_bytes, pixel_size_bits; + int is_u16, pixel_size_bytes, pixel_size_bits, elements; is_u16 = (s->bpp > 8); pixel_size_bits = (is_u16 ? 16 : 8); pixel_size_bytes = (is_u16 ? sizeof(uint16_t) : sizeof(uint8_t)); + elements = width / pixel_size_bytes * pixel_size_bits / s->bpp * s->bppcount; // need to account for [1, 16] bpp + av_assert0 (elements * pixel_size_bytes <= FFABS(stride)); dng_blit(s, dst, 0, // no stride, only 1 line dst, 0, // no stride, only 1 line - width / pixel_size_bytes * pixel_size_bits / s->bpp * s->bppcount, // need to account for [1, 16] bpp + elements, 1, 0, // single-component variation is only preset in JPEG-encoded DNGs is_u16);