diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 1011116f41..0824934025 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -548,15 +548,12 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride, code = (int8_t) * src++; if (code >= 0) { code++; - if (pixels + code > width) { + if (pixels + code > width || + ssrc + size - src < code) { av_log(s->avctx, AV_LOG_ERROR, "Copy went out of bounds\n"); return -1; } - if (ssrc + size - src < code) { - av_log(s->avctx, AV_LOG_ERROR, "Read went out of bounds\n"); - return AVERROR_INVALIDDATA; - } horizontal_fill(s->bpp * (s->avctx->pix_fmt == AV_PIX_FMT_PAL8), dst, 1, src, 0, code, pixels); src += code; diff --git a/libavformat/apetag.c b/libavformat/apetag.c index a445c84aef..60d06395de 100644 --- a/libavformat/apetag.c +++ b/libavformat/apetag.c @@ -114,7 +114,7 @@ static int ape_tag_read_field(AVFormatContext *s) int64_t ff_ape_parse_tag(AVFormatContext *s) { AVIOContext *pb = s->pb; - int file_size = avio_size(pb); + int64_t file_size = avio_size(pb); uint32_t val, fields, tag_bytes; uint8_t buf[8]; int64_t tag_start;