eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-13 10:30:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'qatar/release/9' into release/1.1

Browse Source 
* qatar/release/9:
  tiff: do not overread the source buffer
  apetag: use int64_t for filesize

Conflicts:
	libavcodec/tiff.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2013-06-09 11:06:28 +02:00
parent 2fae70db2a 8eb7c2566c
commit 01580c0955
2 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/tiff.c
View File

@@ -548,15 +548,12 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride,
code = (int8_t) * src++; code = (int8_t) * src++;
if (code >= 0) { if (code >= 0) {
code++; code++;
if (pixels + code > width) { if (pixels + code > width ||
ssrc + size - src < code) {
av_log(s->avctx, AV_LOG_ERROR, av_log(s->avctx, AV_LOG_ERROR,
"Copy went out of bounds\n"); "Copy went out of bounds\n");
return -1; return -1;
} }
if (ssrc + size - src < code) {
av_log(s->avctx, AV_LOG_ERROR, "Read went out of bounds\n");
return AVERROR_INVALIDDATA;
}
horizontal_fill(s->bpp * (s->avctx->pix_fmt == AV_PIX_FMT_PAL8), horizontal_fill(s->bpp * (s->avctx->pix_fmt == AV_PIX_FMT_PAL8),
dst, 1, src, 0, code, pixels); dst, 1, src, 0, code, pixels);
src += code; src += code;

2
libavformat/apetag.c
View File

@@ -114,7 +114,7 @@ static int ape_tag_read_field(AVFormatContext *s)
int64_t ff_ape_parse_tag(AVFormatContext *s) int64_t ff_ape_parse_tag(AVFormatContext *s)
{ {
AVIOContext *pb = s->pb; AVIOContext *pb = s->pb;
int file_size = avio_size(pb); int64_t file_size = avio_size(pb);
uint32_t val, fields, tag_bytes; uint32_t val, fields, tag_bytes;
uint8_t buf[8]; uint8_t buf[8];
int64_t tag_start; int64_t tag_start;