eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-17 20:40:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

tiff: Check buffer allocation and pointer increment more carefully in shorts2str() and double2str()

Browse Source 
Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e1219cdaf9)

Conflicts:

	libavcodec/tiff.c
This commit is contained in:
Michael Niedermayer
2013-02-12 23:40:24 +01:00
parent 534c0df6e0
commit d17b9469c9
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
libavcodec/tiff.c
View File

@@ -207,9 +207,11 @@ static char *doubles2str(double *dp, int count, const char *sep)
{ {
int i; int i;
char *ap, *ap0; char *ap, *ap0;
int component_len = 15 + strlen(sep); uint64_t component_len = 15LL + strlen(sep);
if (!sep) sep = ", "; if (!sep) sep = ", ";
ap = av_malloc(component_len * count); if (count >= (INT_MAX - 1)/component_len)
return NULL;
ap = av_malloc(component_len * count + 1);
if (!ap) if (!ap)
return NULL; return NULL;
ap0 = ap; ap0 = ap;
@@ -228,14 +230,22 @@ static char *shorts2str(int16_t *sp, int count, const char *sep)
{ {
int i; int i;
char *ap, *ap0; char *ap, *ap0;
uint64_t component_len;
if (!sep) sep = ", "; if (!sep) sep = ", ";
ap = av_malloc((5 + strlen(sep)) * count); component_len = 7LL + strlen(sep);
if (count >= (INT_MAX - 1)/component_len)
return NULL;
ap = av_malloc(component_len * count + 1);
if (!ap) if (!ap)
return NULL; return NULL;
ap0 = ap; ap0 = ap;
ap[0] = '\0'; ap[0] = '\0';
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
int l = snprintf(ap, 5 + strlen(sep), "%d%s", sp[i], sep); unsigned l = snprintf(ap, component_len, "%d%s", sp[i], sep);
if (l >= component_len) {
av_free(ap0);
return NULL;
}
ap += l; ap += l;
} }
ap0[strlen(ap0) - strlen(sep)] = '\0'; ap0[strlen(ap0) - strlen(sep)] = '\0';