wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avcodec/tiff: Ignore tile_count

Browse source 
Fixes: out of array access
Fixes: 52427/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4849108968144896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65ce417828)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-11-18 18:26:59 +01:00
parent b314170e2b
commit 7436138621
No known key found for this signature in database
GPG key ID: B18E8928B3948D64
1 changed files with 2 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
libavcodec/tiff.c
View file

@ -100,7 +100,6 @@ typedef struct TiffContext {
int is_tiled;
int tile_byte_counts_offset, tile_offsets_offset;
int tile_width, tile_length;
int tile_count;
int is_jpeg;
@ -988,7 +987,7 @@ static int dng_decode_tiles(AVCodecContext *avctx, AVFrame *frame,
tile_count_y = (s->height + s->tile_length - 1) / s->tile_length;
/* Iterate over the number of tiles */
for (tile_idx = 0; tile_idx < s->tile_count; tile_idx++) {
for (tile_idx = 0; tile_idx < tile_count_x * tile_count_y; tile_idx++) {
tile_x = tile_idx % tile_count_x;
tile_y = tile_idx / tile_count_x;
@ -1408,7 +1407,6 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
break;
case TIFF_TILE_OFFSETS:
s->tile_offsets_offset = off;
s->tile_count = count;
s->is_tiled = 1;
break;
case TIFF_TILE_BYTE_COUNTS:
@ -1903,7 +1901,7 @@ again:
return AVERROR_INVALIDDATA;
}
has_tile_bits = s->is_tiled || s->tile_byte_counts_offset || s->tile_offsets_offset || s->tile_width || s->tile_length || s->tile_count;
has_tile_bits = s->is_tiled || s->tile_byte_counts_offset || s->tile_offsets_offset || s->tile_width || s->tile_length;
has_strip_bits = s->strippos || s->strips || s->stripoff || s->rps || s->sot || s->sstype || s->stripsize || s->stripsizesoff;
if (has_tile_bits && has_strip_bits) {