Commit d381249b authored by Daniel Kang's avatar Daniel Kang Committed by Carl Eugen Hoyos

Fix a crash when decoding tiff by moving check

for invalid header up before reading data.
Fixes issue 2500.

Patch by Daniel Kang, daniel.d.kang at gmail

Originally committed as revision 26248 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 35ca5c0b
......@@ -263,6 +263,10 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
s->height = value;
break;
case TIFF_BPP:
if(count > 4){
av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
return -1;
}
if(count == 1) s->bpp = value;
else{
switch(type){
......@@ -278,10 +282,6 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
s->bpp = -1;
}
}
if(count > 4){
av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
return -1;
}
switch(s->bpp*10 + count){
case 11:
s->avctx->pix_fmt = PIX_FMT_MONOBLACK;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment