Commit ffdc5d09 authored by Andreas Cadhalpun's avatar Andreas Cadhalpun

exr: fix out-of-bounds read

channel_index can be -1.

This problem was introduced in commit
2dd7b461.
Reviewed-by: 's avatarPaul B Mahol <onemda@gmail.com>
Signed-off-by: 's avatarAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
parent 721c90f0
...@@ -1428,8 +1428,7 @@ static int decode_header(EXRContext *s) ...@@ -1428,8 +1428,7 @@ static int decode_header(EXRContext *s)
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
if (s->channel_offsets[channel_index] == -1){/* channel have not been previously assign */ if (channel_index >= 0 && s->channel_offsets[channel_index] == -1) { /* channel has not been previously assigned */
if (channel_index >= 0) {
if (s->pixel_type != EXR_UNKNOWN && if (s->pixel_type != EXR_UNKNOWN &&
s->pixel_type != current_pixel_type) { s->pixel_type != current_pixel_type) {
av_log(s->avctx, AV_LOG_ERROR, av_log(s->avctx, AV_LOG_ERROR,
...@@ -1438,7 +1437,6 @@ static int decode_header(EXRContext *s) ...@@ -1438,7 +1437,6 @@ static int decode_header(EXRContext *s)
} }
s->pixel_type = current_pixel_type; s->pixel_type = current_pixel_type;
s->channel_offsets[channel_index] = s->current_channel_offset; s->channel_offsets[channel_index] = s->current_channel_offset;
}
} }
s->channels = av_realloc(s->channels, s->channels = av_realloc(s->channels,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment