dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 01:21:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/tiff: reject inflate output shorter than the strip

Browse Source 
Fixes: use of uninitialized memory
Fixes: tiff_short_deflate_heap_disclosure.tiff
Fixes: 1cRIkpUVMQtn
Found-by: Adrian Junge (vurlo)
(cherry picked from commit 2f234ea34c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-07-22 05:44:41 +02:00
parent 2bf9f7b6e3
commit 3c287af3af
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/tiff.c
View File

@@ -526,6 +526,7 @@ static int tiff_unpack_zlib(TiffContext *s, AVFrame *p, uint8_t *dst, int stride
uint8_t *zbuf;
unsigned long outlen;
int ret, line;
int rows = is_yuv ? (lines + s->subsampling[1] - 1) / s->subsampling[1] : lines;
outlen = width * lines;
zbuf = av_malloc(outlen);
if (!zbuf)
@@ -545,6 +546,12 @@ static int tiff_unpack_zlib(TiffContext *s, AVFrame *p, uint8_t *dst, int stride
av_free(zbuf);
return AVERROR_UNKNOWN;
}
if (outlen < (unsigned long)width * rows) {
av_log(s->avctx, AV_LOG_ERROR, "Deflated %lu bytes, but %lu are needed\n",
outlen, (unsigned long)width * rows);
av_free(zbuf);
return AVERROR_INVALIDDATA;
}
src = zbuf;
for (line = 0; line < lines; line++) {
if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {
@@ -592,6 +599,7 @@ static int tiff_unpack_lzma(TiffContext *s, AVFrame *p, uint8_t *dst, int stride
{
uint64_t outlen = width * (uint64_t)lines;
int ret, line;
int rows = is_yuv ? (lines + s->subsampling[1] - 1) / s->subsampling[1] : lines;
uint8_t *buf = av_malloc(outlen);
if (!buf)
return AVERROR(ENOMEM);
@@ -610,6 +618,12 @@ static int tiff_unpack_lzma(TiffContext *s, AVFrame *p, uint8_t *dst, int stride
av_free(buf);
return AVERROR_UNKNOWN;
}
if (outlen < (uint64_t)width * rows) {
av_log(s->avctx, AV_LOG_ERROR, "Uncompressed %"PRIu64" bytes, but %"PRIu64" are needed\n",
outlen, (uint64_t)width * rows);
av_free(buf);
return AVERROR_INVALIDDATA;
}
src = buf;
for (line = 0; line < lines; line++) {
if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {