Browse Source

tiffdec: Prevent illegal memory access caused by recycled pointers.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit fd0be63049)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
tags/n0.8.11
Alex Converse Reinhard Tartler 14 years ago
parent
commit
bbe316dfb4
1 changed files with 2 additions and 0 deletions
  1. +2
    -0
      libavcodec/tiff.c

+ 2
- 0
libavcodec/tiff.c View File

@@ -534,6 +534,8 @@ static int decode_frame(AVCodecContext *avctx,
av_log(avctx, AV_LOG_ERROR, "The answer to life, universe and everything is not correct!\n");
return -1;
}
// Reset these pointers so we can tell if they were set this frame
s->stripsizes = s->stripdata = NULL;
/* parse image file directory */
off = tget_long(&buf, le);
if (off >= UINT_MAX - 14 || end_buf - orig_buf < off + 14) {


Loading…
Cancel
Save