[FFmpeg-cvslog] r26288 - trunk/libavcodec/tiff.c

[cehoyos]

Author: cehoyos
Date: Sun Jan  9 20:29:39 2011
New Revision: 26288

Log:
Return on negative soff sizes, fixes issue 2515.

Patch by Daniel Kang, daniel.d.kang at gmail

Modified:
   trunk/libavcodec/tiff.c

Modified: trunk/libavcodec/tiff.c
==============================================================================
--- trunk/libavcodec/tiff.c	Sun Jan  9 16:23:00 2011	(r26287)
+++ trunk/libavcodec/tiff.c	Sun Jan  9 20:29:39 2011	(r26288)
@@ -540,6 +540,10 @@ static int decode_frame(AVCodecContext *
             soff = tget(&s->stripdata, s->sot, s->le);
         }else
             soff = s->stripoff;
+        if (soff < 0) {
+            av_log(avctx, AV_LOG_ERROR, "Invalid stripoff: %d\n", soff);
+            return AVERROR(EINVAL);
+        }
         if(tiff_unpack_strip(s, dst, stride, orig_buf + soff, ssize, FFMIN(s->rps, s->height - i)) < 0)
             break;
         dst += s->rps * stride;