[FFmpeg-cvslog] pnmdec: make ff_pnm_decode_header() more robust
Michael Niedermayer
git at videolan.org
Tue Aug 7 21:10:56 CEST 2012
ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Tue Aug 7 20:58:25 2012 +0200| [0049af262825254705bdbb97c28004dd7c7c2b24] | committer: Michael Niedermayer
pnmdec: make ff_pnm_decode_header() more robust
Fixes ticket1321
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0049af262825254705bdbb97c28004dd7c7c2b24
---
libavcodec/pnm.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/libavcodec/pnm.c b/libavcodec/pnm.c
index a20051e..8c0f218 100644
--- a/libavcodec/pnm.c
+++ b/libavcodec/pnm.c
@@ -104,7 +104,7 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)
}
}
/* check that all tags are present */
- if (w <= 0 || h <= 0 || maxval <= 0 || depth <= 0 || tuple_type[0] == '\0' || av_image_check_size(w, h, 0, avctx))
+ if (w <= 0 || h <= 0 || maxval <= 0 || depth <= 0 || tuple_type[0] == '\0' || av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end)
return -1;
avctx->width = w;
@@ -141,13 +141,15 @@ int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)
return -1;
}
pnm_get(s, buf1, sizeof(buf1));
- avctx->width = atoi(buf1);
- if (avctx->width <= 0)
- return -1;
+ w = atoi(buf1);
pnm_get(s, buf1, sizeof(buf1));
- avctx->height = atoi(buf1);
- if(avctx->height <= 0 || av_image_check_size(avctx->width, avctx->height, 0, avctx))
+ h = atoi(buf1);
+ if(w <= 0 || h <= 0 || av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end)
return -1;
+
+ avctx->width = w;
+ avctx->height = h;
+
if (avctx->pix_fmt != PIX_FMT_MONOWHITE && avctx->pix_fmt != PIX_FMT_MONOBLACK) {
pnm_get(s, buf1, sizeof(buf1));
s->maxval = atoi(buf1);
More information about the ffmpeg-cvslog
mailing list