[FFmpeg-cvslog] iff: prevent a possible crash with broken/prepared IFF PBM

[Piotr Bandurski]

ffmpeg | branch: master | Piotr Bandurski <ami_stuff at o2.pl> | Thu Mar 29 04:59:58 2012 +0200| [ddd8974008918e3e8ecc209843d9a228036bede9] | committer: Michael Niedermayer

iff: prevent a possible crash with broken/prepared IFF PBM

Based on fix by Peter Ross for ticket #1054.
Reviewed-by: Paul B Mahol <onemda at gmail.com>
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ddd8974008918e3e8ecc209843d9a228036bede9
---

 libavcodec/iff.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index ae47949..851da39 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -553,13 +553,16 @@ static int decode_frame_ilbm(AVCodecContext *avctx,
                 memcpy(row, buf, FFMIN(avctx->width, buf_end - buf));
                 buf += avctx->width + (avctx->width % 2); // padding if odd
             }
-        } else { // IFF-PBM: HAM to PIX_FMT_BGR32
+        } else if (s->ham) { // IFF-PBM: HAM to PIX_FMT_BGR32
             for (y = 0; y < avctx->height; y++) {
                 uint8_t *row = &s->frame.data[0][ y*s->frame.linesize[0] ];
                 memcpy(s->ham_buf, buf, FFMIN(avctx->width, buf_end - buf));
                 buf += avctx->width + (avctx->width & 1); // padding if odd
                 decode_ham_plane32((uint32_t *) row, s->ham_buf, s->ham_palbuf, s->planesize);
             }
+        } else {
+            av_log_ask_for_sample(avctx, "unsupported bpp\n");
+            return AVERROR_INVALIDDATA;
         }
     }