[FFmpeg-cvslog] avcodec/tiff: Check for multiple geo key directories

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon Mar 13 20:45:08 2017 +0100| [108b02e5471c1dae248200db694aba9b7b8555a8] | committer: Michael Niedermayer

avcodec/tiff: Check for multiple geo key directories

Fixes memleak
Fixes: 826/clusterfuzz-testcase-5316921379520512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=108b02e5471c1dae248200db694aba9b7b8555a8
---

 libavcodec/tiff.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index efbd979..456da51 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1045,6 +1045,10 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
         ADD_METADATA(count, "ModelTiepointTag", NULL);
         break;
     case TIFF_GEO_KEY_DIRECTORY:
+        if (s->geotag_count) {
+            avpriv_request_sample(s->avctx, "Multiple geo key directories\n");
+            return AVERROR_INVALIDDATA;
+        }
         ADD_METADATA(1, "GeoTIFF_Version", NULL);
         ADD_METADATA(2, "GeoTIFF_Key_Revision", ".");
         s->geotag_count   = ff_tget_short(&s->gb, s->le);