[FFmpeg-cvslog] avcodec/tiff: Check for Tiled and Stripped TIFFs

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Wed Feb 19 15:15:42 2020 +0100| [70faa9f618183956d42d520f516b6d0c8e3d81ce] | committer: Michael Niedermayer

avcodec/tiff: Check for Tiled and Stripped TIFFs

TIFF 6 spec: "Do not use both strip-oriented and tile-oriented fields in the same TIFF file."

Fixes: null pointer use, crash
Fixes: crash-762680f9d1b27f9b9085e12887ad44893fb2b020

Found-by: Shiziru <lunasl at protonmail.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=70faa9f618183956d42d520f516b6d0c8e3d81ce
---

 libavcodec/tiff.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 5e4f424b67..010943c38c 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1758,6 +1758,7 @@ static int decode_frame(AVCodecContext *avctx,
     GetByteContext stripdata;
     int retry_for_subifd, retry_for_page;
     int is_dng;
+    int has_tile_bits, has_strip_bits;
 
     bytestream2_init(&s->gb, avpkt->data, avpkt->size);
 
@@ -1885,6 +1886,14 @@ again:
         return AVERROR_INVALIDDATA;
     }
 
+    has_tile_bits  = s->is_tiled || s->tile_byte_counts_offset || s->tile_offsets_offset || s->tile_width || s->tile_length || s->tile_count;
+    has_strip_bits = s->strippos || s->strips || s->stripoff || s->rps || s->sot || s->sstype || s->stripsize || s->stripsizesoff;
+
+    if (has_tile_bits && has_strip_bits) {
+        av_log(avctx, AV_LOG_ERROR, "Tiled TIFF is not allowed to strip\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     /* now we have the data and may start decoding */
     if ((ret = init_image(s, &frame)) < 0)
         return ret;