[FFmpeg-cvslog] tiffdec: better checks for bitstream offsets, fixes out of array reads

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Nov 29 15:34:29 2012 +0100| [27eada287af5505a93a4b9410412c0a916117731] | committer: Michael Niedermayer

tiffdec: better checks for bitstream offsets, fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=27eada287af5505a93a4b9410412c0a916117731
---

 libavcodec/tiff.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index f00b1ad..34fb109 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1079,12 +1079,12 @@ static int decode_frame(AVCodecContext *avctx,
     dst = p->data[0];
 
     if (s->stripsizesoff) {
-        if (s->stripsizesoff >= avpkt->size)
+        if (s->stripsizesoff >= (unsigned)avpkt->size)
             return AVERROR_INVALIDDATA;
         bytestream2_init(&stripsizes, avpkt->data + s->stripsizesoff, avpkt->size - s->stripsizesoff);
     }
     if (s->strippos) {
-        if (s->strippos >= avpkt->size)
+        if (s->strippos >= (unsigned)avpkt->size)
             return AVERROR_INVALIDDATA;
         bytestream2_init(&stripdata, avpkt->data + s->strippos, avpkt->size - s->strippos);
     }