strips + tiles is not allowed in TIFF
DNG uses a separate codepath
Regression since da5b3d002862d1e105002a6dc1567e6551860896.
Fixes: NULL pointer dereference
Fixes: poc1
Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavcodec/tiff.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 2e45464218..00f0c0ccf7 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1923,14 +1923,17 @@ again:
has_strip_bits = s->strippos || s->strips || s->stripoff || s->rps ||
s->sot || s->sstype || s->stripsize || s->stripsizesoff;
if (has_tile_bits && has_strip_bits) {
- av_log(avctx, AV_LOG_WARNING, "Tiled TIFF is not allowed to strip\n");
+ int tiled_dng = s->is_tiled && is_dng;
+ av_log(avctx, tiled_dng ? AV_LOG_WARNING : AV_LOG_ERROR, "Tiled TIFF
is not allowed to strip\n");
+ if (!tiled_dng)
+ return AVERROR_INVALIDDATA;
}
/* now we have the data and may start decoding */
if ((ret = init_image(s, &frame)) < 0)
return ret;
- if (!s->is_tiled) {
+ if (!s->is_tiled || has_strip_bits) {
if (s->strips == 1 && !s->stripsize) {
av_log(avctx, AV_LOG_WARNING, "Image data size missing\n");
s->stripsize = avpkt->size - s->stripoff;
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
