tiff: Check that there is no aliasing in pixel format selection
authorAnton Khirnov <anton@khirnov.net>
Sat, 7 Mar 2015 21:06:59 +0000 (22:06 +0100)
committerReinhard Tartler <siretart@tauware.de>
Mon, 9 Mar 2015 02:11:54 +0000 (22:11 -0400)
Fixes possible issues with unexpected bpp/bppcount values.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-8544
(cherry picked from commit ae5e1f3d663a8c9a532d89e588cbc61f171c9186)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit eb9041403d820634c45ed4ee98570246a252507a)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
libavcodec/tiff.c

index 309f1a9..67dc5bd 100644 (file)
@@ -236,6 +236,14 @@ static int init_image(TiffContext *s)
     int i, ret;
     uint32_t *pal;
 
+    // make sure there is no aliasing in the following switch
+    if (s->bpp >= 100 || s->bppcount >= 10) {
+        av_log(s->avctx, AV_LOG_ERROR,
+               "Unsupported image parameters: bpp=%d, bppcount=%d\n",
+               s->bpp, s->bppcount);
+        return AVERROR_INVALIDDATA;
+    }
+
     switch (s->bpp * 10 + s->bppcount) {
     case 11:
         s->avctx->pix_fmt = AV_PIX_FMT_MONOBLACK;