summaryrefslogtreecommitdiff
path: root/libavcodec/tiff.c
diff options
context:
space:
mode:
authorDaniel Kang <daniel.d.kang@gmail.com>2011-01-06 22:12:55 +0000
committerCarl Eugen Hoyos <cehoyos@rainbow.studorg.tuwien.ac.at>2011-01-06 22:12:55 +0000
commitd381249bb86d5a4b1a99bb292a7aed034d6d12de (patch)
tree2c2476801bc1b409d9d07409a99fac9a763c1ff8 /libavcodec/tiff.c
parent35ca5c0b6b16fe284eb7147011f516c23a29ec0f (diff)
downloadffmpeg-d381249bb86d5a4b1a99bb292a7aed034d6d12de.tar.gz
Fix a crash when decoding tiff by moving check
for invalid header up before reading data. Fixes issue 2500. Patch by Daniel Kang, daniel.d.kang at gmail Originally committed as revision 26248 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/tiff.c')
-rw-r--r--libavcodec/tiff.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index a23af1ab6f..c1b71dc99a 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -263,6 +263,10 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
s->height = value;
break;
case TIFF_BPP:
+ if(count > 4){
+ av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
+ return -1;
+ }
if(count == 1) s->bpp = value;
else{
switch(type){
@@ -278,10 +282,6 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
s->bpp = -1;
}
}
- if(count > 4){
- av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
- return -1;
- }
switch(s->bpp*10 + count){
case 11:
s->avctx->pix_fmt = PIX_FMT_MONOBLACK;