summaryrefslogtreecommitdiff
path: root/libavcodec/tiff.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2020-02-15 17:12:38 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2020-04-29 23:42:37 +0200
commite444e5bb1ad9434ab79790a5aececcd6b783360b (patch)
tree876f0a1c25296c423c5deafab1d17c40400b824d /libavcodec/tiff.c
parent61e6eddc5735c0b981d868a17c0fb8fe9b2b8a88 (diff)
downloadffmpeg-e444e5bb1ad9434ab79790a5aececcd6b783360b.tar.gz
avcodec/tiff: assert that raw tiff dng blit does not write over the end of a line
Found-by: 黄宁 <tsukimurarin@163.com> Reviewed-by: Nick Renieris <velocityra@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/tiff.c')
-rw-r--r--libavcodec/tiff.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 176bfc274b..45cb225d0a 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -704,18 +704,20 @@ static int tiff_unpack_strip(TiffContext *s, AVFrame *p, uint8_t *dst, int strid
/* Color processing for DNG images with uncompressed strips (non-tiled) */
if (is_dng) {
- int is_u16, pixel_size_bytes, pixel_size_bits;
+ int is_u16, pixel_size_bytes, pixel_size_bits, elements;
is_u16 = (s->bpp > 8);
pixel_size_bits = (is_u16 ? 16 : 8);
pixel_size_bytes = (is_u16 ? sizeof(uint16_t) : sizeof(uint8_t));
+ elements = width / pixel_size_bytes * pixel_size_bits / s->bpp * s->bppcount; // need to account for [1, 16] bpp
+ av_assert0 (elements * pixel_size_bytes <= FFABS(stride));
dng_blit(s,
dst,
0, // no stride, only 1 line
dst,
0, // no stride, only 1 line
- width / pixel_size_bytes * pixel_size_bits / s->bpp * s->bppcount, // need to account for [1, 16] bpp
+ elements,
1,
0, // single-component variation is only preset in JPEG-encoded DNGs
is_u16);