Merge remote branch 'qatar/master'

[ffmpeg] / libavcodec / tiff.c

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index e02767caadb1602166abe892ebffc0befe9caeba..d43999b2f067b9dde76ba2191aec3158611a1e14 100644 (file)
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -21,7 +21,7 @@
 
 /**
  * TIFF image decoder
- * @file libavcodec/tiff.c
+ * @file
  * @author Konstantin Shishkov
  */
 #include "avcodec.h"
@@ -33,6 +33,7 @@
 #include "faxcompr.h"
 #include "libavutil/common.h"
 #include "libavutil/intreadwrite.h"
+#include "libavutil/imgutils.h"
 
 typedef struct TiffContext {
     AVCodecContext *avctx;
@@ -262,6 +263,10 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
         s->height = value;
         break;
     case TIFF_BPP:
+        if(count > 4){
+            av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
+            return -1;
+        }
         if(count == 1) s->bpp = value;
         else{
             switch(type){
@@ -277,10 +282,6 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
                 s->bpp = -1;
             }
         }
-        if(count > 4){
-            av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
-            return -1;
-        }
         switch(s->bpp*10 + count){
         case 11:
             s->avctx->pix_fmt = PIX_FMT_MONOBLACK;
@@ -305,7 +306,7 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
             return -1;
         }
         if(s->width != s->avctx->width || s->height != s->avctx->height){
-            if(avcodec_check_dimensions(s->avctx, s->width, s->height))
+            if(av_image_check_size(s->width, s->height, 0, s->avctx))
                 return -1;
             avcodec_set_dimensions(s->avctx, s->width, s->height);
         }
@@ -428,7 +429,8 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
         bp = buf + count / 3 * off * 2;
         off = (type_sizes[type] - 1) << 3;
         for(i = 0; i < count / 3; i++){
-            j = (tget(&rp, type, s->le) >> off) << 16;
+            j = 0xff << 24;
+            j |= (tget(&rp, type, s->le) >> off) << 16;
             j |= (tget(&gp, type, s->le) >> off) << 8;
             j |= tget(&bp, type, s->le) >> off;
             pal[i] = j;
@@ -507,7 +509,7 @@ static int decode_frame(AVCodecContext *avctx,
         s->bpp = 1;
         avctx->pix_fmt = PIX_FMT_MONOBLACK;
         if(s->width != s->avctx->width || s->height != s->avctx->height){
-            if(avcodec_check_dimensions(s->avctx, s->width, s->height))
+            if(av_image_check_size(s->width, s->height, 0, s->avctx))
                 return -1;
             avcodec_set_dimensions(s->avctx, s->width, s->height);
         }
@@ -530,10 +532,19 @@ static int decode_frame(AVCodecContext *avctx,
         else
             ssize = s->stripsize;
 
+        if (ssize > buf_size) {
+            av_log(avctx, AV_LOG_ERROR, "Buffer size is smaller than strip size\n");
+            return -1;
+        }
+
         if(s->stripdata){
             soff = tget(&s->stripdata, s->sot, s->le);
         }else
             soff = s->stripoff;
+        if (soff < 0) {
+            av_log(avctx, AV_LOG_ERROR, "Invalid stripoff: %d\n", soff);
+            return AVERROR(EINVAL);
+        }
         if(tiff_unpack_strip(s, dst, stride, orig_buf + soff, ssize, FFMIN(s->rps, s->height - i)) < 0)
             break;
         dst += s->rps * stride;
@@ -590,7 +601,7 @@ static av_cold int tiff_end(AVCodecContext *avctx)
     return 0;
 }
 
-AVCodec tiff_decoder = {
+AVCodec ff_tiff_decoder = {
     "tiff",
     AVMEDIA_TYPE_VIDEO,
     CODEC_ID_TIFF,