X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Ftiff.c;h=4be587d569b996e73d9e58ce034a4ed8226db756;hb=48f80831bad87addf40b6496210817ea0efc85af;hp=d5c6398a17c49df8a90a389845891b6d8bc2a63e;hpb=40231a58a0d8bffbe2264fe980483edaa6fc422e;p=ffmpeg

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index d5c6398a17c..4be587d569b 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1004,8 +1004,13 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
             av_log(s->avctx, AV_LOG_ERROR, "subsample count invalid\n");
             return AVERROR_INVALIDDATA;
         }
-        for (i = 0; i < count; i++)
+        for (i = 0; i < count; i++) {
             s->subsampling[i] = ff_tget(&s->gb, type, s->le);
+            if (s->subsampling[i] <= 0) {
+                av_log(s->avctx, AV_LOG_ERROR, "subsampling %d is invalid\n", s->subsampling[i]);
+                return AVERROR_INVALIDDATA;
+            }
+        }
         break;
     case TIFF_T4OPTIONS:
         if (s->compr == TIFF_G3)
@@ -1253,7 +1258,7 @@ static int decode_frame(AVCodecContext *avctx,
                          avpkt->size - s->strippos);
     }
 
-    if (s->rps <= 0) {
+    if (s->rps <= 0 || s->rps % s->subsampling[1]) {
         av_log(avctx, AV_LOG_ERROR, "rps %d invalid\n", s->rps);
         return AVERROR_INVALIDDATA;
     }