Hi, The multiplication width * lines in tiff_unpack_zlib() is evaluated as int * int, which can overflow for large YCbCr images. This is the same bug that was fixed in tiff_unpack_lzma() in 2017 (eac727a502, CID1348138) — the zlib variant was missed. Use uint64_t widening and add a size check, matching the existing safe pattern in tiff_unpack_lzma. Signed-off-by: joaonevess <[email protected]> --- libavcodec/tiff.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index bb8120bc1b..5d880d081a 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -524,9 +524,11 @@ static int tiff_unpack_zlib(TiffContext *s, AVFrame *p, uint8_t *dst, int stride int strip_start, int is_yuv) { uint8_t *zbuf; - unsigned long outlen; + uint64_t outlen = width * (uint64_t)lines; int ret, line; - outlen = width * lines; + + if (outlen > INT_MAX) + return AVERROR_INVALIDDATA; zbuf = av_malloc(outlen); if (!zbuf) return AVERROR(ENOMEM); -- 2.50.1 (Apple Git-155) _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
[FFmpeg-devel] [PATCH] avcodec/tiff: fix integer overflow in tiff_unpack_zlib
joaocns0--- via ffmpeg-devel Thu, 02 Apr 2026 23:46:11 -0700
