---
libavcodec/tiff.c | 13 +++++++++----
1 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index cd00da4..26304ca 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -106,13 +106,18 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t*
dst, int stride, const uin
int c, line, pixels, code;
const uint8_t *ssrc = src;
int width = ((s->width * s->bpp) + 7) >> 3;
-#if CONFIG_ZLIB
- uint8_t *zbuf; unsigned long outlen;
+ if (size <= 0)
+ return AVERROR_INVALIDDATA;
+
+#if CONFIG_ZLIB
if(s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE){
+ uint8_t *zbuf; unsigned long outlen;
int ret;
outlen = width * lines;
zbuf = av_malloc(outlen);
+ if (!zbuf)
+ return AVERROR(ENOMEM);
ret = tiff_uncompress(zbuf, &outlen, src, size);
if(ret != Z_OK){
av_log(s->avctx, AV_LOG_ERROR, "Uncompressing failed (%lu of %lu)
with error %d\n", outlen, (unsigned long)width * lines, ret);
@@ -139,9 +144,9 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst,
int stride, const uin
int i, ret = 0;
uint8_t *src2 = av_malloc((unsigned)size +
FF_INPUT_BUFFER_PADDING_SIZE);
- if(!src2 || (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE <
(unsigned)size){
+ if (!src2) {
av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary
buffer\n");
- return -1;
+ return AVERROR(ENOMEM);
}
if(s->fax_opts & 2){
av_log(s->avctx, AV_LOG_ERROR, "Uncompressed fax mode is not
supported (yet)\n");
--
1.7.7.3
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
