This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch release/9.0
in repository ffmpeg.
The following commit(s) were added to refs/heads/release/9.0 by this push:
new 3c287af3af avcodec/tiff: reject inflate output shorter than the strip
3c287af3af is described below
commit 3c287af3affe1286350faa69c02bcc5d49de18bb
Author: Michael Niedermayer <[email protected]>
AuthorDate: Wed Jul 22 05:44:41 2026 +0200
Commit: Michael Niedermayer <[email protected]>
CommitDate: Sun Aug 2 06:09:21 2026 +0200
avcodec/tiff: reject inflate output shorter than the strip
Fixes: use of uninitialized memory
Fixes: tiff_short_deflate_heap_disclosure.tiff
Fixes: 1cRIkpUVMQtn
Found-by: Adrian Junge (vurlo)
(cherry picked from commit 2f234ea34c81288e3840fca632dd16481d8de39f)
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/tiff.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 8a179f0fd0..b8ce7b0b55 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -526,6 +526,7 @@ static int tiff_unpack_zlib(TiffContext *s, AVFrame *p,
uint8_t *dst, int stride
uint8_t *zbuf;
unsigned long outlen;
int ret, line;
+ int rows = is_yuv ? (lines + s->subsampling[1] - 1) / s->subsampling[1] :
lines;
outlen = width * lines;
zbuf = av_malloc(outlen);
if (!zbuf)
@@ -545,6 +546,12 @@ static int tiff_unpack_zlib(TiffContext *s, AVFrame *p,
uint8_t *dst, int stride
av_free(zbuf);
return AVERROR_UNKNOWN;
}
+ if (outlen < (unsigned long)width * rows) {
+ av_log(s->avctx, AV_LOG_ERROR, "Deflated %lu bytes, but %lu are
needed\n",
+ outlen, (unsigned long)width * rows);
+ av_free(zbuf);
+ return AVERROR_INVALIDDATA;
+ }
src = zbuf;
for (line = 0; line < lines; line++) {
if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {
@@ -592,6 +599,7 @@ static int tiff_unpack_lzma(TiffContext *s, AVFrame *p,
uint8_t *dst, int stride
{
uint64_t outlen = width * (uint64_t)lines;
int ret, line;
+ int rows = is_yuv ? (lines + s->subsampling[1] - 1) / s->subsampling[1] :
lines;
uint8_t *buf = av_malloc(outlen);
if (!buf)
return AVERROR(ENOMEM);
@@ -610,6 +618,12 @@ static int tiff_unpack_lzma(TiffContext *s, AVFrame *p,
uint8_t *dst, int stride
av_free(buf);
return AVERROR_UNKNOWN;
}
+ if (outlen < (uint64_t)width * rows) {
+ av_log(s->avctx, AV_LOG_ERROR, "Uncompressed %"PRIu64" bytes, but
%"PRIu64" are needed\n",
+ outlen, (uint64_t)width * rows);
+ av_free(buf);
+ return AVERROR_INVALIDDATA;
+ }
src = buf;
for (line = 0; line < lines; line++) {
if (s->bpp < 8 && s->avctx->pix_fmt == AV_PIX_FMT_PAL8) {
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
