On 09/11/14 08:48, Vittorio Giovara wrote:
From: Michael Niedermayer <[email protected]>
CC: [email protected]
Bug-Id: CID 700699
---
libavcodec/tiffenc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/tiffenc.c b/libavcodec/tiffenc.c
index 93c151e..f794961 100644
--- a/libavcodec/tiffenc.c
+++ b/libavcodec/tiffenc.c
@@ -123,11 +123,11 @@ static void add_entry(TiffEncoderContext *s, enum
TiffTags tag,
bytestream_put_le16(&entries_ptr, type);
bytestream_put_le32(&entries_ptr, count);
- if (type_sizes[type] * count <= 4) {
+ if (type_sizes[type] * (int64_t)count <= 4) {
tnput(&entries_ptr, count, ptr_val, type, 0);
} else {
bytestream_put_le32(&entries_ptr, *s->buf - s->buf_start);
- check_size(s, count * type_sizes2[type]);
+ check_size(s, count * (int64_t)type_sizes2[type]);
tnput(s->buf, count, ptr_val, type, 0);
}
which is the bound of count? type_sizes2 is 8 at the most. type_sizes 100.
int count
uint8_t type_sizes*
count value is as most
uint32_t strips = (s->height - 1) / s->rps + 1
with s->rps at least 1
I'd change count to uint64_t to match
static inline int check_size(TiffEncoderContext *s, uint64_t need)
lu
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
