Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

iff_ilbm: fix null ptr deref

Fixes Ticket1362

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 849d4b0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
  • Loading branch information...
commit 59417897bee880be334b0a891f333cb537b01337 1 parent 03f82b5
@michaelni michaelni authored
Showing with 7 additions and 3 deletions.
  1. +7 −3 libavcodec/iff.c
View
10 libavcodec/iff.c
@@ -191,7 +191,13 @@ static int extract_header(AVCodecContext *const avctx,
const uint8_t *buf;
unsigned buf_size;
IffContext *s = avctx->priv_data;
- int palette_size = avctx->extradata_size - AV_RB16(avctx->extradata);
+ int palette_size;
+
+ if (avctx->extradata_size < 2) {
+ av_log(avctx, AV_LOG_ERROR, "not enough extradata\n");
+ return AVERROR_INVALIDDATA;
+ }
+ palette_size = avctx->extradata_size - AV_RB16(avctx->extradata);
if (avpkt) {
int image_size;
@@ -207,8 +213,6 @@ static int extract_header(AVCodecContext *const avctx,
return AVERROR_INVALIDDATA;
}
} else {
- if (avctx->extradata_size < 2)
- return AVERROR_INVALIDDATA;
buf = avctx->extradata;
buf_size = bytestream_get_be16(&buf);
if (buf_size <= 1 || palette_size < 0) {
Please sign in to comment.
Something went wrong with that request. Please try again.