diff mbox

[FFmpeg-devel,2/3] exr: fix out-of-bounds read

Message ID 58f36548-f5b7-aa38-8d36-e74a1d1c402b@googlemail.com
State Accepted
Commit ffdc5d09e498bee8176c9e35df101c01c546a738
Headers show

Commit Message

Andreas Cadhalpun Nov. 16, 2016, 7:56 p.m. UTC
channel_index can be -1.

This problem was introduced in commit
2dd7b46132e2801ef34fe1b5c27e0113cdcfa2f9.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
---
 libavcodec/exr.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

Comments

Paul B Mahol Nov. 16, 2016, 8:07 p.m. UTC | #1
On 11/16/16, Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> wrote:
> channel_index can be -1.
>
> This problem was introduced in commit
> 2dd7b46132e2801ef34fe1b5c27e0113cdcfa2f9.
>

lgtm
Andreas Cadhalpun Nov. 16, 2016, 9:40 p.m. UTC | #2
On 16.11.2016 21:07, Paul B Mahol wrote:
> On 11/16/16, Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> wrote:
>> channel_index can be -1.
>>
>> This problem was introduced in commit
>> 2dd7b46132e2801ef34fe1b5c27e0113cdcfa2f9.
>>
> 
> lgtm

Pushed together with the reindentation.

Best regards,
Andreas
diff mbox

Patch

diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 54869d2..bff08f2 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -1430,8 +1430,7 @@  static int decode_header(EXRContext *s)
                     return AVERROR_PATCHWELCOME;
                 }
 
-                if (s->channel_offsets[channel_index] == -1){/* channel have not been previously assign */
-                    if (channel_index >= 0) {
+                if (channel_index >= 0 && s->channel_offsets[channel_index] == -1) { /* channel has not been previously assigned */
                         if (s->pixel_type != EXR_UNKNOWN &&
                             s->pixel_type != current_pixel_type) {
                             av_log(s->avctx, AV_LOG_ERROR,
@@ -1440,7 +1439,6 @@  static int decode_header(EXRContext *s)
                         }
                         s->pixel_type                     = current_pixel_type;
                         s->channel_offsets[channel_index] = s->current_channel_offset;
-                    }
                 }
 
                 s->channels = av_realloc(s->channels,