diff mbox series

[FFmpeg-devel,7/7] avcodec/tiff: Disallow striped and tiled tiffs except for DNG

Message ID 20201105231110.7772-7-michael@niedermayer.cc
State Accepted
Commit 292e41ce650a7b5ca5de4ae87fff0d6a90d9fc97
Headers show
Series [FFmpeg-devel,1/7,RFC] Revert "avcodec/adpcm_swf: support decoding multiple fixed-sized blocks at once" | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Michael Niedermayer Nov. 5, 2020, 11:11 p.m. UTC 
strips + tiles is not allowed in TIFF
DNG uses a separate codepath

Regression since da5b3d002862d1e105002a6dc1567e6551860896.

Fixes: NULL pointer dereference
Fixes: poc1

Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/tiff.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer Dec. 27, 2020, 5:58 p.m. UTC | #1 
On Fri, Nov 06, 2020 at 12:11:10AM +0100, Michael Niedermayer wrote:
> strips + tiles is not allowed in TIFF
> DNG uses a separate codepath
> 
> Regression since da5b3d002862d1e105002a6dc1567e6551860896.
> 
> Fixes: NULL pointer dereference
> Fixes: poc1
> 
> Found-by: 1vanChen of NSFOCUS Security Team
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/tiff.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)

will apply

[...]
diff mbox series

Patch

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 2e45464218..00f0c0ccf7 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1923,14 +1923,17 @@  again:
     has_strip_bits = s->strippos || s->strips || s->stripoff || s->rps || s->sot || s->sstype || s->stripsize || s->stripsizesoff;
 
     if (has_tile_bits && has_strip_bits) {
-        av_log(avctx, AV_LOG_WARNING, "Tiled TIFF is not allowed to strip\n");
+        int tiled_dng = s->is_tiled && is_dng;
+        av_log(avctx, tiled_dng ? AV_LOG_WARNING : AV_LOG_ERROR, "Tiled TIFF is not allowed to strip\n");
+        if (!tiled_dng)
+            return AVERROR_INVALIDDATA;
     }
 
     /* now we have the data and may start decoding */
     if ((ret = init_image(s, &frame)) < 0)
         return ret;
 
-    if (!s->is_tiled) {
+    if (!s->is_tiled || has_strip_bits) {
         if (s->strips == 1 && !s->stripsize) {
             av_log(avctx, AV_LOG_WARNING, "Image data size missing\n");
             s->stripsize = avpkt->size - s->stripoff;