diff mbox series

[FFmpeg-devel] avcodec/tiff: Fix loop detection

Message ID 20220912181918.9699-1-michael@niedermayer.cc
State Accepted
Commit 43a4854510a3d596e114d899177a5b3b323ca9fb
Headers show
Series [FFmpeg-devel] avcodec/tiff: Fix loop detection | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Sept. 12, 2022, 6:19 p.m. UTC 
Fixes regression with tickets/4364/L1004220.DNG

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/tiff.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Paul B Mahol Sept. 16, 2022, 3:13 p.m. UTC | #1 
lgtm
Michael Niedermayer Sept. 16, 2022, 5:43 p.m. UTC | #2 
On Fri, Sep 16, 2022 at 05:13:46PM +0200, Paul B Mahol wrote:
> lgtm

will apply

thx

[...]
diff mbox series

Patch

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index beb427e0074..226050744fc 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1747,7 +1747,7 @@  static int decode_frame(AVCodecContext *avctx, AVFrame *p,
                         int *got_frame, AVPacket *avpkt)
 {
     TiffContext *const s = avctx->priv_data;
-    unsigned off, last_off;
+    unsigned off, last_off = 0;
     int le, ret, plane, planes;
     int i, j, entries, stride;
     unsigned soff, ssize;
@@ -1812,7 +1812,6 @@  again:
     /** whether we should process this multi-page IFD's next page */
     retry_for_page = s->get_page && s->cur_page + 1 < s->get_page;  // get_page is 1-indexed
 
-    last_off = off;
     if (retry_for_page) {
         // set offset to the next IFD
         off = ff_tget_long(&s->gb, le);
@@ -1830,6 +1829,7 @@  again:
             avpriv_request_sample(s->avctx, "non increasing IFD offset");
             return AVERROR_INVALIDDATA;
         }
+        last_off = off;
         if (off >= UINT_MAX - 14 || avpkt->size < off + 14) {
             av_log(avctx, AV_LOG_ERROR, "IFD offset is greater than image size\n");
             return AVERROR_INVALIDDATA;