[FFmpeg-devel] [PATCH] avcodec/tiff: check the black level denominator

[Michael Niedermayer]

On Sat, Oct 26, 2019 at 12:07:34PM -0300, James Almer wrote:
> Fixes ticket #8327.
> 
> Signed-off-by: James Almer <jamrial at gmail.com>
> ---
>  libavcodec/tiff.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
> index f537e99b5a..c34e97cd6d 100644
> --- a/libavcodec/tiff.c
> +++ b/libavcodec/tiff.c
> @@ -1413,6 +1413,10 @@ static int tiff_decode_tag(TiffContext *s, AVFrame *frame)
>              if (type == TIFF_RATIONAL) {
>                  value  = ff_tget(&s->gb, TIFF_LONG, s->le);
>                  value2 = ff_tget(&s->gb, TIFF_LONG, s->le);
> +                if (!value2) {
> +                    av_log(s->avctx, AV_LOG_ERROR, "Invalid black level denominator\n");
> +                    return AVERROR_INVALIDDATA;
> +                }
>  
>                  s->black_level = value / value2;
>              } else
> -- 

The code in the 2nd else branch below looks like it may have the same issue

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Modern terrorism, a quick summary: Need oil, start war with country that
has oil, kill hundread thousand in war. Let country fall into chaos,
be surprised about raise of fundamantalists. Drop more bombs, kill more
people, be surprised about them taking revenge and drop even more bombs
and strip your own citizens of their rights and freedoms. to be continued
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20191027/02c398ee/attachment.sig>