[FFmpeg-devel] [PATCH 1/4] avcodec/tiff: Ignore tile_count

[Anton Khirnov]

Quoting Michael Niedermayer (2022-11-18 22:09:15)
> Fixes: out of array access
> Fixes: 52427/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4849108968144896
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/tiff.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
> index cde318d5e5..b962dce5a2 100644
> --- a/libavcodec/tiff.c
> +++ b/libavcodec/tiff.c
> @@ -994,7 +994,7 @@ static int dng_decode_tiles(AVCodecContext *avctx, AVFrame *frame,
>      tile_count_y = (s->height + s->tile_length - 1) / s->tile_length;
>  
>      /* Iterate over the number of tiles */
> -    for (tile_idx = 0; tile_idx < s->tile_count; tile_idx++) {
> +    for (tile_idx = 0; tile_idx < tile_count_x * tile_count_y; tile_idx++) {

Then why store tile_count at all? Seems to be it will just confuse
future readers.

If I'm reading the code correctly, the only other use of tile_count is
in setting has_tile_bits, but that also checks is_tiled, which is set
together with tile_count.

-- 
Anton Khirnov