har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libavcodec/exr : fix channel size calculation for uint32 channel

Browse Source 
uint32 need 4 bytes not 1.
Fix decoding when there is half/float and uint32 channel.

This fixes crashes due to pointer corruption caused by invalid writes.

The problem was introduced in commit
03152e74dfdc7f438cb4a10402c4de744e807e22.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 52da3f6f70b1e95589a152aaf224811756fb9665)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Martin Vignali 2016-11-16 23:15:27 +01:00 committed by Andreas Cadhalpun
parent c7d38efbc2
commit 08f26d99b5
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/exr.c
View File

@ -1448,7 +1448,11 @@ static int decode_header(EXRContext *s)
channel->xsub = xsub;
channel->ysub = ysub;
s->current_channel_offset += 1 << current_pixel_type;
if (current_pixel_type == EXR_HALF) {
s->current_channel_offset += 2;
} else {/* Float or UINT32 */
s->current_channel_offset += 4;
}
}
/* Check if all channels are set with an offset or if the channels