diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-11-16 22:46:56 +0300 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-11-17 00:37:17 +0300 |
| commit | ffdc5d09e498bee8176c9e35df101c01c546a738 (patch) | |
| tree | e9176ea8c3d394f2ac13401e64be354c8d5c1165 /libavcodec/exr.c | |
| parent | 721c90f0f99c0f295b411d8a4f8460098c5ce27e (diff) | |
exr: fix out-of-bounds read
channel_index can be -1.
This problem was introduced in commit
2dd7b46132e2801ef34fe1b5c27e0113cdcfa2f9.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Diffstat (limited to 'libavcodec/exr.c')
| -rw-r--r-- | libavcodec/exr.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/libavcodec/exr.c b/libavcodec/exr.c index c250eea423..51a8ee603c 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -1428,8 +1428,7 @@ static int decode_header(EXRContext *s) return AVERROR_PATCHWELCOME; } - if (s->channel_offsets[channel_index] == -1){/* channel have not been previously assign */ - if (channel_index >= 0) { + if (channel_index >= 0 && s->channel_offsets[channel_index] == -1) { /* channel has not been previously assigned */ if (s->pixel_type != EXR_UNKNOWN && s->pixel_type != current_pixel_type) { av_log(s->avctx, AV_LOG_ERROR, @@ -1438,7 +1437,6 @@ static int decode_header(EXRContext *s) } s->pixel_type = current_pixel_type; s->channel_offsets[channel_index] = s->current_channel_offset; - } } s->channels = av_realloc(s->channels, |