diff options
Diffstat (limited to 'libavcodec/tiff.c')
| -rw-r--r-- | libavcodec/tiff.c | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 9829e92bf8..939cfb2dca 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -218,10 +218,12 @@ static char *doubles2str(double *dp, int count, const char *sep) { int i; char *ap, *ap0; - int component_len; + uint64_t component_len; if (!sep) sep = ", "; - component_len = 15 + strlen(sep); - ap = av_malloc(component_len * count); + component_len = 15LL + strlen(sep); + if (count >= (INT_MAX - 1)/component_len) + return NULL; + ap = av_malloc(component_len * count + 1); if (!ap) return NULL; ap0 = ap; @@ -242,14 +244,22 @@ static char *shorts2str(int16_t *sp, int count, const char *sep) { int i; char *ap, *ap0; + uint64_t component_len; if (!sep) sep = ", "; - ap = av_malloc((5 + strlen(sep)) * count); + component_len = 7LL + strlen(sep); + if (count >= (INT_MAX - 1)/component_len) + return NULL; + ap = av_malloc(component_len * count + 1); if (!ap) return NULL; ap0 = ap; ap[0] = '\0'; for (i = 0; i < count; i++) { - int l = snprintf(ap, 5 + strlen(sep), "%d%s", sp[i], sep); + unsigned l = snprintf(ap, component_len, "%d%s", sp[i], sep); + if (l >= component_len) { + av_free(ap0); + return NULL; + } ap += l; } ap0[strlen(ap0) - strlen(sep)] = '\0'; |