sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/targa: reject truncated RLE packet payloads

Browse Source 
Fixes: 1j9froqh2wEw
Regression since: 2ad405548b
Fixes: use-of-uninitialized-value
Found-by: Trithem90 <149891156+Trithem90@users.noreply.github.com>
This commit is contained in:
Trithem90
2026-09-01 21:44:45 +02:00
committed by Michael Niedermayer
parent e45aa1bf83
commit f8f84348df
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/targa.c
View File

@@ -69,7 +69,12 @@ static int targa_decode_rle(AVCodecContext *avctx, TargaContext *s,
if (!type) {
do {
int n = FFMIN(count, w - x);
bytestream2_get_buffer(&s->gb, dst, n * depth);
if (bytestream2_get_bytes_left(&s->gb) < n * depth) {
av_log(avctx, AV_LOG_ERROR,
"Not enough data for raw RLE packet\n");
return AVERROR_INVALIDDATA;
}
bytestream2_get_bufferu(&s->gb, dst, n * depth);
count -= n;
dst += n * depth;
x += n;
@@ -80,7 +85,11 @@ static int targa_decode_rle(AVCodecContext *avctx, TargaContext *s,
} while (dst && count > 0);
} else {
uint8_t tmp[4];
bytestream2_get_buffer(&s->gb, tmp, depth);
if (bytestream2_get_buffer(&s->gb, tmp, depth) != depth) {
av_log(avctx, AV_LOG_ERROR,
"Not enough data for RLE pixel\n");
return AVERROR_INVALIDDATA;
}
do {
int n = FFMIN(count, w - x);
count -= n;