diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 64e4e41..2ed1267 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -405,14 +405,25 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride, #if CONFIG_ZLIB if (s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE) { - uint8_t *zbuf; + uint8_t *src2, *zbuf; unsigned long outlen; - int ret; + int i, ret; outlen = width * lines; zbuf = av_malloc(outlen); if (!zbuf) return AVERROR(ENOMEM); - ret = tiff_uncompress(zbuf, &outlen, src, size); + src2 = av_malloc((unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE); + if (!src2) { + av_log(s->avctx, AV_LOG_ERROR, "Error allocating temporary buffer\n"); + return AVERROR(ENOMEM); + if (!s->fill_order) { + memcpy(src2, src, size); + } else { + for (i = 0; i < size; i++) + src2[i] = ff_reverse[src[i]]; + } + memset(src2 + size, 0, FF_INPUT_BUFFER_PADDING_SIZE); + ret = tiff_uncompress(zbuf, &outlen, src2, size); if (ret != Z_OK) { av_log(s->avctx, AV_LOG_ERROR, "Uncompressing failed (%lu of %lu) with error %d\n", outlen, @@ -431,6 +442,7 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t *dst, int stride, src += width; } av_free(zbuf); + av_free(src2); return 0; } #endif