[FFmpeg-cvslog] tiff: Check buffer allocation and pointer increment more carefully in shorts2str () and double2str()

[Michael Niedermayer]

ffmpeg | branch: release/1.1 | Michael Niedermayer <michaelni at gmx.at> | Tue Feb 12 23:40:24 2013 +0100| [75211f2b8cfb8b4a3f47c514e55585651eeb2767] | committer: Michael Niedermayer

tiff: Check buffer allocation and pointer increment more carefully in shorts2str() and double2str()

Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit e1219cdaf9fb4bc8cea410e1caf802373c1bfe51)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=75211f2b8cfb8b4a3f47c514e55585651eeb2767
---

 libavcodec/tiff.c |   20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 85a5823..1011116 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -212,10 +212,12 @@ static char *doubles2str(double *dp, int count, const char *sep)
 {
     int i;
     char *ap, *ap0;
-    int component_len;
+    uint64_t component_len;
     if (!sep) sep = ", ";
-    component_len = 15 + strlen(sep);
-    ap = av_malloc(component_len * count);
+    component_len = 15LL + strlen(sep);
+    if (count >= (INT_MAX - 1)/component_len)
+        return NULL;
+    ap = av_malloc(component_len * count + 1);
     if (!ap)
         return NULL;
     ap0   = ap;
@@ -236,14 +238,22 @@ static char *shorts2str(int16_t *sp, int count, const char *sep)
 {
     int i;
     char *ap, *ap0;
+    uint64_t component_len;
     if (!sep) sep = ", ";
-    ap = av_malloc((5 + strlen(sep)) * count);
+    component_len = 7LL + strlen(sep);
+    if (count >= (INT_MAX - 1)/component_len)
+        return NULL;
+    ap = av_malloc(component_len * count + 1);
     if (!ap)
         return NULL;
     ap0   = ap;
     ap[0] = '\0';
     for (i = 0; i < count; i++) {
-        int l = snprintf(ap, 5 + strlen(sep), "%d%s", sp[i], sep);
+        unsigned l = snprintf(ap, component_len, "%d%s", sp[i], sep);
+        if (l >= component_len) {
+            av_free(ap0);
+            return NULL;
+        }
         ap += l;
     }
     ap0[strlen(ap0) - strlen(sep)] = '\0';