At least 2 bytes from the source are read every loop.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
break;
case TIFF_PACKBITS:
for (pixels = 0; pixels < width;) {
+ if (ssrc + size - src < 2)
+ return AVERROR_INVALIDDATA;
code = (int8_t) *src++;
if (code >= 0) {
code++;
- if (pixels + code > width) {
+ if (pixels + code > width ||
+ ssrc + size - src < code) {
av_log(s->avctx, AV_LOG_ERROR,
"Copy went out of bounds\n");
return AVERROR_INVALIDDATA;