From: Piotr Bandurski <ami_stuff@o2.pl>
Date: Thu, 29 Mar 2012 02:59:58 +0000 (+0200)
Subject: iff: prevent a possible crash with broken/prepared IFF PBM
X-Git-Tag: android-x86-4.4-r1~12688
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=ddd8974008918e3e8ecc209843d9a228036bede9;p=android-x86%2Fexternal-ffmpeg.git

iff: prevent a possible crash with broken/prepared IFF PBM

Based on fix by Peter Ross for ticket #1054.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---

diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index ae479492b6..851da394a9 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -553,13 +553,16 @@ static int decode_frame_ilbm(AVCodecContext *avctx,
                 memcpy(row, buf, FFMIN(avctx->width, buf_end - buf));
                 buf += avctx->width + (avctx->width % 2); // padding if odd
             }
-        } else { // IFF-PBM: HAM to PIX_FMT_BGR32
+        } else if (s->ham) { // IFF-PBM: HAM to PIX_FMT_BGR32
             for (y = 0; y < avctx->height; y++) {
                 uint8_t *row = &s->frame.data[0][ y*s->frame.linesize[0] ];
                 memcpy(s->ham_buf, buf, FFMIN(avctx->width, buf_end - buf));
                 buf += avctx->width + (avctx->width & 1); // padding if odd
                 decode_ham_plane32((uint32_t *) row, s->ham_buf, s->ham_palbuf, s->planesize);
             }
+        } else {
+            av_log_ask_for_sample(avctx, "unsupported bpp\n");
+            return AVERROR_INVALIDDATA;
         }
     }