On Sat, Nov 19, 2022 at 01:40:06PM +0100, Anton Khirnov wrote:
> Quoting Michael Niedermayer (2022-11-18 22:09:15)
> > Fixes: out of array access
> > Fixes: 52427/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-4849108968144896
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/tiff.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
> > index cde318d5e5..b962dce5a2 100644
> > --- a/libavcodec/tiff.c
> > +++ b/libavcodec/tiff.c
> > @@ -994,7 +994,7 @@ static int dng_decode_tiles(AVCodecContext *avctx, AVFrame *frame,
> >      tile_count_y = (s->height + s->tile_length - 1) / s->tile_length;
> >  
> >      /* Iterate over the number of tiles */
> > -    for (tile_idx = 0; tile_idx < s->tile_count; tile_idx++) {
> > +    for (tile_idx = 0; tile_idx < tile_count_x * tile_count_y; tile_idx++) {
> 
> Then why store tile_count at all? Seems to be it will just confuse
> future readers.
> 
> If I'm reading the code correctly, the only other use of tile_count is
> in setting has_tile_bits, but that also checks is_tiled, which is set
> together with tile_count.

i tend to make minimal changes with the bugfixes but yes you are correct
the field seems useless i will remove it in that patch

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Those who are best at talking, realize last or never when they are wrong.