Fix a crash when decoding tiff by moving check

for invalid header up before reading data.
Fixes issue 2500.

Patch by Daniel Kang, daniel.d.kang at gmail

Originally committed as revision 26248 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index a23af1ab6f0bc0388462da8e47e7e4dcbb5906cc..c1b71dc99a738d7dd69a8454f077ec9c151cb920 100644 (file)
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -263,6 +263,10 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
         s->height = value;
         break;
     case TIFF_BPP:
+        if(count > 4){
+            av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
+            return -1;
+        }
         if(count == 1) s->bpp = value;
         else{
             switch(type){
@@ -278,10 +282,6 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
                 s->bpp = -1;
             }
         }
-        if(count > 4){
-            av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
-            return -1;
-        }
         switch(s->bpp*10 + count){
         case 11:
             s->avctx->pix_fmt = PIX_FMT_MONOBLACK;