libavcodec/exr : fix channel size calculation for uint32 channel
authorMartin Vignali <martin.vignali@gmail.com>
Wed, 16 Nov 2016 22:15:27 +0000 (23:15 +0100)
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Wed, 16 Nov 2016 22:45:44 +0000 (23:45 +0100)
uint32 need 4 bytes not 1.
Fix decoding when there is half/float and uint32 channel.

This fixes crashes due to pointer corruption caused by invalid writes.

The problem was introduced in commit
03152e74dfdc7f438cb4a10402c4de744e807e22.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
libavcodec/exr.c

index 51c17d6..f02337e 100644 (file)
@@ -1448,7 +1448,11 @@ static int decode_header(EXRContext *s)
                 channel->xsub       = xsub;
                 channel->ysub       = ysub;
 
-                s->current_channel_offset += 1 << current_pixel_type;
+                if (current_pixel_type == EXR_HALF) {
+                    s->current_channel_offset += 2;
+                } else {/* Float or UINT32 */
+                    s->current_channel_offset += 4;
+                }
             }
 
             /* Check if all channels are set with an offset or if the channels