RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/pngdec: Check that previous_picture has same w/h/format 

Fixes: out of array access
Fixes: 15540/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5684905029140480

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-07-10 23:02:36 +02:00
parent 9ffa32b81b
commit 18c808ffbe
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavcodec/pngdec.c
View File

@ -1391,6 +1391,9 @@ exit_loop:
if (CONFIG_PNG_DECODER && avctx->codec_id != AV_CODEC_ID_APNG) if (CONFIG_PNG_DECODER && avctx->codec_id != AV_CODEC_ID_APNG)
handle_p_frame_png(s, p); handle_p_frame_png(s, p);
else if (CONFIG_APNG_DECODER && else if (CONFIG_APNG_DECODER &&
s->previous_picture.f->width == p->width &&
s->previous_picture.f->height== p->height &&
s->previous_picture.f->format== p->format &&
avctx->codec_id == AV_CODEC_ID_APNG && avctx->codec_id == AV_CODEC_ID_APNG &&
(ret = handle_p_frame_apng(avctx, s, p)) < 0) (ret = handle_p_frame_apng(avctx, s, p)) < 0)
goto fail; goto fail;