RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

gifdec: check that the last keyframe exists and has been successfully parsed. 

Prevents inconsistent state and null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-01-24 04:17:58 +01:00
parent b53ed19aa7
commit 46cb61819d
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/gifdec.c
View File

@ -75,6 +75,7 @@ typedef struct GifState {
AVCodecContext *avctx;
int keyframe;
int keyframe_ok;
int trans_color; /**< color value that is used instead of transparent color */
} GifState;
@ -472,6 +473,7 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
}
if (s->keyframe) {
s->keyframe_ok = 0;
if ((ret = gif_read_header1(s)) < 0)
return ret;
@ -489,7 +491,13 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
s->picture.pict_type = AV_PICTURE_TYPE_I;
s->picture.key_frame = 1;
s->keyframe_ok = 1;
} else {
if (!s->keyframe_ok) {
av_log(avctx, AV_LOG_ERROR, "cannot decode frame without keyframe\n");
return AVERROR_INVALIDDATA;
}
if ((ret = avctx->reget_buffer(avctx, &s->picture)) < 0) {
av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
return ret;