mirror of https://git.ffmpeg.org/ffmpeg.git
webp: fix infinite loop in webp_decode_frame
The loop always needs at least 8 bytes for chunk_type and chunk_size.
If fewer are left, bytestream2_get_le32 just returns 0 without
reading any bytes, leading to an infinite loop.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0762152f7a
)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
parent
f0af6e705f
commit
762a5878a6
|
@ -1387,7 +1387,7 @@ static int webp_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
|
|||
}
|
||||
|
||||
av_dict_free(&s->exif_metadata);
|
||||
while (bytestream2_get_bytes_left(&gb) > 0) {
|
||||
while (bytestream2_get_bytes_left(&gb) > 8) {
|
||||
char chunk_str[5] = { 0 };
|
||||
|
||||
chunk_type = bytestream2_get_le32(&gb);
|
||||
|
|
Loading…
Reference in New Issue