RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

pngdec: validate length. 

Fixes out of array reading.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-03-04 06:25:06 +01:00
parent 337fa0dbe7
commit 39a3a53b66
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/pngdec.c
View File

@ -427,7 +427,7 @@ static int decode_frame(AVCodecContext *avctx,
if (s->bytestream >= s->bytestream_end)
goto fail;
length = bytestream_get_be32(&s->bytestream);
if (length > 0x7fffffff)
if (length > 0x7fffffff || length > s->bytestream_end - s->bytestream)
goto fail;
tag32 = bytestream_get_be32(&s->bytestream);
tag = av_bswap32(tag32);