mirror of
https://git.videolan.org/git/ffmpeg.git
synced 2024-09-01 22:16:42 +02:00
avcodec/pngdec: Check IHDR/IDAT order
Fixes out of array access Fixes: asan_heap-oob_20a6c26_2690_cov_3434532168_mail.png Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
8b8cb30d11
commit
79ceaf827b
@ -524,6 +524,12 @@ static int decode_ihdr_chunk(AVCodecContext *avctx, PNGDecContext *s,
|
||||
{
|
||||
if (length != 13)
|
||||
return AVERROR_INVALIDDATA;
|
||||
|
||||
if (s->state & PNG_IDAT) {
|
||||
av_log(avctx, AV_LOG_ERROR, "IHDR after IDAT\n");
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
|
||||
s->width = bytestream2_get_be32(&s->gb);
|
||||
s->height = bytestream2_get_be32(&s->gb);
|
||||
if (av_image_check_size(s->width, s->height, 0, avctx)) {
|
||||
|
Loading…
Reference in New Issue
Block a user