diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-29 00:12:04 +0300 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2014-01-07 09:43:57 +0100 |
| commit | ac1e61d5593d987876e2947b42a7aa37a4efcd4e (patch) | |
| tree | 827780837bca9953605d6f9631b49545eecd1c7c | |
| parent | 1438181a2943be1aa37ec955cae4905514cf317c (diff) | |
| download | ffmpeg-ac1e61d5593d987876e2947b42a7aa37a4efcd4e.tar.gz | |
pngdec: Stop trying to decode once inflate returns Z_STREAM_END
If the input buffer contains more data after the deflate stream,
the loop previously left running infinitely, with inflate returning
Z_STREAM_END.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a81cad8f86d1feb7e4bfae29e43f3e994935a5c7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit a63e83cd4b43c3dcef38f7fefe41c002a263af0f)
| -rw-r--r-- | libavcodec/pngdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index ac98f7093d..22f154ebbc 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -377,6 +377,10 @@ static int png_decode_idat(PNGDecContext *s, int length) s->zstream.avail_out = s->crow_size; s->zstream.next_out = s->crow_buf; } + if (ret == Z_STREAM_END && s->zstream.avail_in > 0) { + av_log(NULL, AV_LOG_WARNING, "%d undecompressed bytes left in buffer\n", s->zstream.avail_in); + return 0; + } } return 0; } |