aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-01-24 04:17:58 +0100
committerMichael Niedermayer <michaelni@gmx.at>2013-05-13 00:58:49 +0200
commit91138821fb675883e69f123a5ad86ca8470fb537 (patch)
tree72606c05bbae7378e94dd8d57fee9cd1d9f39aaf
parenta4681d1043556718fb20c9026f8d1cec4e7f453f (diff)
downloadffmpeg-91138821fb675883e69f123a5ad86ca8470fb537.tar.gz
gifdec: check that the last keyframe exists and has been successfully parsed.
Prevents inconsistent state and null pointer dereference Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 46cb61819d867961e8f2052a8f13bcf2027d484f) Conflicts: libavcodec/gifdec.c Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavcodec/gifdec.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/gifdec.c b/libavcodec/gifdec.c
index 9be5bec003..41d3d5b9dd 100644
--- a/libavcodec/gifdec.c
+++ b/libavcodec/gifdec.c
@@ -75,6 +75,7 @@ typedef struct GifState {
AVCodecContext *avctx;
int keyframe;
+ int keyframe_ok;
int trans_color; /**< color value that is used instead of transparent color */
} GifState;
@@ -471,6 +472,7 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
}
if (s->keyframe) {
+ s->keyframe_ok = 0;
s->gce_prev_disposal = GCE_DISPOSAL_NONE;
if ((ret = gif_read_header1(s)) < 0)
return ret;
@@ -489,7 +491,13 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
s->picture.pict_type = AV_PICTURE_TYPE_I;
s->picture.key_frame = 1;
+ s->keyframe_ok = 1;
} else {
+ if (!s->keyframe_ok) {
+ av_log(avctx, AV_LOG_ERROR, "cannot decode frame without keyframe\n");
+ return AVERROR_INVALIDDATA;
+ }
+
if ((ret = avctx->reget_buffer(avctx, &s->picture)) < 0) {
av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
return ret;