diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-11-26 17:00:17 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-11-26 17:01:26 +0100 |
| commit | 9a53707e86eb066e1c77460215c716f7962c71e7 (patch) | |
| tree | 62652073a76ec92e4a10396ac241f20bcae10e44 | |
| parent | 79ceaf827be0b070675d4cd0a55c3386542defd8 (diff) | |
| download | ffmpeg-9a53707e86eb066e1c77460215c716f7962c71e7.tar.gz | |
avcodec/pngdec: Fix paeth prediction with small images
Fixes out of array read
Fixes: asan_heap-oob_20b0a06_1962_cov_1907976991_delete_node_small.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/pngdec.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index f80a3fe9d7..35dcd76feb 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -267,8 +267,10 @@ static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type, /* would write off the end of the array if we let it process * the last pixel with bpp=3 */ int w = bpp == 4 ? size : size - 3; - dsp->add_paeth_prediction(dst + i, src + i, last + i, w - i, bpp); - i = w; + if (w > i) { + dsp->add_paeth_prediction(dst + i, src + i, last + i, w - i, bpp); + i = w; + } } ff_add_png_paeth_prediction(dst + i, src + i, last + i, size - i, bpp); break; |