diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2022-07-04 15:52:21 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2022-07-09 19:37:52 +0200 |
| commit | 3204572a1a5dc19e11356cdf39378a171189149b (patch) | |
| tree | 7a1a299e123389f083c036f2f23d15aaf972a9f5 | |
| parent | e4a10dd63783f80ed251e7bbf2550feff4c01306 (diff) | |
| download | ffmpeg-3204572a1a5dc19e11356cdf39378a171189149b.tar.gz | |
avformat/apngenc: Check for incomplete chunks
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
| -rw-r--r-- | libavformat/apngenc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/apngenc.c b/libavformat/apngenc.c index 88d4a41462..7443c77504 100644 --- a/libavformat/apngenc.c +++ b/libavformat/apngenc.c @@ -50,7 +50,7 @@ typedef struct APNGMuxContext { static uint8_t *apng_find_chunk(uint32_t tag, uint8_t *buf, size_t length) { size_t b; - for (b = 0; b < length; b += AV_RB32(buf + b) + 12) + for (b = 0; AV_RB32(buf + b) + 12ULL <= length - b; b += AV_RB32(buf + b) + 12ULL) if (AV_RB32(&buf[b + 4]) == tag) return &buf[b]; return NULL; |