diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-17 02:32:19 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-17 02:33:19 +0100 |
| commit | 745c40a47f885e57ad97a775bbaa5c9973430276 (patch) | |
| tree | 0dcf1be98bef0d9ccb4304316829d7951018a09f | |
| parent | 5fe415f0f415bb4f654851032185dff88ba943aa (diff) | |
| download | ffmpeg-745c40a47f885e57ad97a775bbaa5c9973430276.tar.gz | |
avcodec/gifdec: check that the correct number of bytes was decoded
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f084c646637_9261_top_title_green_frog.gif
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/gifdec.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavcodec/gifdec.c b/libavcodec/gifdec.c index c7b9ac8726..78c8900628 100644 --- a/libavcodec/gifdec.c +++ b/libavcodec/gifdec.c @@ -237,8 +237,12 @@ static int gif_read_image(GifState *s, AVFrame *frame) pass = 0; y1 = 0; for (y = 0; y < height; y++) { - if (ff_lzw_decode(s->lzw, s->idx_line, width) == 0) + int count = ff_lzw_decode(s->lzw, s->idx_line, width); + if (count != width) { + if (count) + av_log(s->avctx, AV_LOG_ERROR, "LZW decode failed\n"); goto decode_tail; + } pr = ptr + width; |