diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-15 18:01:11 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-15 18:21:53 +0200 |
| commit | a63c813797fbdc32c530bf8930e11bf5a9a01d77 (patch) | |
| tree | 2d08431d3e9a9dec1e4b8437ff362c8ab2bf7ee0 | |
| parent | c7dc19d68f5de4ee150e601875d43dc80bd6c285 (diff) | |
| download | ffmpeg-a63c813797fbdc32c530bf8930e11bf5a9a01d77.tar.gz | |
pngdec: check bits_per_pixel for palette mode.
This fixes a out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/pngdec.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index a96d3cd5d4..5d0604eea9 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -494,7 +494,8 @@ static int decode_frame(AVCodecContext *avctx, } else if (s->bit_depth == 16 && s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) { avctx->pix_fmt = PIX_FMT_RGBA64BE; - } else if (s->color_type == PNG_COLOR_TYPE_PALETTE) { + } else if ((s->bits_per_pixel == 1 || s->bits_per_pixel == 2 || s->bits_per_pixel == 4 || s->bits_per_pixel == 8) && + s->color_type == PNG_COLOR_TYPE_PALETTE) { avctx->pix_fmt = PIX_FMT_PAL8; } else if (s->bit_depth == 1) { avctx->pix_fmt = PIX_FMT_MONOBLACK; |