diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-29 00:12:04 +0300 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-10-04 03:52:10 +0200 |
| commit | a63e83cd4b43c3dcef38f7fefe41c002a263af0f (patch) | |
| tree | 1f0f208faef1f00bcdcffcd0438aae195e39685b | |
| parent | c10f3fed259c23e6887f68cdf3e7d4ae87026f65 (diff) | |
| download | ffmpeg-a63e83cd4b43c3dcef38f7fefe41c002a263af0f.tar.gz | |
pngdec: Stop trying to decode once inflate returns Z_STREAM_END
If the input buffer contains more data after the deflate stream,
the loop previously left running infinitely, with inflate returning
Z_STREAM_END.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a81cad8f86d1feb7e4bfae29e43f3e994935a5c7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| -rw-r--r-- | libavcodec/pngdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index 9c340eacb4..6c2df12c7d 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -378,6 +378,10 @@ static int png_decode_idat(PNGDecContext *s, int length) s->zstream.avail_out = s->crow_size; s->zstream.next_out = s->crow_buf; } + if (ret == Z_STREAM_END && s->zstream.avail_in > 0) { + av_log(NULL, AV_LOG_WARNING, "%d undecompressed bytes left in buffer\n", s->zstream.avail_in); + return 0; + } } return 0; } |