diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-05-02 10:58:55 -0700 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-06-03 19:04:51 +0200 |
| commit | d34e9e61dd619a14e3d29760f6bc8cd5b1a19d9f (patch) | |
| tree | 9e83e0872c9c94c430158efcc60b33dc6a7e5563 | |
| parent | c38d3e1a39b28937692a2c0eb39b25d8bc07d7bb (diff) | |
| download | ffmpeg-d34e9e61dd619a14e3d29760f6bc8cd5b1a19d9f.tar.gz | |
png: check bit depth for PAL8/Y400A pixel formats.
Wrong bit depth can lead to invalid rowsize values, which crashes the
decoder further down.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d2205d6543881f2e6fa18c8a354bbcf91a1235f7)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/pngdec.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index 94eb6ebeed..ac98f7093d 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -479,9 +479,11 @@ static int decode_frame(AVCodecContext *avctx, } else if (s->bit_depth == 1 && s->color_type == PNG_COLOR_TYPE_GRAY) { avctx->pix_fmt = PIX_FMT_MONOBLACK; - } else if (s->color_type == PNG_COLOR_TYPE_PALETTE) { + } else if (s->bit_depth == 8 && + s->color_type == PNG_COLOR_TYPE_PALETTE) { avctx->pix_fmt = PIX_FMT_PAL8; - } else if (s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) { + } else if (s->bit_depth == 8 && + s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) { avctx->pix_fmt = PIX_FMT_Y400A; } else { goto fail; |