diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2020-10-31 14:07:27 +0100 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2020-11-03 14:27:25 +0100 |
| commit | d9363b56a6b134e90fff8098cbd46a642f9cf99d (patch) | |
| tree | ed20eb5c1a269a9fbba3276b1a67e055154e5f8a | |
| parent | 9c341c6c92a0fc9c5bbecbd12e8bdd904678e4d5 (diff) | |
| download | ffmpeg-d9363b56a6b134e90fff8098cbd46a642f9cf99d.tar.gz | |
avformat/apngdec: Check fcTL chunk length when reading header
Reading the header terminates when an fcTL chunk is encountered in which
case read_header returned success without checking the length of said
chunk. Yet when read_packet processes this chunk, it checks for the
length to be 26 and errors out otherwise. So do so when reading the header,
too.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
| -rw-r--r-- | libavformat/apngdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c index d8d0de190f..6b2ce2e251 100644 --- a/libavformat/apngdec.c +++ b/libavformat/apngdec.c @@ -226,7 +226,7 @@ static int apng_read_header(AVFormatContext *s) ctx->num_frames, ctx->num_play); break; case MKTAG('f', 'c', 'T', 'L'): - if (!acTL_found) { + if (!acTL_found || len != 26) { ret = AVERROR_INVALIDDATA; goto fail; } |