diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-02-04 12:24:14 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-02-06 10:17:13 +0100 |
| commit | 7e1d9d25fe0494403f438c4487d5e2ab4a2bbac0 (patch) | |
| tree | 95df7fd3f3794767f57396f6f29e4b30d5d3d89b /libavcodec/pngdec.c | |
| parent | d399f25bd1e62c6cb41f40b74ebdf65310e3f3ce (diff) | |
| download | ffmpeg-7e1d9d25fe0494403f438c4487d5e2ab4a2bbac0.tar.gz | |
avcodec/pngdec: Check trns more completely
Fixes out of array access
Fixes: 546/clusterfuzz-testcase-4809433909559296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e477f09d0b3619f3d29173b2cd593e17e2d1978e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/pngdec.c')
| -rw-r--r-- | libavcodec/pngdec.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index 7ade0cee66..bf8f27f64b 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -772,6 +772,16 @@ static int decode_trns_chunk(AVCodecContext *avctx, PNGDecContext *s, { int v, i; + if (!(s->state & PNG_IHDR)) { + av_log(avctx, AV_LOG_ERROR, "trns before IHDR\n"); + return AVERROR_INVALIDDATA; + } + + if (s->state & PNG_IDAT) { + av_log(avctx, AV_LOG_ERROR, "trns after IDAT\n"); + return AVERROR_INVALIDDATA; + } + if (s->color_type == PNG_COLOR_TYPE_PALETTE) { if (length > 256 || !(s->state & PNG_PLTE)) return AVERROR_INVALIDDATA; @@ -782,7 +792,8 @@ static int decode_trns_chunk(AVCodecContext *avctx, PNGDecContext *s, } } else if (s->color_type == PNG_COLOR_TYPE_GRAY || s->color_type == PNG_COLOR_TYPE_RGB) { if ((s->color_type == PNG_COLOR_TYPE_GRAY && length != 2) || - (s->color_type == PNG_COLOR_TYPE_RGB && length != 6)) + (s->color_type == PNG_COLOR_TYPE_RGB && length != 6) || + s->bit_depth == 1) return AVERROR_INVALIDDATA; for (i = 0; i < length / 2; i++) { @@ -1241,6 +1252,8 @@ exit_loop: size_t raw_bpp = s->bpp - byte_depth; unsigned x, y; + av_assert0(s->bit_depth > 1); + for (y = 0; y < s->height; ++y) { uint8_t *row = &s->image_buf[s->image_linesize * y]; |