diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-02-04 12:24:14 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-02-08 21:17:51 +0100 |
| commit | 3aa8440bafe3f793df116c035d6cd1ba4c404423 (patch) | |
| tree | 803c10335075dce9004ccbecaba2ac712924e631 /libavcodec | |
| parent | c9992efd84e1c0e15ea88cf11478dccbdd185660 (diff) | |
| download | ffmpeg-3aa8440bafe3f793df116c035d6cd1ba4c404423.tar.gz | |
avcodec/pngdec: Check trns more completely
Fixes out of array access
Fixes: 546/clusterfuzz-testcase-4809433909559296
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e477f09d0b3619f3d29173b2cd593e17e2d1978e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/pngdec.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index d58fca65f5..61c4ac8e0a 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -770,6 +770,16 @@ static int decode_trns_chunk(AVCodecContext *avctx, PNGDecContext *s, { int v, i; + if (!(s->state & PNG_IHDR)) { + av_log(avctx, AV_LOG_ERROR, "trns before IHDR\n"); + return AVERROR_INVALIDDATA; + } + + if (s->state & PNG_IDAT) { + av_log(avctx, AV_LOG_ERROR, "trns after IDAT\n"); + return AVERROR_INVALIDDATA; + } + if (s->color_type == PNG_COLOR_TYPE_PALETTE) { if (length > 256 || !(s->state & PNG_PLTE)) return AVERROR_INVALIDDATA; @@ -780,7 +790,8 @@ static int decode_trns_chunk(AVCodecContext *avctx, PNGDecContext *s, } } else if (s->color_type == PNG_COLOR_TYPE_GRAY || s->color_type == PNG_COLOR_TYPE_RGB) { if ((s->color_type == PNG_COLOR_TYPE_GRAY && length != 2) || - (s->color_type == PNG_COLOR_TYPE_RGB && length != 6)) + (s->color_type == PNG_COLOR_TYPE_RGB && length != 6) || + s->bit_depth == 1) return AVERROR_INVALIDDATA; for (i = 0; i < length / 2; i++) { @@ -1194,6 +1205,8 @@ exit_loop: size_t raw_bpp = s->bpp - byte_depth; unsigned x, y; + av_assert0(s->bit_depth > 1); + for (y = 0; y < s->height; ++y) { uint8_t *row = &s->image_buf[s->image_linesize * y]; |