diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-29 00:12:04 +0300 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2013-09-29 20:01:03 +0300 |
| commit | a81cad8f86d1feb7e4bfae29e43f3e994935a5c7 (patch) | |
| tree | 5f74ae94991586284076cb4185dfa0f04ed6eeab /libavcodec | |
| parent | c231987662194d009dd91bfc57c678e0e70ca161 (diff) | |
| download | ffmpeg-a81cad8f86d1feb7e4bfae29e43f3e994935a5c7.tar.gz | |
pngdec: Stop trying to decode once inflate returns Z_STREAM_END
If the input buffer contains more data after the deflate stream,
the loop previously left running infinitely, with inflate returning
Z_STREAM_END.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/pngdec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index ec44d56de8..8864e4a214 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -378,6 +378,10 @@ static int png_decode_idat(PNGDecContext *s, int length) s->zstream.avail_out = s->crow_size; s->zstream.next_out = s->crow_buf; } + if (ret == Z_STREAM_END && s->zstream.avail_in > 0) { + av_log(NULL, AV_LOG_WARNING, "%d undecompressed bytes left in buffer\n", s->zstream.avail_in); + return 0; + } } return 0; } |