diff options
| author | Anton Khirnov <anton@khirnov.net> | 2021-04-02 16:00:23 +0200 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2021-04-08 14:15:30 +0200 |
| commit | c64180fac8442d4b0f1ed9cb07265361c193400e (patch) | |
| tree | 15b840b4b47392c37be8ffc805ced57b6da13caf /libavcodec | |
| parent | 8ee432dc2365f11908c6535be7e076d9d298a9ad (diff) | |
| download | ffmpeg-c64180fac8442d4b0f1ed9cb07265361c193400e.tar.gz | |
lavc/pngdec: improve chunk length check
The length does not cover the chunk type or CRC.
(cherry picked from commit ae08eec6a1f2129cd231a0ab664f0f17b854d138)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/pngdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index f3295688c6..0ff81d740c 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -1217,7 +1217,7 @@ static int decode_frame_common(AVCodecContext *avctx, PNGDecContext *s, } length = bytestream2_get_be32(&s->gb); - if (length > 0x7fffffff || length > bytestream2_get_bytes_left(&s->gb)) { + if (length > 0x7fffffff || length + 8 > bytestream2_get_bytes_left(&s->gb)) { av_log(avctx, AV_LOG_ERROR, "chunk too big\n"); ret = AVERROR_INVALIDDATA; goto fail; |