diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-02-19 19:12:25 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-20 03:41:32 +0200 |
| commit | 00a81ed120e3f95a6fee23b324ac432ca1740fe9 (patch) | |
| tree | 21f242fb35e46872869b1b308f33cf059f1b9e48 /libavcodec | |
| parent | 367222af32d67f6550d391234b70c36f1f49abcb (diff) | |
| download | ffmpeg-00a81ed120e3f95a6fee23b324ac432ca1740fe9.tar.gz | |
avcodec/pngdec: Check bit depth for validity
Fixes: runtime error: shift exponent 132 is too large for 32-bit type 'int'
Fixes: 609/clusterfuzz-testcase-4825202619842560
See 11.2.2 IHDR Image header
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4279613a2652cdf2bee564f4b7244567e5ba91ba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/pngdec.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index 61c4ac8e0a..bb51b34a6a 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -557,6 +557,11 @@ static int decode_ihdr_chunk(AVCodecContext *avctx, PNGDecContext *s, return AVERROR_INVALIDDATA; } s->bit_depth = bytestream2_get_byte(&s->gb); + if (s->bit_depth != 1 && s->bit_depth != 2 && s->bit_depth != 4 && + s->bit_depth != 8 && s->bit_depth != 16) { + av_log(avctx, AV_LOG_ERROR, "Invalid bit depth\n"); + goto error; + } s->color_type = bytestream2_get_byte(&s->gb); s->compression_type = bytestream2_get_byte(&s->gb); s->filter_type = bytestream2_get_byte(&s->gb); @@ -570,6 +575,10 @@ static int decode_ihdr_chunk(AVCodecContext *avctx, PNGDecContext *s, s->compression_type, s->filter_type, s->interlace_type); return 0; +error: + s->cur_w = s->cur_h = s->width = s->height = 0; + s->bit_depth = 8; + return AVERROR_INVALIDDATA; } static int decode_phys_chunk(AVCodecContext *avctx, PNGDecContext *s) |