diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-11-06 23:44:01 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-12 02:55:47 +0100 |
| commit | 132bd4bc4fb4a3d6c4cf0504f0f42699d5c20e7c (patch) | |
| tree | e751251f1c584dad6930119850bb9c0f1a966463 /libavcodec | |
| parent | cd8bedb9fa7c3d04288bf57b64081b4a89aefb4d (diff) | |
| download | ffmpeg-132bd4bc4fb4a3d6c4cf0504f0f42699d5c20e7c.tar.gz | |
apng: use correct size for output buffer
The buffer needs s->bpp bytes, at maximum currently 10.
Assert that s->bpp is not larger.
This fixes a stack buffer overflow.
Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 3e8e1a660ea182111057d56ec1cfad2c62250f4c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/pngdec.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index 60c49758f1..ffb0d7b737 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -946,7 +946,7 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s, for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += s->bpp, background += s->bpp) { size_t b; uint8_t foreground_alpha, background_alpha, output_alpha; - uint8_t output[4]; + uint8_t output[10]; // Since we might be blending alpha onto alpha, we use the following equations: // output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha @@ -986,6 +986,8 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s, output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha); + av_assert0(s->bpp <= 10); + for (b = 0; b < s->bpp - 1; ++b) { if (output_alpha == 0) { output[b] = 0; |