diff options
| author | Anton Khirnov <anton@khirnov.net> | 2021-04-02 16:00:23 +0200 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2021-04-08 11:03:15 +0200 |
| commit | ae08eec6a1f2129cd231a0ab664f0f17b854d138 (patch) | |
| tree | 4ebd74fc3f5eb87a9ec40af207197184d1555e62 /libavcodec | |
| parent | 8e4390de48b22cf6dd2307f0c29a3fef7016ef4c (diff) | |
| download | ffmpeg-ae08eec6a1f2129cd231a0ab664f0f17b854d138.tar.gz | |
lavc/pngdec: improve chunk length check
The length does not cover the chunk type or CRC.
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/pngdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index f3295688c6..0ff81d740c 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -1217,7 +1217,7 @@ static int decode_frame_common(AVCodecContext *avctx, PNGDecContext *s, } length = bytestream2_get_be32(&s->gb); - if (length > 0x7fffffff || length > bytestream2_get_bytes_left(&s->gb)) { + if (length > 0x7fffffff || length + 8 > bytestream2_get_bytes_left(&s->gb)) { av_log(avctx, AV_LOG_ERROR, "chunk too big\n"); ret = AVERROR_INVALIDDATA; goto fail; |