mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2024-09-19 21:06:42 +00:00
avcodec/pngdec: Check that previous_picture has same w/h/format
Fixes: out of array access
Fixes: 15540/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5684905029140480
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 18c808ffbe
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
40c3eedd40
commit
f2d81316e8
@ -1248,6 +1248,9 @@ exit_loop:
|
||||
if (CONFIG_PNG_DECODER && avctx->codec_id != AV_CODEC_ID_APNG)
|
||||
handle_p_frame_png(s, p);
|
||||
else if (CONFIG_APNG_DECODER &&
|
||||
s->previous_picture.f->width == p->width &&
|
||||
s->previous_picture.f->height== p->height &&
|
||||
s->previous_picture.f->format== p->format &&
|
||||
avctx->codec_id == AV_CODEC_ID_APNG &&
|
||||
(ret = handle_p_frame_apng(avctx, s, p)) < 0)
|
||||
goto fail;
|
||||
|
Loading…
Reference in New Issue
Block a user