[FFmpeg-cvslog] png: check bit depth for PAL8/Y400A pixel formats.

[Ronald S. Bultje]

ffmpeg | branch: master | Ronald S. Bultje <rsbultje at gmail.com> | Wed May  2 10:58:55 2012 -0700| [d2205d6543881f2e6fa18c8a354bbcf91a1235f7] | committer: Ronald S. Bultje

png: check bit depth for PAL8/Y400A pixel formats.

Wrong bit depth can lead to invalid rowsize values, which crashes the
decoder further down.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d2205d6543881f2e6fa18c8a354bbcf91a1235f7
---

 libavcodec/pngdec.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index 087abae..871f2b2 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -479,9 +479,11 @@ static int decode_frame(AVCodecContext *avctx,
                 } else if (s->bit_depth == 1 &&
                            s->color_type == PNG_COLOR_TYPE_GRAY) {
                     avctx->pix_fmt = PIX_FMT_MONOBLACK;
-                } else if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
+                } else if (s->bit_depth == 8 &&
+                           s->color_type == PNG_COLOR_TYPE_PALETTE) {
                     avctx->pix_fmt = PIX_FMT_PAL8;
-                } else if (s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
+                } else if (s->bit_depth == 8 &&
+                           s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) {
                     avctx->pix_fmt = PIX_FMT_Y400A;
                 } else {
                     goto fail;