[FFmpeg-cvslog] gifdec: check that the last keyframe exists and has been successfully parsed.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Jan 24 04:17:58 2013 +0100| [46cb61819d867961e8f2052a8f13bcf2027d484f] | committer: Michael Niedermayer

gifdec: check that the last keyframe exists and has been successfully parsed.

Prevents inconsistent state and null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=46cb61819d867961e8f2052a8f13bcf2027d484f
---

 libavcodec/gifdec.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/gifdec.c b/libavcodec/gifdec.c
index b0254de..51e8422 100644
--- a/libavcodec/gifdec.c
+++ b/libavcodec/gifdec.c
@@ -75,6 +75,7 @@ typedef struct GifState {
 
     AVCodecContext *avctx;
     int keyframe;
+    int keyframe_ok;
     int trans_color;    /**< color value that is used instead of transparent color */
 } GifState;
 
@@ -472,6 +473,7 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
     }
 
     if (s->keyframe) {
+        s->keyframe_ok = 0;
         if ((ret = gif_read_header1(s)) < 0)
             return ret;
 
@@ -489,7 +491,13 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
 
         s->picture.pict_type = AV_PICTURE_TYPE_I;
         s->picture.key_frame = 1;
+        s->keyframe_ok = 1;
     } else {
+        if (!s->keyframe_ok) {
+            av_log(avctx, AV_LOG_ERROR, "cannot decode frame without keyframe\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         if ((ret = avctx->reget_buffer(avctx, &s->picture)) < 0) {
             av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
             return ret;