[FFmpeg-cvslog] avcodec/pngdec: Check compression method
Michael Niedermayer
git at videolan.org
Thu Mar 28 18:32:31 EET 2019
ffmpeg | branch: release/3.4 | Michael Niedermayer <michael at niedermayer.cc> | Fri Nov 9 03:12:45 2018 +0100| [5e1133920f52f9baa05134702e10b1d02c5a5a8b] | committer: Michael Niedermayer
avcodec/pngdec: Check compression method
method 0 (inflate/deflate) is the only specified in the specification and the only supported
Fixes: Timeout
Fixes: 10976/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PNG_fuzzer-5729372588736512
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 1f99674ddddcc33f4c37def0a206e31ad7c4c1af)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5e1133920f52f9baa05134702e10b1d02c5a5a8b
---
libavcodec/pngdec.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index 0d6612ccca..0a2772f763 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -577,6 +577,10 @@ static int decode_ihdr_chunk(AVCodecContext *avctx, PNGDecContext *s,
}
s->color_type = bytestream2_get_byte(&s->gb);
s->compression_type = bytestream2_get_byte(&s->gb);
+ if (s->compression_type) {
+ av_log(avctx, AV_LOG_ERROR, "Invalid compression method %d\n", s->compression_type);
+ goto error;
+ }
s->filter_type = bytestream2_get_byte(&s->gb);
s->interlace_type = bytestream2_get_byte(&s->gb);
bytestream2_skip(&s->gb, 4); /* crc */
More information about the ffmpeg-cvslog
mailing list