virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-08 13:22:53 +02:00
Code Issues Releases Activity

apng: use correct size for output buffer

Browse Source 
The buffer needs s->bpp bytes, at maximum currently 10.
Assert that s->bpp is not larger.

This fixes a stack buffer overflow.

Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 3e8e1a660e)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Andreas Cadhalpun 2015-11-06 23:44:01 +01:00 committed by Michael Niedermayer
parent cd8bedb9fa
commit 132bd4bc4f
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/pngdec.c
View File

@ -946,7 +946,7 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += s->bpp, background += s->bpp) { for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += s->bpp, background += s->bpp) {
size_t b; size_t b;
uint8_t foreground_alpha, background_alpha, output_alpha; uint8_t foreground_alpha, background_alpha, output_alpha;
uint8_t output[4]; uint8_t output[10];
// Since we might be blending alpha onto alpha, we use the following equations: // Since we might be blending alpha onto alpha, we use the following equations:
// output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha // output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha
@ -986,6 +986,8 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha); output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha);
av_assert0(s->bpp <= 10);
for (b = 0; b < s->bpp - 1; ++b) { for (b = 0; b < s->bpp - 1; ++b) {
if (output_alpha == 0) { if (output_alpha == 0) {
output[b] = 0; output[b] = 0;