avcodec/pngdec: check av_image_get_linesize return value
authorBenoit Fouet <benoit.fouet@free.fr>
Mon, 8 Dec 2014 02:16:46 +0000 (03:16 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 8 Dec 2014 03:58:00 +0000 (04:58 +0100)
Fixes CID 1257012

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/pngdec.c

index e6b7593..60acd3f 100644 (file)
@@ -872,6 +872,9 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s,
                                 s->previous_picture.f->data[0] : s->last_picture.f->data[0];
     int ls = FFMIN(av_image_get_linesize(p->format, s->width, 0), s->width * s->bpp);
 
+    if (ls < 0)
+        return ls;
+
     if (s->blend_op == APNG_BLEND_OP_OVER &&
         avctx->pix_fmt != AV_PIX_FMT_RGBA && avctx->pix_fmt != AV_PIX_FMT_ARGB) {
         avpriv_request_sample(avctx, "Blending with pixel format %s",