avformat/apngdec: validate frame dimensions.
authorBenoit Fouet <benoit.fouet@free.fr>
Wed, 26 Nov 2014 09:12:18 +0000 (10:12 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 26 Nov 2014 22:51:07 +0000 (23:51 +0100)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/apngdec.c

index 8aa70a0..276d765 100644 (file)
@@ -301,7 +301,11 @@ static int decode_fctl_chunk(AVFormatContext *s, APNGDemuxContext *ctx, AVPacket
         height != s->streams[0]->codec->height ||
         x_offset != 0 ||
         y_offset != 0) {
-        if (sequence_number == 0)
+        if (sequence_number == 0 ||
+            x_offset >= s->streams[0]->codec->width ||
+            width > s->streams[0]->codec->width - x_offset ||
+            y_offset >= s->streams[0]->codec->height ||
+            height > s->streams[0]->codec->height - y_offset)
             return AVERROR_INVALIDDATA;
         ctx->is_key_frame = 0;
     } else {