On 2015-08-02 10:36:37 +0200, Luca Barbato wrote:
> Signed-off-by: Luca Barbato <[email protected]>
> ---
> libavcodec/pngdec.c | 20 +++++++++++++++++---
> 1 file changed, 17 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
> index 4ca919b..f4d124d 100644
> --- a/libavcodec/pngdec.c
> +++ b/libavcodec/pngdec.c
> @@ -18,6 +18,8 @@
> * License along with Libav; if not, write to the Free Software
> * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
> USA
> */
> +
> +#include "libavutil/avstring.h"
> #include "libavutil/imgutils.h"
> #include "avcodec.h"
> #include "bytestream.h"
> @@ -414,9 +416,21 @@ static int decode_frame(AVCodecContext *avctx,
> int ret;
>
> /* check signature */
> - if (buf_size < 8 ||
> - (memcmp(buf, ff_pngsig, 8) != 0 && memcmp(buf, ff_mngsig, 8) != 0)) {
> - av_log(avctx, AV_LOG_ERROR, "Invalid PNG signature (%d).\n",
> buf_size);
> + if (buf_size < 8) {
> + av_log(avctx, AV_LOG_ERROR, "Not enough data %d\n",
> + buf_size);
> + return AVERROR_INVALIDDATA;
> + }
> + if (memcmp(buf, ff_pngsig, 8) != 0 &&
> + memcmp(buf, ff_mngsig, 8) != 0) {
> + char signature[5 * 8] = { 0 };
no need to initialize the array, it's overwriten completely by by the
code below
> + int i;
> + for (i = 0; i < 8; i++) {
> + av_strlcatf(signature + i * 5, sizeof(signature) - i * 5,
> + " 0x%02x", buf[i]);
the buffer is not large enough for this, it misses one byte for the
terminating \0
Janne
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
