On 02/08/15 11:36, Janne Grunau wrote:
> On 2015-08-02 10:36:37 +0200, Luca Barbato wrote:
>> Signed-off-by: Luca Barbato <[email protected]>
>> ---
>> libavcodec/pngdec.c | 20 +++++++++++++++++---
>> 1 file changed, 17 insertions(+), 3 deletions(-)
>>
>> diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
>> index 4ca919b..f4d124d 100644
>> --- a/libavcodec/pngdec.c
>> +++ b/libavcodec/pngdec.c
>> @@ -18,6 +18,8 @@
>> * License along with Libav; if not, write to the Free Software
>> * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
>> USA
>> */
>> +
>> +#include "libavutil/avstring.h"
>> #include "libavutil/imgutils.h"
>> #include "avcodec.h"
>> #include "bytestream.h"
>> @@ -414,9 +416,21 @@ static int decode_frame(AVCodecContext *avctx,
>> int ret;
>>
>> /* check signature */
>> - if (buf_size < 8 ||
>> - (memcmp(buf, ff_pngsig, 8) != 0 && memcmp(buf, ff_mngsig, 8) != 0))
>> {
>> - av_log(avctx, AV_LOG_ERROR, "Invalid PNG signature (%d).\n",
>> buf_size);
>> + if (buf_size < 8) {
>> + av_log(avctx, AV_LOG_ERROR, "Not enough data %d\n",
>> + buf_size);
>> + return AVERROR_INVALIDDATA;
>> + }
>> + if (memcmp(buf, ff_pngsig, 8) != 0 &&
>> + memcmp(buf, ff_mngsig, 8) != 0) {
>> + char signature[5 * 8] = { 0 };
>
> no need to initialize the array, it's overwriten completely by by the
> code below
I need to initialize at least the first and the last byte of it =)
>> + int i;
>> + for (i = 0; i < 8; i++) {
>> + av_strlcatf(signature + i * 5, sizeof(signature) - i * 5,
>> + " 0x%02x", buf[i]);
>
> the buffer is not large enough for this, it misses one byte for the
> terminating \0
Right, thanks for spotting!
lu
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
