ffmpeg | branch: release/2.8 | Andreas Cadhalpun <andreas.cadhal...@googlemail.com> | Fri Nov 6 23:44:01 2015 +0100| [c0cd8747ef14dabb91261d910c34bc09c683773a] | committer: Michael Niedermayer
apng: use correct size for output buffer The buffer needs s->bpp bytes, at maximum currently 10. Assert that s->bpp is not larger. This fixes a stack buffer overflow. Reviewed-by: wm4 <nfx...@googlemail.com> Reviewed-by: Paul B Mahol <one...@gmail.com> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> (cherry picked from commit 3e8e1a660ea182111057d56ec1cfad2c62250f4c) Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c0cd8747ef14dabb91261d910c34bc09c683773a --- libavcodec/pngdec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index f0729a1..614c6a5 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -1012,7 +1012,7 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s, for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += s->bpp, background += s->bpp) { size_t b; uint8_t foreground_alpha, background_alpha, output_alpha; - uint8_t output[4]; + uint8_t output[10]; // Since we might be blending alpha onto alpha, we use the following equations: // output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha @@ -1052,6 +1052,8 @@ static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s, output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha); + av_assert0(s->bpp <= 10); + for (b = 0; b < s->bpp - 1; ++b) { if (output_alpha == 0) { output[b] = 0; _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
