avcodec/pngdec: Do not pass AVFrame into global header decode
The global header should not contain a frame, and decoding it
would result in leaks
Fixes: memleak
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-6603443149340672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d31d4f3228
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
@ -618,6 +618,8 @@ static int decode_idat_chunk(AVCodecContext *avctx, PNGDecContext *s,
|
|||||||
int ret;
|
int ret;
|
||||||
size_t byte_depth = s->bit_depth > 8 ? 2 : 1;
|
size_t byte_depth = s->bit_depth > 8 ? 2 : 1;
|
||||||
|
|
||||||
|
if (!p)
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
if (!(s->hdr_state & PNG_IHDR)) {
|
if (!(s->hdr_state & PNG_IHDR)) {
|
||||||
av_log(avctx, AV_LOG_ERROR, "IDAT without IHDR\n");
|
av_log(avctx, AV_LOG_ERROR, "IDAT without IHDR\n");
|
||||||
return AVERROR_INVALIDDATA;
|
return AVERROR_INVALIDDATA;
|
||||||
@ -1226,6 +1228,10 @@ skip_tag:
|
|||||||
}
|
}
|
||||||
exit_loop:
|
exit_loop:
|
||||||
|
|
||||||
|
if (!p)
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
|
||||||
|
|
||||||
if (s->bits_per_pixel <= 4)
|
if (s->bits_per_pixel <= 4)
|
||||||
handle_small_bpp(s, p);
|
handle_small_bpp(s, p);
|
||||||
|
|
||||||
@ -1362,7 +1368,7 @@ static int decode_frame_apng(AVCodecContext *avctx,
|
|||||||
s->zstream.zfree = ff_png_zfree;
|
s->zstream.zfree = ff_png_zfree;
|
||||||
|
|
||||||
bytestream2_init(&s->gb, avctx->extradata, avctx->extradata_size);
|
bytestream2_init(&s->gb, avctx->extradata, avctx->extradata_size);
|
||||||
if ((ret = decode_frame_common(avctx, s, p, avpkt)) < 0)
|
if ((ret = decode_frame_common(avctx, s, NULL, avpkt)) < 0)
|
||||||
goto end;
|
goto end;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Reference in New Issue
Block a user