From 801b5c18c7beefbb894ad4de20d1b591ddb22198 Mon Sep 17 00:00:00 2001 From: Andreas Cadhalpun Date: Fri, 25 Nov 2016 22:09:51 +0100 Subject: [PATCH] pngdec: check if previous frame exists instead of trusting sequence_number This fixes a segmentation fault caused by calling memcpy with NULL as second argument in handle_p_frame_apng. Reviewed-by: Michael Niedermayer Signed-off-by: Andreas Cadhalpun --- libavcodec/pngdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index 36275ae43f..2f8d266c27 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -922,7 +922,8 @@ static int decode_fctl_chunk(AVCodecContext *avctx, PNGDecContext *s, return AVERROR_INVALIDDATA; } - if (sequence_number == 0 && dispose_op == APNG_DISPOSE_OP_PREVIOUS) { + if ((sequence_number == 0 || !s->previous_picture.f->data[0]) && + dispose_op == APNG_DISPOSE_OP_PREVIOUS) { // No previous frame to revert to for the first frame // Spec says to just treat it as a APNG_DISPOSE_OP_BACKGROUND dispose_op = APNG_DISPOSE_OP_BACKGROUND;