diff mbox series

[FFmpeg-devel,3/5] avformat/apngenc: Check fcTL size

Message ID DB6PR0101MB2214A41BD271E6AFE30C5E2E8FBE9@DB6PR0101MB2214.eurprd01.prod.exchangelabs.com
State Accepted
Commit f89446eaff0537bbf6e390584d32375c6b65ea2f
Headers show
Series [FFmpeg-devel,1/5] avcodec/apng: Add APNG_FCTL_CHUNK_SIZE define | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Andreas Rheinhardt July 4, 2022, 3:25 p.m. UTC 
The remaining code relies on it having the value it should have.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavformat/apngenc.c | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox series

Patch

diff --git a/libavformat/apngenc.c b/libavformat/apngenc.c
index 7443c77504..1c039685f2 100644
--- a/libavformat/apngenc.c
+++ b/libavformat/apngenc.c
@@ -27,6 +27,7 @@ 
 #include "libavutil/intreadwrite.h"
 #include "libavutil/log.h"
 #include "libavutil/opt.h"
+#include "libavcodec/apng.h"
 #include "libavcodec/png.h"
 
 typedef struct APNGMuxContext {
@@ -181,6 +182,9 @@  static int flush_packet(AVFormatContext *format_context, AVPacket *packet)
         if (existing_fcTL_chunk) {
             AVRational delay;
 
+            if (AV_RB32(existing_fcTL_chunk) != APNG_FCTL_CHUNK_SIZE)
+                return AVERROR_INVALIDDATA;
+
             existing_fcTL_chunk += 8;
             delay.num = AV_RB16(existing_fcTL_chunk + 20);
             delay.den = AV_RB16(existing_fcTL_chunk + 22);