From patchwork Sun Jan 12 21:56:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 17309 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id ED7AB44B0B6 for ; Mon, 13 Jan 2020 00:02:21 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id C92CE68B0A3; Mon, 13 Jan 2020 00:02:21 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm1-f67.google.com (mail-wm1-f67.google.com [209.85.128.67]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E6A6A6882C0 for ; Mon, 13 Jan 2020 00:02:15 +0200 (EET) Received: by mail-wm1-f67.google.com with SMTP id t14so7585653wmi.5 for ; Sun, 12 Jan 2020 14:02:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=8rNC39EcmUn5P0AzdBmJUNrjLrZ/hLxyfoi9yEiQrlo=; b=CfI8XFSIJg1lU7vxEQ7FqZiSHXk0y9Xxs8YbCut2OD8fZwPLujcevcQs3tS/TBpK1U YZro7Y6qoQWe8MV/CsQvXwOrsDlgeAcOtqvyZ0J9eXuKtdVJ8qVyNwSbMrQ5efykEGYG rd+yZiNgpBmLVjC+jkVhYso9uwQPIBOkzaYeBt/nKYzRxDOnF4DnJxS3uR4AbiKvV7if FawzrdLrZ7n/3v2za3nAQzxhZDmFSftvEpn0PAolk4CN7qgFHXUFTQqj1QxCvjy8lViW FHDfs+o9VjOs4GAebAEMUWlUHfb0r9qLs2j4yVgMBu8BSPWCKjhzwlsKauJqzvKIqHAb wRiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=8rNC39EcmUn5P0AzdBmJUNrjLrZ/hLxyfoi9yEiQrlo=; b=Ey134QXDa7YLSNJN6MNKR6Mv1D9eYHqaALAAguntAkpzT7wsX2o7D4LcSquyDZXvSQ LegFsgZkEdpew2UMgwrlb1n/cd7oUtJhix7kB5EtyvygT8W/n/eysRCCz3PwwWX1Q/WC TinI5M84S5Iik2yRZiAfMM11g2hbRoQ8N+DUJOo0a8wbG6LJnkjTJQQzEUgHwoGZLfr/ HNrn7y4A8DEaPi+K09uFzD70sLpgsYcHLtSbBldp4ipSRbG/8bVvsDj9vmd9sAyJGisa ywb5YBhRx1mk1gMmBszmjS+TmiNZMOnkFsg0+Xw2RrJAK5viWXfQdRX7pczUz8VvBOFQ MzCA== X-Gm-Message-State: APjAAAV0ZXzLTSVmwHDJ4KxcLoe0ZDEePAr7igS8/fFJg/r3O9LR0I5k VueoNRpizss2BqGI/sawMs6LRP5W X-Google-Smtp-Source: APXvYqx2wWq51UUXGRqf6mGoXzKgG8efXVSZV61OJRrgxUn9WPrkqyvo30CTgl6ldURx0rAKGYtCsg== X-Received: by 2002:a7b:cbc9:: with SMTP id n9mr16460174wmi.89.1578866218623; Sun, 12 Jan 2020 13:56:58 -0800 (PST) Received: from sblaptop.fritz.box (ipbcc08bbf.dynamic.kabel-deutschland.de. [188.192.139.191]) by smtp.gmail.com with ESMTPSA id c4sm11763741wml.7.2020.01.12.13.56.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jan 2020 13:56:58 -0800 (PST) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Sun, 12 Jan 2020 22:56:49 +0100 Message-Id: <20200112215651.1258-1-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH v2 1/3] avformat/apngdec: Return error for incomplete header X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" If avio_read() could read anything, it returns the number of bytes read, even if it could not read as much as the caller desired. apng_read_header() only checked the return value of its avio_read() calls for being negative and this meant that it was possible for an incomplete header to not be detected. The return value of the last successfull call has been returned instead. This commit changes this. Signed-off-by: Andreas Rheinhardt --- Now returning AVERROR_INVALIDDATA for truncated data. I wonder whether a function that automatically returns an error when the desired amount of data couldn't be read (instead of returning the amount it read) would be worth it. (Such a function should have a parameter indicating whether the current position can be a legitimate position for EOF (so that AVERROR_EOF is returned when nothing could be read due to EOF) or not (where AVERROR_INVALIDDATA should be returned in such a case).) libavformat/apngdec.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c index 0f1d04a365..36657877d2 100644 --- a/libavformat/apngdec.c +++ b/libavformat/apngdec.c @@ -138,8 +138,8 @@ static int append_extradata(AVCodecParameters *par, AVIOContext *pb, int len) par->extradata = new_extradata; par->extradata_size = new_size; - if ((ret = avio_read(pb, par->extradata + previous_size, len)) < 0) - return ret; + if ((ret = avio_read(pb, par->extradata + previous_size, len)) != len) + return (ret < 0 && ret != AVERROR_EOF) ? ret : AVERROR_INVALIDDATA; return previous_size; } @@ -185,10 +185,10 @@ static int apng_read_header(AVFormatContext *s) AV_WL32(st->codecpar->extradata+4, tag); AV_WB32(st->codecpar->extradata+8, st->codecpar->width); AV_WB32(st->codecpar->extradata+12, st->codecpar->height); - if ((ret = avio_read(pb, st->codecpar->extradata+16, 9)) < 0) - goto fail; + if ((ret = avio_read(pb, st->codecpar->extradata + 16, 9)) != 9) + return (ret < 0 && ret != AVERROR_EOF) ? ret : AVERROR_INVALIDDATA; - while (!avio_feof(pb)) { + while (1) { if (acTL_found && ctx->num_play != 1) { int64_t size = avio_size(pb); int64_t offset = avio_tell(pb); From patchwork Sun Jan 12 21:56:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 17310 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 0F20444B190 for ; Mon, 13 Jan 2020 00:03:18 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id DEDF568B0AA; Mon, 13 Jan 2020 00:03:17 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm1-f68.google.com (mail-wm1-f68.google.com [209.85.128.68]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 6EC6A68B0A3 for ; Mon, 13 Jan 2020 00:03:12 +0200 (EET) Received: by mail-wm1-f68.google.com with SMTP id t14so7586988wmi.5 for ; Sun, 12 Jan 2020 14:03:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=sPdE3FQBVIrv/2XecmbVEDOq8s/NXV/u0JMJDUGVVQI=; b=tNCaoicat46w3cET8PgMNnLNdc6H0rHZhJbtujux19PQUal37bqZtVLjwvRQqj7eFS wk1S/3SxWu9VzqliZTsgnPnOwDfmDCER7r5MmEYh3oLdkuS+FQo56twzWm/+rd1qNrFM K+oLwWK8qRnGi7OKWzv/1B0KrGzUiJht2TlzyclhW6lSF4gyGjQpJMZQoO6Il+hHRHos XsF+PYey/C6TmEKpyDqINVJE4jikJsSPFvK4VyE8h3uqLa1lz8KpuYwCisVu1lWdTjYs k1gkZlra5VtNJra6jRSH7x6XevG3lDpMWo5x6EGPxbDt8qfaj0BNYDQfbV/b6Roy9zoU oOYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=sPdE3FQBVIrv/2XecmbVEDOq8s/NXV/u0JMJDUGVVQI=; b=ZCsNiUoyhPOCT2p2mqgZ6IUHGiOI2UW6a21e5aBw5cGdcetlHuQGCeCsCr+4d6q6Lw KibryBMFnD0Fm5H8FRZNRn11DXMaXywtKGo1nKs0VcmuPZn670eBX+jG1I5EQ3DKrzAb 597q6XTb1RTNKwbm9PSKdalJ7RYRO9JHyNCfGy5a4VxDOoMAwnN1j6pXGIyIfbrwHUv+ 8CiExbLdq/MUrVpmJLbguqGUKEmIMUysHlOGLzJ92ov9/X0tum0jICSCjxrA3eQ+dBjG ScSDDBH76LNhFW5omjmHXT9KJU3EJvWM2PIikmL5KZ5wk7SXKqZjKRaEd3vBvoemqWQK e4SQ== X-Gm-Message-State: APjAAAXdUBjH707ahHChB1VtoM56aYrpF28XRj+Mt5mwO/D3dAucMiGo r2+33yNP7Ie5DYcBNW4l+y0Rj7Gm X-Google-Smtp-Source: APXvYqzs7x1ZbjBoc0uypiZn91PKX3zYa0dpM/IAUm8h401bvdCgJSE/TutcgwUvvdNrfua4n66Z3w== X-Received: by 2002:a7b:cb0a:: with SMTP id u10mr16010656wmj.165.1578866591715; Sun, 12 Jan 2020 14:03:11 -0800 (PST) Received: from sblaptop.fritz.box (ipbcc08bbf.dynamic.kabel-deutschland.de. [188.192.139.191]) by smtp.gmail.com with ESMTPSA id c4sm11763741wml.7.2020.01.12.14.03.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jan 2020 14:03:11 -0800 (PST) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Sun, 12 Jan 2020 22:56:50 +0100 Message-Id: <20200112215651.1258-2-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200112215651.1258-1-andreas.rheinhardt@gmail.com> References: <20200112215651.1258-1-andreas.rheinhardt@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH v2 2/3] avformat/apngdec: Fix size/overflow checks X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" apng data consists of parts containing a small header (including a four-byte size field) and a data part; the size field does not account for everything and is actually twelve bytes short of the actual size. In order to make sure that the size fits into an int, the size field is checked for being > INT_MAX; yet this does not account for the + 12 and upon conversion to int (which happens when calling append_extradata()), the size parameter can still wrap around. Furthermore, append_extradata() appends the new data to the already existing extradata and therefore needs to make sure that the combined size of new and old data as well as padding fits into an int. The check used for this is "if (old_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE - new_size)" and this does not work if new_size is > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE. Finally, the size field of a fcTL part has to be 26. This was enforced when reading packets, yet not when reading the header. All of these issues have been fixed. Signed-off-by: Andreas Rheinhardt --- libavformat/apngdec.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c index 36657877d2..e9c317efbf 100644 --- a/libavformat/apngdec.c +++ b/libavformat/apngdec.c @@ -121,13 +121,13 @@ end: return AVPROBE_SCORE_MAX; } -static int append_extradata(AVCodecParameters *par, AVIOContext *pb, int len) +static int append_extradata(AVCodecParameters *par, AVIOContext *pb, uint64_t len) { int previous_size = par->extradata_size; int new_size, ret; uint8_t *new_extradata; - if (previous_size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE - len) + if (previous_size + len > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE) return AVERROR_INVALIDDATA; new_size = previous_size + len; @@ -208,16 +208,11 @@ static int apng_read_header(AVFormatContext *s) goto fail; len = avio_rb32(pb); - if (len > 0x7fffffff) { - ret = AVERROR_INVALIDDATA; - goto fail; - } - tag = avio_rl32(pb); switch (tag) { case MKTAG('a', 'c', 'T', 'L'): if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 || - (ret = append_extradata(st->codecpar, pb, len + 12)) < 0) + (ret = append_extradata(st->codecpar, pb, len + 12ULL)) < 0) goto fail; acTL_found = 1; ctx->num_frames = AV_RB32(st->codecpar->extradata + ret + 8); @@ -226,7 +221,7 @@ static int apng_read_header(AVFormatContext *s) ctx->num_frames, ctx->num_play); break; case MKTAG('f', 'c', 'T', 'L'): - if (!acTL_found) { + if (!acTL_found || len != 26) { ret = AVERROR_INVALIDDATA; goto fail; } @@ -235,7 +230,7 @@ static int apng_read_header(AVFormatContext *s) return 0; default: if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 || - (ret = append_extradata(st->codecpar, pb, len + 12)) < 0) + (ret = append_extradata(st->codecpar, pb, len + 12ULL)) < 0) goto fail; } } From patchwork Sun Jan 12 21:56:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Rheinhardt X-Patchwork-Id: 17311 Return-Path: X-Original-To: patchwork@ffaux-bg.ffmpeg.org Delivered-To: patchwork@ffaux-bg.ffmpeg.org Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by ffaux.localdomain (Postfix) with ESMTP id 2582444B190 for ; Mon, 13 Jan 2020 00:03:20 +0200 (EET) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 0274068B0C7; Mon, 13 Jan 2020 00:03:20 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wr1-f65.google.com (mail-wr1-f65.google.com [209.85.221.65]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 3E46B68B0C5 for ; Mon, 13 Jan 2020 00:03:13 +0200 (EET) Received: by mail-wr1-f65.google.com with SMTP id c14so6720411wrn.7 for ; Sun, 12 Jan 2020 14:03:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=4jMo+26FxOetSGNha8kISRsLU6/0zBLwySs3PQMojz4=; b=ri7YCoU2cZjLvSSQ+acBG3aPa0JqnVrgtS7k19jYvvo56KSNjChpvc3VyBPukyKSR0 LNYIqoleHgjFov6k8XqaC9l72f2rBobaiznjvrrXPZeknzA4GJAk3T3HgB4QJWbBmoz7 batmpAVC6x2QUbx9oPjCvmlUQfgsfd/w3SIijWOE16ICAn665TDgZKImpuPFI+mJ0Ngc aAa4uLKk0DuXlJh7vkKO0ab0pNS0dNt+P98o8DHeGbbCoEjVoTeY8wi6oIoXg2JdtLqe YcLEMX5cPVGMyr8rZuakYoqOzRfrViN0GwY9YhNMfhVHygI5+fuYdCtq/S1VazuDOQGr 2tLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=4jMo+26FxOetSGNha8kISRsLU6/0zBLwySs3PQMojz4=; b=NYfdNyGbFrepSMsKhanBenl2mJIIJYjRryJmkFhWjh/K/B8ArpZg+ygYCBvgi2BPUh J8JQr3X1bgdGhlb/4MrTDUc1c8lkIwNxoa8I8f+eRArk0ux+jfJ0BKJXq29qkUOcEnyp D2fLlRAsucUFSTxFYSzEgiJnnwojYZc9soXHqU2q41IYI/hO+K+l6XBkIym3BBppBYdD othTnc8BtJYJHO61gxiNllfJrbOabziE/U5hzD4Z2D/19QLGmeewuZiBKBwpb3oaWwDy 5uOEu0PEuxJUc0Sp1j/npv8F5//h7SdgyGoeLBQmUWqAiDJUfSSg0rqABWtU/pbcg7PC BXSA== X-Gm-Message-State: APjAAAW+oRI72VGkZHVCcdSHM6rP96FWwgdmQre4RRLHoA/3k04tyopL Cs+jM8mg7uH0KSn365St3hr+vrig X-Google-Smtp-Source: APXvYqwrlxhz7WTi2tOxq4CnrchydQOPZPHJwR220/ESoE7h2josZo00PWdsJ5oEBe0uep5+VO9fFA== X-Received: by 2002:adf:fd07:: with SMTP id e7mr14660993wrr.21.1578866592453; Sun, 12 Jan 2020 14:03:12 -0800 (PST) Received: from sblaptop.fritz.box (ipbcc08bbf.dynamic.kabel-deutschland.de. [188.192.139.191]) by smtp.gmail.com with ESMTPSA id c4sm11763741wml.7.2020.01.12.14.03.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jan 2020 14:03:12 -0800 (PST) From: Andreas Rheinhardt To: ffmpeg-devel@ffmpeg.org Date: Sun, 12 Jan 2020 22:56:51 +0100 Message-Id: <20200112215651.1258-3-andreas.rheinhardt@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200112215651.1258-1-andreas.rheinhardt@gmail.com> References: <20200112215651.1258-1-andreas.rheinhardt@gmail.com> MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH v2 3/3] avformat/apngdec: Remove goto fail that does nothing X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Andreas Rheinhardt Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Signed-off-by: Andreas Rheinhardt --- libavformat/apngdec.c | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c index e9c317efbf..13b66d700c 100644 --- a/libavformat/apngdec.c +++ b/libavformat/apngdec.c @@ -151,17 +151,17 @@ static int apng_read_header(AVFormatContext *s) uint32_t len, tag; AVStream *st; int acTL_found = 0; - int64_t ret = AVERROR_INVALIDDATA; + int64_t ret; /* verify PNGSIG */ if (avio_rb64(pb) != PNGSIG) - return ret; + return AVERROR_INVALIDDATA; /* parse IHDR (must be first chunk) */ len = avio_rb32(pb); tag = avio_rl32(pb); if (len != 13 || tag != MKTAG('I', 'H', 'D', 'R')) - return ret; + return AVERROR_INVALIDDATA; st = avformat_new_stream(s, NULL); if (!st) @@ -193,11 +193,9 @@ static int apng_read_header(AVFormatContext *s) int64_t size = avio_size(pb); int64_t offset = avio_tell(pb); if (size < 0) { - ret = size; - goto fail; + return size; } else if (offset < 0) { - ret = offset; - goto fail; + return offset; } else if ((ret = ffio_ensure_seekback(pb, size - offset)) < 0) { av_log(s, AV_LOG_WARNING, "Could not ensure seekback, will not loop\n"); ctx->num_play = 1; @@ -205,7 +203,7 @@ static int apng_read_header(AVFormatContext *s) } if ((ctx->num_play == 1 || !acTL_found) && ((ret = ffio_ensure_seekback(pb, 4 /* len */ + 4 /* tag */)) < 0)) - goto fail; + return ret; len = avio_rb32(pb); tag = avio_rl32(pb); @@ -213,7 +211,7 @@ static int apng_read_header(AVFormatContext *s) case MKTAG('a', 'c', 'T', 'L'): if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 || (ret = append_extradata(st->codecpar, pb, len + 12ULL)) < 0) - goto fail; + return ret; acTL_found = 1; ctx->num_frames = AV_RB32(st->codecpar->extradata + ret + 8); ctx->num_play = AV_RB32(st->codecpar->extradata + ret + 12); @@ -222,21 +220,17 @@ static int apng_read_header(AVFormatContext *s) break; case MKTAG('f', 'c', 'T', 'L'): if (!acTL_found || len != 26) { - ret = AVERROR_INVALIDDATA; - goto fail; + return AVERROR_INVALIDDATA; } if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0) - goto fail; + return ret; return 0; default: if ((ret = avio_seek(pb, -8, SEEK_CUR)) < 0 || (ret = append_extradata(st->codecpar, pb, len + 12ULL)) < 0) - goto fail; + return ret; } } - -fail: - return ret; } static int decode_fctl_chunk(AVFormatContext *s, APNGDemuxContext *ctx, AVPacket *pkt)