From: Michael Niedermayer <michaelni@gmx.at>
Date: Wed, 26 Nov 2014 13:45:47 +0000 (+0100)
Subject: avcodec/pngdec: Check IHDR/IDAT order
X-Git-Tag: archive/raspbian/6%11.12-1_deb8u3+rpi1^2~21
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=6d3dad6df2d299a4296e4afa053e94b027d6aaad;p=libav.git

avcodec/pngdec: Check IHDR/IDAT order

avcodec/pngdec: Check IHDR/IDAT order

Fixes out of array access
Fixes: asan_heap-oob_20a6c26_2690_cov_3434532168_mail.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

[sunweaver] - Port this commit to libav in Debian jessie.

Gbp-Pq: Name CVE-2014-9317.patch
---

diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index 2790bf4..58b5799 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -445,6 +445,12 @@ static int decode_frame(AVCodecContext *avctx,
         case MKTAG('I', 'H', 'D', 'R'):
             if (length != 13)
                 goto fail;
+
+            if (s->state & PNG_IDAT) {
+                av_log(avctx, AV_LOG_ERROR, "IHDR after IDAT\n");
+                goto fail;
+            }
+
             s->width  = bytestream2_get_be32(&s->gb);
             s->height = bytestream2_get_be32(&s->gb);
             if (av_image_check_size(s->width, s->height, 0, avctx)) {