From e5bcecfb3739ba390bb7eed4a6988a7247fc2902 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 4 Feb 2017 12:24:14 +0100 Subject: [PATCH] avcodec/pngdec: Check trns more completely Fixes out of array access Fixes: 546/clusterfuzz-testcase-4809433909559296 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer [sunweaver] ported to libav in Debian jessie LTS (which only supports palette based transparency). Gbp-Pq: Name CVE-2017-7863.patch --- libavcodec/pngdec.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index 1511403..40b783a 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -592,6 +592,16 @@ static int decode_frame(AVCodecContext *avctx, { int v, i; + if (!(s->state & PNG_IHDR)) { + av_log(avctx, AV_LOG_ERROR, "trns before IHDR\n"); + return AVERROR_INVALIDDATA; + } + + if (s->state & PNG_IDAT) { + av_log(avctx, AV_LOG_ERROR, "trns after IDAT\n"); + return AVERROR_INVALIDDATA; + } + /* read the transparency. XXX: Only palette mode supported */ if (s->color_type != PNG_COLOR_TYPE_PALETTE || length > 256 || -- 2.30.2