avformat/apngdec: validate frame dimensions.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
10 years ago · e2b8b4caf6
parent 345cfd04d0
commit e2b8b4caf6
1 changed files with 5 additions and 1 deletions
--- a/libavformat/apngdec.c
+++ b/libavformat/apngdec.c
@ -301,7 +301,11 @@ static int decode_fctl_chunk(AVFormatContext *s, APNGDemuxContext *ctx, AVPacket
        height != s->streams[0]->codec->height ||
        x_offset != 0 ||
        y_offset != 0) {
-        if (sequence_number == 0)
+        if (sequence_number == 0 ||
+            x_offset >= s->streams[0]->codec->width ||
+            width > s->streams[0]->codec->width - x_offset ||
+            y_offset >= s->streams[0]->codec->height ||
+            height > s->streams[0]->codec->height - y_offset)
            return AVERROR_INVALIDDATA;
        ctx->is_key_frame = 0;
    } else {