From: "Ronald S. Bultje" <[email protected]>
If the PNG filter is enabled, a PNG-style filter will run over the
input buffer, writing into the buffer. Therefore, if no zlib compression
was used, ensure that we copy into a temporary buffer, otherwise we
overwrite user-provided input data.
---
libavcodec/lcldec.c | 11 ++++++++---
1 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c
index b66a3ce..a7f0bde 100644
--- a/libavcodec/lcldec.c
+++ b/libavcodec/lcldec.c
@@ -236,9 +236,14 @@ static int decode_frame(AVCodecContext *avctx, void *data,
int *data_size, AVPac
* gives a file with ZLIB fourcc, but frame is really uncompressed.
* To be sure that's true check also frame size */
if (c->compression == COMP_ZLIB_NORMAL && c->imgtype == IMGTYPE_RGB24
&&
- len == width * height * 3)
- break;
- if (c->flags & FLAG_MULTITHREAD) {
+ len == width * height * 3) {
+ if (c->flags & FLAG_PNGFILTER) {
+ memcpy(c->decomp_buf, encoded, len);
+ encoded = c->decomp_buf;
+ } else {
+ break;
+ }
+ } else if (c->flags & FLAG_MULTITHREAD) {
int ret;
mthread_inlen = AV_RL32(encoded);
mthread_inlen = FFMIN(mthread_inlen, len - 8);
--
1.7.7.4
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
