Browse code

gifdec: check that the last keyframe exists and has been successfully parsed.

Prevents inconsistent state and null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2013/01/24 12:17:58
Showing 1 changed files
... ...
@@ -75,6 +75,7 @@ typedef struct GifState {
75 75
 
76 76
     AVCodecContext *avctx;
77 77
     int keyframe;
78
+    int keyframe_ok;
78 79
     int trans_color;    /**< color value that is used instead of transparent color */
79 80
 } GifState;
80 81
 
... ...
@@ -472,6 +473,7 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
472 472
     }
473 473
 
474 474
     if (s->keyframe) {
475
+        s->keyframe_ok = 0;
475 476
         if ((ret = gif_read_header1(s)) < 0)
476 477
             return ret;
477 478
 
... ...
@@ -489,7 +491,13 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
489 489
 
490 490
         s->picture.pict_type = AV_PICTURE_TYPE_I;
491 491
         s->picture.key_frame = 1;
492
+        s->keyframe_ok = 1;
492 493
     } else {
494
+        if (!s->keyframe_ok) {
495
+            av_log(avctx, AV_LOG_ERROR, "cannot decode frame without keyframe\n");
496
+            return AVERROR_INVALIDDATA;
497
+        }
498
+
493 499
         if ((ret = avctx->reget_buffer(avctx, &s->picture)) < 0) {
494 500
             av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
495 501
             return ret;