Prevents inconsistent state and null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
... | ... |
@@ -75,6 +75,7 @@ typedef struct GifState { |
75 | 75 |
|
76 | 76 |
AVCodecContext *avctx; |
77 | 77 |
int keyframe; |
78 |
+ int keyframe_ok; |
|
78 | 79 |
int trans_color; /**< color value that is used instead of transparent color */ |
79 | 80 |
} GifState; |
80 | 81 |
|
... | ... |
@@ -472,6 +473,7 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A |
472 | 472 |
} |
473 | 473 |
|
474 | 474 |
if (s->keyframe) { |
475 |
+ s->keyframe_ok = 0; |
|
475 | 476 |
if ((ret = gif_read_header1(s)) < 0) |
476 | 477 |
return ret; |
477 | 478 |
|
... | ... |
@@ -489,7 +491,13 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A |
489 | 489 |
|
490 | 490 |
s->picture.pict_type = AV_PICTURE_TYPE_I; |
491 | 491 |
s->picture.key_frame = 1; |
492 |
+ s->keyframe_ok = 1; |
|
492 | 493 |
} else { |
494 |
+ if (!s->keyframe_ok) { |
|
495 |
+ av_log(avctx, AV_LOG_ERROR, "cannot decode frame without keyframe\n"); |
|
496 |
+ return AVERROR_INVALIDDATA; |
|
497 |
+ } |
|
498 |
+ |
|
493 | 499 |
if ((ret = avctx->reget_buffer(avctx, &s->picture)) < 0) { |
494 | 500 |
av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n"); |
495 | 501 |
return ret; |