diff options
| author | Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> | 2015-07-03 00:45:46 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-07-03 05:06:19 +0300 |
| commit | 0762152f7af6cd93bc8f504d5503723500c3f369 (patch) | |
| tree | e71bbaa173192593a566c4f76802f858fe82f7f2 /libavcodec/webp.c | |
| parent | 30ffbeb04abde7bcf2ec01566f56dc187a87cad3 (diff) | |
webp: fix infinite loop in webp_decode_frame
The loop always needs at least 8 bytes for chunk_type and chunk_size.
If fewer are left, bytestream2_get_le32 just returns 0 without
reading any bytes, leading to an infinite loop.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/webp.c')
| -rw-r--r-- | libavcodec/webp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/webp.c b/libavcodec/webp.c index 47e9e9e662..723a84769b 100644 --- a/libavcodec/webp.c +++ b/libavcodec/webp.c @@ -1387,7 +1387,7 @@ static int webp_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, } av_dict_free(&s->exif_metadata); - while (bytestream2_get_bytes_left(&gb) > 0) { + while (bytestream2_get_bytes_left(&gb) > 8) { char chunk_str[5] = { 0 }; chunk_type = bytestream2_get_le32(&gb); |