From a63c813797fbdc32c530bf8930e11bf5a9a01d77 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 15 Apr 2012 18:01:11 +0200 Subject: pngdec: check bits_per_pixel for palette mode. This fixes a out of array read Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/pngdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'libavcodec/pngdec.c') diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index a96d3cd5d4..5d0604eea9 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -494,7 +494,8 @@ static int decode_frame(AVCodecContext *avctx, } else if (s->bit_depth == 16 && s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) { avctx->pix_fmt = PIX_FMT_RGBA64BE; - } else if (s->color_type == PNG_COLOR_TYPE_PALETTE) { + } else if ((s->bits_per_pixel == 1 || s->bits_per_pixel == 2 || s->bits_per_pixel == 4 || s->bits_per_pixel == 8) && + s->color_type == PNG_COLOR_TYPE_PALETTE) { avctx->pix_fmt = PIX_FMT_PAL8; } else if (s->bit_depth == 1) { avctx->pix_fmt = PIX_FMT_MONOBLACK; -- cgit v1.2.3