[FFmpeg-cvslog] pngdec: check bits_per_pixel for palette mode.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Apr 15 18:01:11 2012 +0200| [a63c813797fbdc32c530bf8930e11bf5a9a01d77] | committer: Michael Niedermayer

pngdec: check bits_per_pixel for palette mode.

This fixes a out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a63c813797fbdc32c530bf8930e11bf5a9a01d77
---

 libavcodec/pngdec.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index a96d3cd..5d0604e 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -494,7 +494,8 @@ static int decode_frame(AVCodecContext *avctx,
                 } else if (s->bit_depth == 16 &&
                            s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
                     avctx->pix_fmt = PIX_FMT_RGBA64BE;
-                } else if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
+                } else if ((s->bits_per_pixel == 1 || s->bits_per_pixel == 2 || s->bits_per_pixel == 4 || s->bits_per_pixel == 8) &&
+                           s->color_type == PNG_COLOR_TYPE_PALETTE) {
                     avctx->pix_fmt = PIX_FMT_PAL8;
                 } else if (s->bit_depth == 1) {
                     avctx->pix_fmt = PIX_FMT_MONOBLACK;