[FFmpeg-cvslog] pngdec: validate length.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Mar  4 06:25:06 2012 +0100| [39a3a53b66fcc115bd8d0bc0a70db66791eab854] | committer: Michael Niedermayer

pngdec: validate length.

Fixes out of array reading.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=39a3a53b66fcc115bd8d0bc0a70db66791eab854
---

 libavcodec/pngdec.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index 39afbdd..55df8b0 100644
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -427,7 +427,7 @@ static int decode_frame(AVCodecContext *avctx,
         if (s->bytestream >= s->bytestream_end)
             goto fail;
         length = bytestream_get_be32(&s->bytestream);
-        if (length > 0x7fffffff)
+        if (length > 0x7fffffff || length > s->bytestream_end - s->bytestream)
             goto fail;
         tag32 = bytestream_get_be32(&s->bytestream);
         tag = av_bswap32(tag32);