[FFmpeg-cvslog] [ffmpeg] branch master updated. 243b392d83 avformat/apngdec: allow other chunks between fcTL and fdAT/IDAT

[ffmpeg-git at ffmpeg.org]

The branch, master has been updated
       via  243b392d83cab1686e213680ba0a8f997a271701 (commit)
      from  a9e7b5aa07d58173bbf08d6eb4537b76fa8966a7 (commit)


- Log -----------------------------------------------------------------
commit 243b392d83cab1686e213680ba0a8f997a271701
Author:     devjeonghwan <dev.parkjeonghwan at gmail.com>
AuthorDate: Thu Aug 7 01:37:37 2025 +0900
Commit:     Leo Izen <leo.izen at gmail.com>
CommitDate: Thu Aug 14 08:05:21 2025 -0400

    avformat/apngdec: allow other chunks between fcTL and fdAT/IDAT

diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c
index d0005046c1..c51cb3c889 100644
--- a/libavformat/apngdec.c
+++ b/libavformat/apngdec.c
@@ -344,12 +344,15 @@ static int apng_read_packet(AVFormatContext *s, AVPacket *pkt)
         if ((ret = decode_fctl_chunk(s, ctx, pkt)) < 0)
             return ret;
 
-        /* fcTL must precede fdAT or IDAT */
+        /* fcTL may be followed by other chunks before fdAT or IDAT */
         len = avio_rb32(pb);
         tag = avio_rl32(pb);
-        if (len > 0x7fffffff ||
-            tag != MKTAG('f', 'd', 'A', 'T') &&
-            tag != MKTAG('I', 'D', 'A', 'T'))
+        if (len > 0x7fffffff)
+            return AVERROR_INVALIDDATA;
+
+        /* check for empty frame */
+        if (tag == MKTAG('f', 'c', 'T', 'L') ||
+            tag == MKTAG('I', 'E', 'N', 'D'))
             return AVERROR_INVALIDDATA;
 
         size = 38 /* fcTL */ + 8 /* len, tag */ + len + 4 /* crc */;

-----------------------------------------------------------------------

Summary of changes:
 libavformat/apngdec.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)


hooks/post-receive
--