[FFmpeg-devel] [PATCH] [PATCH] avformat/apngdec: allow other chunks between fcTL and fdAT/IDAT (PR #20140)

[Park Jeonghwan]

PR #20140 opened by Park Jeonghwan (devjeonghwan)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20140
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20140.patch

The APNG demuxer incorrectly assumed that fcTL chunks must be immediately followed by fdAT or IDAT chunks.
Per PNG specification section 14.3.2, ancillary chunks may appear in any order relative to other ancillary chunks.

This change allows intermediate chunks (like tEXt) between fcTL and frame data chunks, fixing playback of APNG files with metadata.

Fixes [#11012](https://trac.ffmpeg.org/ticket/11012).


From f048044c8fe7b1938efc1c3c6d38b56b24e6b62d Mon Sep 17 00:00:00 2001
From: devjeonghwan <dev.parkjeonghwan at gmail.com>
Date: Thu, 7 Aug 2025 01:37:37 +0900
Subject: [PATCH] avformat/apngdec: allow other chunks between fcTL and
 fdAT/IDAT

---
 libavformat/apngdec.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c
index d0005046c1..6b9d2c3c88 100644
--- a/libavformat/apngdec.c
+++ b/libavformat/apngdec.c
@@ -344,14 +344,27 @@ static int apng_read_packet(AVFormatContext *s, AVPacket *pkt)
         if ((ret = decode_fctl_chunk(s, ctx, pkt)) < 0)
             return ret;
 
-        /* fcTL must precede fdAT or IDAT */
+        /* fcTL may be followed by other chunks before fdAT or IDAT */
         len = avio_rb32(pb);
         tag = avio_rl32(pb);
-        if (len > 0x7fffffff ||
-            tag != MKTAG('f', 'd', 'A', 'T') &&
-            tag != MKTAG('I', 'D', 'A', 'T'))
+        if (len > 0x7fffffff)
             return AVERROR_INVALIDDATA;
 
+        /* check for empty frame */
+        if (tag == MKTAG('f', 'c', 'T', 'L') ||
+            tag == MKTAG('I', 'E', 'N', 'D')) {
+            size = 38; /* size of fcTL chunk and its header */
+            if ((ret = avio_seek(pb, -46, SEEK_CUR)) < 0 ||
+                (ret = av_append_packet(pb, pkt, size)) < 0)
+                return ret;
+
+            if (ctx->is_key_frame)
+                pkt->flags |= AV_PKT_FLAG_KEY;
+            pkt->pts = pkt->dts = AV_NOPTS_VALUE;
+            pkt->duration = ctx->pkt_duration;
+            return ret;
+        }
+
         size = 38 /* fcTL */ + 8 /* len, tag */ + len + 4 /* crc */;
         if (size > INT_MAX)
             return AVERROR(EINVAL);
-- 
2.49.1