dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2025-02-13 07:22:52 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Mux: fix a scenario with bad ANMF/FRGM size

Browse Source 
When a ANMF/FRGM chunk size (read from file) is smaller than ANMF/FRGM header
size (which is constant and implicit), the parser should report an error.

Change-Id: I91d71889937f5133a97f1e83d5254cb2d7f37028
This commit is contained in:
Urvang Joshi 2013-01-23 00:49:37 +00:00 committed by James Zern
parent 19eb012c55
commit be2fd1735a
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/mux/muxread.c
View File

@ -92,6 +92,9 @@ static int MuxImageParse(const WebPChunk* const chunk, int copy_data,
const size_t hdr_size = (chunk->tag_ == kChunks[IDX_ANMF].tag) ? const size_t hdr_size = (chunk->tag_ == kChunks[IDX_ANMF].tag) ?
ANMF_CHUNK_SIZE : FRGM_CHUNK_SIZE; ANMF_CHUNK_SIZE : FRGM_CHUNK_SIZE;
const WebPData temp = { bytes, hdr_size }; const WebPData temp = { bytes, hdr_size };
// Each of ANMF and FRGM chunk contain a header at the beginning. So, its
// size should at least be 'hdr_size'.
if (size < hdr_size) goto Fail;
ChunkAssignData(&subchunk, &temp, copy_data, chunk->tag_); ChunkAssignData(&subchunk, &temp, copy_data, chunk->tag_);
} }
ChunkSetNth(&subchunk, &wpi->header_, 1); ChunkSetNth(&subchunk, &wpi->header_, 1);