avformat/apngenc: Check for incomplete chunks

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2022-07-04 15:52:21 +02:00
parent e4a10dd637
commit 3204572a1a

View File

@ -50,7 +50,7 @@ typedef struct APNGMuxContext {
static uint8_t *apng_find_chunk(uint32_t tag, uint8_t *buf, size_t length)
{
size_t b;
for (b = 0; b < length; b += AV_RB32(buf + b) + 12)
for (b = 0; AV_RB32(buf + b) + 12ULL <= length - b; b += AV_RB32(buf + b) + 12ULL)
if (AV_RB32(&buf[b + 4]) == tag)
return &buf[b];
return NULL;