diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c index d0005046c1..c51cb3c889 100644 --- a/libavformat/apngdec.c +++ b/libavformat/apngdec.c @@ -344,12 +344,15 @@ static int apng_read_packet(AVFormatContext *s, AVPacket *pkt) if ((ret = decode_fctl_chunk(s, ctx, pkt)) < 0) return ret; - /* fcTL must precede fdAT or IDAT */ + /* fcTL may be followed by other chunks before fdAT or IDAT */ len = avio_rb32(pb); tag = avio_rl32(pb); - if (len > 0x7fffffff || - tag != MKTAG('f', 'd', 'A', 'T') && - tag != MKTAG('I', 'D', 'A', 'T')) + if (len > 0x7fffffff) + return AVERROR_INVALIDDATA; + + /* check for empty frame */ + if (tag == MKTAG('f', 'c', 'T', 'L') || + tag == MKTAG('I', 'E', 'N', 'D')) return AVERROR_INVALIDDATA; size = 38 /* fcTL */ + 8 /* len, tag */ + len + 4 /* crc */;