avformat/apngdec: Check fcTL chunk length when reading header

[ffmpeg] / libavformat / apngdec.c

diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c
index d8d0de190fb00e14b74acbf8b2f413df9d9fdcfd..6b2ce2e251532a3c146651fe7e5d8ae034c32ba2 100644 (file)
--- a/libavformat/apngdec.c
+++ b/libavformat/apngdec.c
@@ -226,7 +226,7 @@ static int apng_read_header(AVFormatContext *s)
                                     ctx->num_frames, ctx->num_play);
             break;
         case MKTAG('f', 'c', 'T', 'L'):
-            if (!acTL_found) {
+            if (!acTL_found || len != 26) {
                ret = AVERROR_INVALIDDATA;
                goto fail;
             }