From 9edff4f9812fad7f605bdc12954f82a8745a25ee Mon Sep 17 00:00:00 2001 From: Pascal Massimino Date: Wed, 28 Aug 2019 09:41:42 +0200 Subject: [PATCH] webp: fix decoding for trailing junk some bitstream have trailing junk, despite being valid webp data. In case of apparent error, abort the loop and let *got_frame decide whether this is an error or not. Another possibility would be turning the loop into: while (!*got_frame) {...} --- libavcodec/webp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/webp.c b/libavcodec/webp.c index 077bb06f85..c6d0206846 100644 --- a/libavcodec/webp.c +++ b/libavcodec/webp.c @@ -1412,8 +1412,11 @@ static int webp_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, return AVERROR_INVALIDDATA; chunk_size += chunk_size & 1; - if (bytestream2_get_bytes_left(&gb) < chunk_size) - return AVERROR_INVALIDDATA; + if (bytestream2_get_bytes_left(&gb) < chunk_size) { + /* we seem to be running out of data, but it could also be that the + bitstream has trailing junk leading to bogus chunk_size. */ + break; + } switch (chunk_type) { case MKTAG('V', 'P', '8', ' '): -- 2.19.0.605.g01d371f741-goog