[FFmpeg-cvslog] gifdec: check that the last keyframe exists and has been successfully parsed.

[Michael Niedermayer]

ffmpeg | branch: release/1.1 | Michael Niedermayer <michaelni at gmx.at> | Thu Jan 24 04:17:58 2013 +0100| [91138821fb675883e69f123a5ad86ca8470fb537] | committer: Michael Niedermayer

gifdec: check that the last keyframe exists and has been successfully parsed.

Prevents inconsistent state and null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 46cb61819d867961e8f2052a8f13bcf2027d484f)

Conflicts:

	libavcodec/gifdec.c

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=91138821fb675883e69f123a5ad86ca8470fb537
---

 libavcodec/gifdec.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/gifdec.c b/libavcodec/gifdec.c
index 9be5bec..41d3d5b 100644
--- a/libavcodec/gifdec.c
+++ b/libavcodec/gifdec.c
@@ -75,6 +75,7 @@ typedef struct GifState {
 
     AVCodecContext *avctx;
     int keyframe;
+    int keyframe_ok;
     int trans_color;    /**< color value that is used instead of transparent color */
 } GifState;
 
@@ -471,6 +472,7 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
     }
 
     if (s->keyframe) {
+        s->keyframe_ok = 0;
         s->gce_prev_disposal = GCE_DISPOSAL_NONE;
         if ((ret = gif_read_header1(s)) < 0)
             return ret;
@@ -489,7 +491,13 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, A
 
         s->picture.pict_type = AV_PICTURE_TYPE_I;
         s->picture.key_frame = 1;
+        s->keyframe_ok = 1;
     } else {
+        if (!s->keyframe_ok) {
+            av_log(avctx, AV_LOG_ERROR, "cannot decode frame without keyframe\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         if ((ret = avctx->reget_buffer(avctx, &s->picture)) < 0) {
             av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
             return ret;