From dcbd6b5948017e8763b60bb7e8c434c24a1df74c Mon Sep 17 00:00:00 2001 From: TazyFoundSoup Date: Tue, 14 Apr 2026 12:44:00 +1000 Subject: feat(png): Validate CRC with crc32.c from tinf --- src/format/image/png.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src/format/image') diff --git a/src/format/image/png.c b/src/format/image/png.c index 1004b2a..8597a55 100644 --- a/src/format/image/png.c +++ b/src/format/image/png.c @@ -66,6 +66,12 @@ static ff_result ff_png_dispatch(ff_ctx* ctx, ff_stream* stream, ff_png_ctx *png png_ctx->last_error = FF_RESULT_ERROR_READ_FILE_FAILURE; return FF_RESULT_ERROR_READ_FILE_FAILURE; } + + uint32_t crc32 = ff_be32(crc); + if (tinf_crc32(chunk_data, length) != crc32) { + png_ctx->last_error = FF_RESULT_ERROR_INVALID_FILE; + return FF_RESULT_ERROR_INVALID_FILE; + } } } -- cgit v1.2.3