Merge commit '1e763454322f7fbc7799f6009bf2e11d7a3b9821'

* commit '1e763454322f7fbc7799f6009bf2e11d7a3b9821':
  png: improve signature check

Conflicts:
	libavcodec/pngdec.c

See: 8a08503b78f59d61cf98b9deb99363e3e07d8599
See: 0a3589bf2f0a23b0eb68664fbb00078abe882a88
Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --cc libavcodec/pngdec.c
index 297e631,dec5bd5..901abae
--- 1/libavcodec/pngdec.c
--- 2/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@@ -1063,82 -607,25 +1063,82 @@@ skip_tag
          }
      }
  exit_loop:
 +
 +    if (s->bits_per_pixel <= 4)
 +        handle_small_bpp(s, p);
 +
      /* handle p-frames only if a predecessor frame is available */
 -    if (s->prev->data[0]) {
 -        if (!(avpkt->flags & AV_PKT_FLAG_KEY)) {
 -            int i, j;
 -            uint8_t *pd      = p->data[0];
 -            uint8_t *pd_last = s->prev->data[0];
 -
 -            for (j = 0; j < s->height; j++) {
 -                for (i = 0; i < s->width * s->bpp; i++)
 -                    pd[i] += pd_last[i];
 -                pd      += s->image_linesize;
 -                pd_last += s->image_linesize;
 -            }
 +    ref = s->dispose_op == APNG_DISPOSE_OP_PREVIOUS ?
 +             s->previous_picture.f : s->last_picture.f;
 +    if (ref->data[0]) {
 +        if (   !(avpkt->flags & AV_PKT_FLAG_KEY) && avctx->codec_tag != AV_RL32("MPNG")
 +            && ref->width == p->width
 +            && ref->height== p->height
 +            && ref->format== p->format
 +         ) {
 +            if (CONFIG_PNG_DECODER && avctx->codec_id != AV_CODEC_ID_APNG)
 +                handle_p_frame_png(s, p);
 +            else if (CONFIG_APNG_DECODER &&
 +                     avctx->codec_id == AV_CODEC_ID_APNG &&
 +                     (ret = handle_p_frame_apng(avctx, s, p)) < 0)
 +                goto fail;
          }
      }
-         av_log(avctx, AV_LOG_ERROR, "Missing png signature\n");
 +    ff_thread_report_progress(&s->picture, INT_MAX, 0);
 +
 +    av_frame_set_metadata(p, metadata);
 +    metadata   = NULL;
 +    return 0;
 +
 +fail:
 +    av_dict_free(&metadata);
 +    ff_thread_report_progress(&s->picture, INT_MAX, 0);
 +    return ret;
 +}
 +
 +#if CONFIG_PNG_DECODER
 +static int decode_frame_png(AVCodecContext *avctx,
 +                        void *data, int *got_frame,
 +                        AVPacket *avpkt)
 +{
 +    PNGDecContext *const s = avctx->priv_data;
 +    const uint8_t *buf     = avpkt->data;
 +    int buf_size           = avpkt->size;
 +    AVFrame *p;
 +    int64_t sig;
 +    int ret;
 +
 +    ff_thread_release_buffer(avctx, &s->last_picture);
 +    FFSWAP(ThreadFrame, s->picture, s->last_picture);
 +    p = s->picture.f;
 +
 +    bytestream2_init(&s->gb, buf, buf_size);
 +
 +    /* check signature */
 +    sig = bytestream2_get_be64(&s->gb);
 +    if (sig != PNGSIG &&
 +        sig != MNGSIG) {
++        av_log(avctx, AV_LOG_ERROR, "Invalid PNG signature (%d).\n", buf_size);
 +        return AVERROR_INVALIDDATA;
 +    }
  
 -    av_frame_unref(s->prev);
 -    if ((ret = av_frame_ref(s->prev, p)) < 0)
 -        goto fail;
 +    s->y = s->state = 0;
 +
 +    /* init the zlib */
 +    s->zstream.zalloc = ff_png_zalloc;
 +    s->zstream.zfree  = ff_png_zfree;
 +    s->zstream.opaque = NULL;
 +    ret = inflateInit(&s->zstream);
 +    if (ret != Z_OK) {
 +        av_log(avctx, AV_LOG_ERROR, "inflateInit returned error %d\n", ret);
 +        return AVERROR_EXTERNAL;
 +    }
 +
 +    if ((ret = decode_frame_common(avctx, s, p, avpkt)) < 0)
 +        goto the_end;
 +
 +    if ((ret = av_frame_ref(data, s->picture.f)) < 0)
 +        return ret;
  
      *got_frame = 1;