[FFmpeg-devel] [PATCH] [PATCH] avformat/apngdec: allow other chunks between fcTL and fdAT/IDAT (PR #20208)

[devjeonghwan <code@ffmpeg.org>]

PR #20208 opened by devjeonghwan
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20208
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20208.patch

The APNG demuxer incorrectly assumed that fcTL chunks must be immediately followed by fdAT or IDAT chunks.
Per PNG specification section 14.3.2, ancillary chunks may appear in any order relative to other ancillary chunks.

This change allows intermediate chunks (like tEXt) between fcTL and frame data chunks, fixing playback of APNG files with metadata.

Fixes [#11012](https://trac.ffmpeg.org/ticket/11012).

Follow-up to #20140


From fa82fd3086262001165cb3be663d7fb241997e00 Mon Sep 17 00:00:00 2001
From: devjeonghwan <dev.parkjeonghwan@gmail.com>
Date: Thu, 7 Aug 2025 01:37:37 +0900
Subject: [PATCH 1/2] avformat/apngdec: allow other chunks between fcTL and
 fdAT/IDAT

---
 libavformat/apngdec.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c
index d0005046c1..6b9d2c3c88 100644
--- a/libavformat/apngdec.c
+++ b/libavformat/apngdec.c
@@ -344,14 +344,27 @@ static int apng_read_packet(AVFormatContext *s, AVPacket *pkt)
         if ((ret = decode_fctl_chunk(s, ctx, pkt)) < 0)
             return ret;
 
-        /* fcTL must precede fdAT or IDAT */
+        /* fcTL may be followed by other chunks before fdAT or IDAT */
         len = avio_rb32(pb);
         tag = avio_rl32(pb);
-        if (len > 0x7fffffff ||
-            tag != MKTAG('f', 'd', 'A', 'T') &&
-            tag != MKTAG('I', 'D', 'A', 'T'))
+        if (len > 0x7fffffff)
             return AVERROR_INVALIDDATA;
 
+        /* check for empty frame */
+        if (tag == MKTAG('f', 'c', 'T', 'L') ||
+            tag == MKTAG('I', 'E', 'N', 'D')) {
+            size = 38; /* size of fcTL chunk and its header */
+            if ((ret = avio_seek(pb, -46, SEEK_CUR)) < 0 ||
+                (ret = av_append_packet(pb, pkt, size)) < 0)
+                return ret;
+
+            if (ctx->is_key_frame)
+                pkt->flags |= AV_PKT_FLAG_KEY;
+            pkt->pts = pkt->dts = AV_NOPTS_VALUE;
+            pkt->duration = ctx->pkt_duration;
+            return ret;
+        }
+
         size = 38 /* fcTL */ + 8 /* len, tag */ + len + 4 /* crc */;
         if (size > INT_MAX)
             return AVERROR(EINVAL);
-- 
2.49.1


From d55907dd3d253c4aff6b4a2ab2c186e41c05348f Mon Sep 17 00:00:00 2001
From: "dev.parkjeonghwan@gmail.com" <dev.parkjeonghwan@gmail.com>
Date: Mon, 11 Aug 2025 09:58:30 +0900
Subject: [PATCH 2/2] avformat/apngdec: reject fcTL-only frame as invalid

---
 libavformat/apngdec.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/libavformat/apngdec.c b/libavformat/apngdec.c
index 6b9d2c3c88..c51cb3c889 100644
--- a/libavformat/apngdec.c
+++ b/libavformat/apngdec.c
@@ -352,18 +352,8 @@ static int apng_read_packet(AVFormatContext *s, AVPacket *pkt)
 
         /* check for empty frame */
         if (tag == MKTAG('f', 'c', 'T', 'L') ||
-            tag == MKTAG('I', 'E', 'N', 'D')) {
-            size = 38; /* size of fcTL chunk and its header */
-            if ((ret = avio_seek(pb, -46, SEEK_CUR)) < 0 ||
-                (ret = av_append_packet(pb, pkt, size)) < 0)
-                return ret;
-
-            if (ctx->is_key_frame)
-                pkt->flags |= AV_PKT_FLAG_KEY;
-            pkt->pts = pkt->dts = AV_NOPTS_VALUE;
-            pkt->duration = ctx->pkt_duration;
-            return ret;
-        }
+            tag == MKTAG('I', 'E', 'N', 'D'))
+            return AVERROR_INVALIDDATA;
 
         size = 38 /* fcTL */ + 8 /* len, tag */ + len + 4 /* crc */;
         if (size > INT_MAX)
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".