func: static int CVE_2014_8545_PATCHED_decode_frame(AVCodecContext void *data, int AVPacket *avpkt) PNGDecContext * const s = avctx -> priv_data AVFrame * p ; uint32_t tag , length ; int64_t sig ; int ret ; p = s -> picture . f; sig = bytestream2_get_be64 ( & s -> gb ); if ( sig != PNGSIG && sig != MNGSIG )  s -> y = s -> state = 0; s -> zstream . zalloc = ff_png_zalloc; s -> zstream . zfree = ff_png_zfree; s -> zstream . opaque = NULL; ret = inflateInit ( & s -> zstream ); if ( ret != Z_OK )  if ( bytestream2_get_bytes_left ( & s -> gb ) <= 0 )  length = bytestream2_get_be32 ( & s -> gb ); if ( length > 0x7fffffff || length > bytestream2_get_bytes_left ( & s -> gb ) )  if ( length != 13 )  s -> width = bytestream2_get_be32 ( & s -> gb ); s -> height = bytestream2_get_be32 ( & s -> gb ); if ( av_image_check_size ( s -> width , s -> height , 0 , avctx ) )  s -> bit_depth = bytestream2_get_byte ( & s -> gb ); s -> color_type = bytestream2_get_byte ( & s -> gb ); s -> compression_type = bytestream2_get_byte ( & s -> gb ); s -> filter_type = bytestream2_get_byte ( & s -> gb ); s -> interlace_type = bytestream2_get_byte ( & s -> gb ); s -> state |= PNG_IHDR; if ( s -> state & PNG_IDAT )  avctx -> sample_aspect_ratio . num = bytestream2_get_be32 ( & s -> gb ); avctx -> sample_aspect_ratio . den = bytestream2_get_be32 ( & s -> gb ); if ( avctx -> sample_aspect_ratio . num < 0 || avctx -> sample_aspect_ratio . den < 0 )  avctx -> sample_aspect_ratio = ( AVRational ) 0 , 1 if ( ! ( s -> state & PNG_IHDR ) )  if ( ! ( s -> state & PNG_IDAT ) )  avctx -> width = s -> width; avctx -> height = s -> height; s -> channels = ff_png_get_nb_channels ( s -> color_type ); s -> bits_per_pixel = s -> bit_depth * s -> channels; s -> bpp = ( s -> bits_per_pixel + 7 ) >> 3; s -> row_size = ( avctx -> width * s -> bits_per_pixel + 7 ) >> 3; if ( ( s -> bit_depth == 2 || s -> bit_depth == 4 || s -> bit_depth == 8 ) && s -> color_type == PNG_COLOR_TYPE_RGB )  avctx -> pix_fmt = AV_PIX_FMT_RGB24; if ( ( s -> bit_depth == 2 || s -> bit_depth == 4 || s -> bit_depth == 8 ) && s -> color_type == PNG_COLOR_TYPE_RGB_ALPHA )  avctx -> pix_fmt = AV_PIX_FMT_RGBA; if ( ( s -> bit_depth == 2 || s -> bit_depth == 4 || s -> bit_depth == 8 ) && s -> color_type == PNG_COLOR_TYPE_GRAY )  avctx -> pix_fmt = AV_PIX_FMT_GRAY8; if ( s -> bit_depth == 16 && s -> color_type == PNG_COLOR_TYPE_GRAY )  avctx -> pix_fmt = AV_PIX_FMT_GRAY16BE; if ( s -> bit_depth == 16 && s -> color_type == PNG_COLOR_TYPE_RGB )  avctx -> pix_fmt = AV_PIX_FMT_RGB48BE; if ( s -> bit_depth == 16 && s -> color_type == PNG_COLOR_TYPE_RGB_ALPHA )  avctx -> pix_fmt = AV_PIX_FMT_RGBA64BE; if ( ( s -> bits_per_pixel == 1 || s -> bits_per_pixel == 2 || s -> bits_per_pixel == 4 || s -> bits_per_pixel == 8 ) && s -> color_type == PNG_COLOR_TYPE_PALETTE )  avctx -> pix_fmt = AV_PIX_FMT_PAL8; if ( s -> bit_depth == 1 && s -> bits_per_pixel == 1 )  avctx -> pix_fmt = AV_PIX_FMT_MONOBLACK; if ( s -> bit_depth == 8 && s -> color_type == PNG_COLOR_TYPE_GRAY_ALPHA )  avctx -> pix_fmt = AV_PIX_FMT_YA8; if ( s -> bit_depth == 16 && s -> color_type == PNG_COLOR_TYPE_GRAY_ALPHA )  avctx -> pix_fmt = AV_PIX_FMT_YA16BE; if ( ff_thread_get_buffer ( avctx , & s -> picture , AV_GET_BUFFER_FLAG_REF ) < 0 )  p -> pict_type = AV_PICTURE_TYPE_I; p -> key_frame = 1; p -> interlaced_frame = ! ! s -> interlace_type; if ( ! s -> interlace_type )  s -> crow_size = s -> row_size + 1; s -> pass = 0; s -> pass_row_size = ff_png_pass_row_size ( s -> pass , s -> bits_per_pixel , s -> width ); s -> crow_size = s -> pass_row_size + 1; s -> image_buf = p -> data [ 0 ]; s -> image_linesize = p -> linesize [ 0 ]; if ( avctx -> pix_fmt == AV_PIX_FMT_PAL8 )  memcpy ( p -> data [ 1 ] , s -> palette , 256 * sizeof ( uint32_t ) ); if ( ! s -> last_row )  if ( s -> interlace_type || s -> color_type == PNG_COLOR_TYPE_RGB_ALPHA )  if ( ! s -> tmp_row )  if ( ! s -> buffer )  s -> crow_buf = s -> buffer + 15; s -> zstream . avail_out = s -> crow_size; s -> zstream . next_out = s -> crow_buf; s -> state |= PNG_IDAT; if ( png_decode_idat ( s , length ) < 0 )  