ffmpeg | branch: master | Paul B Mahol <one...@gmail.com> | Wed Aug 29 23:11:45 2018 +0200| [d71dfc087bce47197209a7e33640853cbb986775] | committer: Paul B Mahol
avcodec/scpr: error out if run length is <= 0 > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d71dfc087bce47197209a7e33640853cbb986775 --- libavcodec/scpr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c index d76148998b..965a3ed22f 100644 --- a/libavcodec/scpr.c +++ b/libavcodec/scpr.c @@ -334,6 +334,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) ret = decode_value(s, s->run_model[0], 256, 400, &run); if (ret < 0) return ret; + if (run <= 0) + return AVERROR_INVALIDDATA; clr = (b << 16) + (g << 8) + r; k += run; @@ -382,6 +384,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) ret = decode_value(s, s->run_model[ptype], 256, 400, &run); if (ret < 0) return ret; + if (run <= 0) + return AVERROR_INVALIDDATA; switch (ptype) { case 0: @@ -615,6 +619,8 @@ static int decompress_p(AVCodecContext *avctx, ret = decode_value(s, s->run_model[ptype], 256, 400, &run); if (ret < 0) return ret; + if (run <= 0) + return AVERROR_INVALIDDATA; switch (ptype) { case 0: _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
