diff options
| author | Paul B Mahol <onemda@gmail.com> | 2018-08-29 23:11:45 +0200 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2018-08-29 23:11:45 +0200 |
| commit | d71dfc087bce47197209a7e33640853cbb986775 (patch) | |
| tree | d2adb13c4a2f4f5202163679c95776404f42bac8 /libavcodec/scpr.c | |
| parent | b205635fbc0893b092caabd9edc047d16e44da7e (diff) | |
avcodec/scpr: error out if run length is <= 0
Diffstat (limited to 'libavcodec/scpr.c')
| -rw-r--r-- | libavcodec/scpr.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c index d76148998b..965a3ed22f 100644 --- a/libavcodec/scpr.c +++ b/libavcodec/scpr.c @@ -334,6 +334,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) ret = decode_value(s, s->run_model[0], 256, 400, &run); if (ret < 0) return ret; + if (run <= 0) + return AVERROR_INVALIDDATA; clr = (b << 16) + (g << 8) + r; k += run; @@ -382,6 +384,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) ret = decode_value(s, s->run_model[ptype], 256, 400, &run); if (ret < 0) return ret; + if (run <= 0) + return AVERROR_INVALIDDATA; switch (ptype) { case 0: @@ -615,6 +619,8 @@ static int decompress_p(AVCodecContext *avctx, ret = decode_value(s, s->run_model[ptype], 256, 400, &run); if (ret < 0) return ret; + if (run <= 0) + return AVERROR_INVALIDDATA; switch (ptype) { case 0: |