diff options
| author | Paul B Mahol <onemda@gmail.com> | 2017-02-23 18:46:24 +0100 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2017-02-23 18:46:24 +0100 |
| commit | 95a5af446bd2180a6597828152a123e4a57662ba (patch) | |
| tree | 6998432c137c4a112c1d784e7ae42d00dcb25a7e /libavcodec/scpr.c | |
| parent | fd7af82c53ea8a2577ea8952d35fb158db594592 (diff) | |
avcodec/scpr: check that current row is in valid range
Stops writing out of dst array.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Diffstat (limited to 'libavcodec/scpr.c')
| -rw-r--r-- | libavcodec/scpr.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c index 73e7eedb77..319057c909 100644 --- a/libavcodec/scpr.c +++ b/libavcodec/scpr.c @@ -333,6 +333,9 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) switch (ptype) { case 0: while (run-- > 0) { + if (y >= avctx->height) + return AVERROR_INVALIDDATA; + dst[y * linesize + x] = clr; lx = x; ly = y; @@ -345,6 +348,9 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) break; case 1: while (run-- > 0) { + if (y >= avctx->height) + return AVERROR_INVALIDDATA; + dst[y * linesize + x] = dst[ly * linesize + lx]; lx = x; ly = y; @@ -358,6 +364,9 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) break; case 2: while (run-- > 0) { + if (y < 1 || y >= avctx->height) + return AVERROR_INVALIDDATA; + clr = dst[y * linesize + x + off + 1]; dst[y * linesize + x] = clr; lx = x; @@ -372,6 +381,10 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) case 4: while (run-- > 0) { uint8_t *odst = (uint8_t *)dst; + + if (y < 1 || y >= avctx->height) + return AVERROR_INVALIDDATA; + r = odst[(ly * linesize + lx) * 4] + odst[((y * linesize + x) + off) * 4 + 4] - odst[((y * linesize + x) + off) * 4]; @@ -394,6 +407,9 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) break; case 5: while (run-- > 0) { + if (y < 1 || y >= avctx->height) + return AVERROR_INVALIDDATA; + clr = dst[y * linesize + x + off]; dst[y * linesize + x] = clr; lx = x; |