diff options
author | Paul B Mahol <onemda@gmail.com> | 2018-09-07 15:09:40 +0200 |
---|---|---|
committer | Paul B Mahol <onemda@gmail.com> | 2018-09-07 15:09:40 +0200 |
commit | cc24665f4479af6eb49c05033bf2d6fbae8c1f83 (patch) | |
tree | 1da6e3ad86ac25360f38291efbc7e739d134a331 /libavcodec/scpr.c | |
parent | 70a708713ad20198d909087d99a429bb1262c0a9 (diff) |
avcodec/scpr: make sure count and min are valid
Diffstat (limited to 'libavcodec/scpr.c')
-rw-r--r-- | libavcodec/scpr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c index ee6bf21b71..f1584355c0 100644 --- a/libavcodec/scpr.c +++ b/libavcodec/scpr.c @@ -529,7 +529,7 @@ static int decompress_p(AVCodecContext *avctx, return ret; max += temp << 8; - if (min > max) + if (min > max || min >= s->nbcount) return AVERROR_INVALIDDATA; memset(s->blocks, 0, sizeof(*s->blocks) * s->nbcount); @@ -541,6 +541,8 @@ static int decompress_p(AVCodecContext *avctx, ret |= decode_value(s, s->count_model, 256, 20, &count); if (ret < 0) return ret; + if (count <= 0) + return AVERROR_INVALIDDATA; while (min < s->nbcount && count-- > 0) { s->blocks[min++] = fill; |