virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-28 20:53:54 +02:00
Code Issues Releases Activity

avcodec/scpr: check that current row is in valid range

Browse Source 
Stops writing out of dst array.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
This commit is contained in:
Paul B Mahol 2017-02-23 18:46:24 +01:00
parent fd7af82c53
commit 95a5af446b
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
libavcodec/scpr.c
View File

@ -333,6 +333,9 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
switch (ptype) {
case 0:
while (run-- > 0) {
if (y >= avctx->height)
return AVERROR_INVALIDDATA;
dst[y * linesize + x] = clr;
lx = x;
ly = y;
@ -345,6 +348,9 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
break;
case 1:
while (run-- > 0) {
if (y >= avctx->height)
return AVERROR_INVALIDDATA;
dst[y * linesize + x] = dst[ly * linesize + lx];
lx = x;
ly = y;
@ -358,6 +364,9 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
break;
case 2:
while (run-- > 0) {
if (y < 1 || y >= avctx->height)
return AVERROR_INVALIDDATA;
clr = dst[y * linesize + x + off + 1];
dst[y * linesize + x] = clr;
lx = x;
@ -372,6 +381,10 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
case 4:
while (run-- > 0) {
uint8_t *odst = (uint8_t *)dst;
if (y < 1 || y >= avctx->height)
return AVERROR_INVALIDDATA;
r = odst[(ly * linesize + lx) * 4] +
odst[((y * linesize + x) + off) * 4 + 4] -
odst[((y * linesize + x) + off) * 4];
@ -394,6 +407,9 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
break;
case 5:
while (run-- > 0) {
if (y < 1 || y >= avctx->height)
return AVERROR_INVALIDDATA;
clr = dst[y * linesize + x + off];
dst[y * linesize + x] = clr;
lx = x;