From d71dfc087bce47197209a7e33640853cbb986775 Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Wed, 29 Aug 2018 23:11:45 +0200 Subject: [PATCH] avcodec/scpr: error out if run length is <= 0 --- libavcodec/scpr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c index d76148998b..965a3ed22f 100644 --- a/libavcodec/scpr.c +++ b/libavcodec/scpr.c @@ -334,6 +334,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) ret = decode_value(s, s->run_model[0], 256, 400, &run); if (ret < 0) return ret; + if (run <= 0) + return AVERROR_INVALIDDATA; clr = (b << 16) + (g << 8) + r; k += run; @@ -382,6 +384,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) ret = decode_value(s, s->run_model[ptype], 256, 400, &run); if (ret < 0) return ret; + if (run <= 0) + return AVERROR_INVALIDDATA; switch (ptype) { case 0: @@ -615,6 +619,8 @@ static int decompress_p(AVCodecContext *avctx, ret = decode_value(s, s->run_model[ptype], 256, 400, &run); if (ret < 0) return ret; + if (run <= 0) + return AVERROR_INVALIDDATA; switch (ptype) { case 0: