Skip to content

F
ffmpeg.wasm-core
Commit d71dfc08 authored by Paul B Mahol's avatar Paul B Mahol
Browse files
Options

avcodec/scpr: error out if run length is <= 0

parent b205635f
Hide whitespace changes
Inline Side-by-side
Showing with 6 additions and 0 deletions
libavcodec/scpr.c
View file @ d71dfc08
...@@ -334,6 +334,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) ...@@ -334,6 +334,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
ret = decode_value(s, s->run_model[0], 256, 400, &run); ret = decode_value(s, s->run_model[0], 256, 400, &run);
if (ret < 0) if (ret < 0)
return ret; return ret;
if (run <= 0)
return AVERROR_INVALIDDATA;
clr = (b << 16) + (g << 8) + r; clr = (b << 16) + (g << 8) + r;
k += run; k += run;
...@@ -382,6 +384,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize) ...@@ -382,6 +384,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
ret = decode_value(s, s->run_model[ptype], 256, 400, &run); ret = decode_value(s, s->run_model[ptype], 256, 400, &run);
if (ret < 0) if (ret < 0)
return ret; return ret;
if (run <= 0)
return AVERROR_INVALIDDATA;
switch (ptype) { switch (ptype) {
case 0: case 0:
...@@ -615,6 +619,8 @@ static int decompress_p(AVCodecContext *avctx, ...@@ -615,6 +619,8 @@ static int decompress_p(AVCodecContext *avctx,
ret = decode_value(s, s->run_model[ptype], 256, 400, &run); ret = decode_value(s, s->run_model[ptype], 256, 400, &run);
if (ret < 0) if (ret < 0)
return ret; return ret;
if (run <= 0)
return AVERROR_INVALIDDATA;
switch (ptype) { switch (ptype) {
case 0: case 0:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment