c->low <<= 1;
c->high <<= 1;
c->high |= 1;
+ if (get_bits_left(c->gbc.gb) < 1)
+ c->overread++;
c->value |= get_bits1(c->gbc.gb);
}
}
c->low = 0;
c->high = 0xFFFF;
c->value = get_bits(gb, 16);
+ c->overread = 0;
c->gbc.gb = gb;
c->get_model_sym = arith_get_model_sym;
c->get_number = arith_get_number;
{
int i, val, pix;
+ if (acoder->overread > MAX_OVERREAD)
+ return AVERROR_INVALIDDATA;
val = acoder->get_model_sym(acoder, &pctx->cache_model);
if (val < pctx->num_syms) {
if (any_ngb) {
else
p = decode_pixel_in_context(acoder, pctx, dst + i, stride,
i, j, width - i - 1);
+ if (p < 0)
+ return p;
dst[i] = p;
if (rgb_pic)
else
p = decode_pixel_in_context(acoder, pctx, dst + i, stride,
i, j, width - i - 1);
+ if (p < 0)
+ return p;
dst[i] = p;
if (c->rgb_pic)
AV_WB24(rgb_dst + i * 3, c->pal[p]);
uint8_t *rgb_dst = c->rgb_pic + x * 3 + y * rgb_stride;
pix = decode_pixel(acoder, &sc->intra_pix_ctx, NULL, 0, 0);
+ if (pix < 0)
+ return pix;
rgb_pix = c->pal[pix];
for (i = 0; i < height; i++, dst += stride, rgb_dst += rgb_stride) {
memset(dst, pix, width);
if (!mode) {
mode = decode_pixel(acoder, &sc->inter_pix_ctx, NULL, 0, 0);
+ if (mode < 0)
+ return mode;
if (c->avctx->err_recognition & AV_EF_EXPLODE &&
( c->rgb_pic && mode != 0x01 && mode != 0x02 && mode != 0x04 ||
int x, int y, int width, int height)
{
int mode, pivot;
+ if (acoder->overread > MAX_OVERREAD)
+ return AVERROR_INVALIDDATA;
mode = acoder->get_model_sym(acoder, &sc->split_mode);