dequant_shift[qp], i)) < 0)
return ret;
h->cdsp.cavs_idct8_add(dst, block, stride);
- h->dsp.clear_block(block);
+ h->bdsp.clear_block(block);
return 0;
}
/* get coded block pattern */
int cbp = get_ue_golomb(&h->gb);
- if (cbp > 63) {
- av_log(h->avctx, AV_LOG_ERROR, "illegal inter cbp\n");
+ if (cbp > 63 || cbp < 0) {
+ av_log(h->avctx, AV_LOG_ERROR, "illegal inter cbp %d\n", cbp);
return AVERROR_INVALIDDATA;
}
h->cbp = cbp_tab[cbp][1];
/* get coded block pattern */
if (h->cur.f->pict_type == AV_PICTURE_TYPE_I)
cbp_code = get_ue_golomb(gb);
- if (cbp_code > 63) {
+ if (cbp_code > 63 || cbp_code < 0) {
av_log(h->avctx, AV_LOG_ERROR, "illegal intra cbp\n");
return AVERROR_INVALIDDATA;
}
static int decode_pic(AVSContext *h)
{
+ int ret;
int skip_count = -1;
enum cavs_mb mb_type;
skip_bits(&h->gb, 1); //marker_bit
}
- ff_get_buffer(h->avctx, h->cur.f, h->cur.f->pict_type == AV_PICTURE_TYPE_B ?
- 0 : AV_GET_BUFFER_FLAG_REF);
+ ret = ff_get_buffer(h->avctx, h->cur.f, h->cur.f->pict_type == AV_PICTURE_TYPE_B ?
+ 0 : AV_GET_BUFFER_FLAG_REF);
+ if (ret < 0)
+ return ret;
if (!h->edge_emu_buffer) {
int alloc_size = FFALIGN(FFABS(h->cur.f->linesize[0]) + 32, 32);