if (avctx->extradata_size <= 7)
return AVERROR_INVALIDDATA;
s->dict_entries = AV_RB16(avctx->extradata);
- if (avctx->extradata_size < s->dict_entries * 4 + 7)
+ if (avctx->extradata_size < s->dict_entries * 4 + 7 ||
+ s->dict_entries == 0)
return AVERROR_INVALIDDATA;
s->delta_compression = AV_RB32(avctx->extradata + 2);
s->sample = s->first_sample = avctx->extradata[avctx->extradata_size - 1];
for (int i = 0; i < s->dict_entries; i++) {
s->dict[i].l = AV_RB16(avctx->extradata + 6 + 4 * i);
s->dict[i].r = AV_RB16(avctx->extradata + 6 + 4 * i + 2);
+ if (s->dict[i].l >= 0 &&
+ (s->dict[i].l >= s->dict_entries ||
+ s->dict[i].r >= s->dict_entries ||
+ s->dict[i].r < 0 ))
+ return AVERROR_INVALIDDATA;
}
+ if (s->dict[0].l < 0)
+ return AVERROR_INVALIDDATA;
avctx->sample_fmt = AV_SAMPLE_FMT_U8;
s->dict_entry = 0;
.close = hcom_close,
.decode = hcom_decode,
.capabilities = AV_CODEC_CAP_DR1,
+ .caps_internal = FF_CODEC_CAP_INIT_CLEANUP,
};