if (avctx->extradata_size <= 7)
return AVERROR_INVALIDDATA;
s->dict_entries = AV_RB16(avctx->extradata);
- if (avctx->extradata_size < s->dict_entries * 4 + 7)
+ if (avctx->extradata_size < s->dict_entries * 4 + 7 ||
+ s->dict_entries == 0)
return AVERROR_INVALIDDATA;
s->delta_compression = AV_RB32(avctx->extradata + 2);
s->sample = s->first_sample = avctx->extradata[avctx->extradata_size - 1];
for (int i = 0; i < s->dict_entries; i++) {
s->dict[i].l = AV_RB16(avctx->extradata + 6 + 4 * i);
s->dict[i].r = AV_RB16(avctx->extradata + 6 + 4 * i + 2);
+ if (s->dict[i].l >= 0 &&
+ (s->dict[i].l >= s->dict_entries ||
+ s->dict[i].r >= s->dict_entries ||
+ s->dict[i].r < 0 )) {
+ av_freep(&s->dict);
+ return AVERROR_INVALIDDATA;
+ }
+ }
+ if (s->dict[0].l < 0) {
+ av_freep(&s->dict);
+ return AVERROR_INVALIDDATA;
}
avctx->sample_fmt = AV_SAMPLE_FMT_U8;