}
p = (e + 127) >> 7;
k = ((f + e - 1) >> 7) + 1;
+ if (k > FF_ARRAY_ELEMS(n.dectab))
+ return AVERROR_INVALIDDATA;
for (i = 0; i < k - p; i++)
n.dectab[p + i] = j;
e += f;
e = d;
n.cntsum += n.cnts[e];
n.freqs1[e] = c;
- for (g = n.freqs[e], q = c + 128 - 1 >> 7, f = (c + g - 1 >> 7) + 1; q < f; q++) {
+ g = n.freqs[e];
+ f = (c + g - 1 >> 7) + 1;
+ if (f > FF_ARRAY_ELEMS(n.dectab))
+ return AVERROR_INVALIDDATA;
+ for (q = c + 128 - 1 >> 7; q < f; q++) {
n.dectab[q] = e;
}
c += g;
uint16_t a = 0, b = 0;
uint32_t param;
int type;
+ int ret;
type = m->type;
switch (type) {
break;
case 3:
*value = bytestream2_get_byte(&s->gb);
- decode_static3(m, *value);
+ ret = decode_static3(m, *value);
+ if (ret < 0)
+ return AVERROR_INVALIDDATA;
sync_code3(gb, rc);
break;
case 4:
break;
case 6:
if (!decode_adaptive6(m, code, value, &a, &b)) {
- update_model6_to_7(m);
+ ret = update_model6_to_7(m);
+ if (ret < 0)
+ return AVERROR_INVALIDDATA;
}
decode3(gb, rc, a, b);
sync_code3(gb, rc);
ret = decode_run_i(avctx, ptype, run, &x, &y, clr,
dst, linesize, &lx, &ly,
backstep, off, &cx, &cx1);
- if (run < 0)
+ if (ret < 0)
return ret;
}
s->range_model3.freqs[1],
s->range_model3.cnts,
s->range_model3.dectab, &temp);
+ if (ret < 0)
+ return ret;
+
min += temp << 8;
ret |= decode_value3(s, 255, &s->range_model3.cntsum,
s->range_model3.freqs[0],
}
}
+ ret = av_frame_copy(s->current_frame, s->last_frame);
+ if (ret < 0)
+ return ret;
+
for (y = 0; y < s->nby; y++) {
for (x = 0; x < s->nbx; x++) {
int sy1 = 0, sy2 = 16, sx1 = 0, sx2 = 16;