X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fhcom.c;h=1c49988b3a0dd308e10a7353e4ca7ad3dae7b6b1;hb=e5af9203098a889f36b759652615046254d45102;hp=8753486c02f5d04266abe7596c25dac3022e523e;hpb=ebdc5c419aef0d9eed8c1ec57b30238194c1db0a;p=ffmpeg

diff --git a/libavcodec/hcom.c b/libavcodec/hcom.c
index 8753486c02f..1c49988b3a0 100644
--- a/libavcodec/hcom.c
+++ b/libavcodec/hcom.c
@@ -52,7 +52,8 @@ static av_cold int hcom_init(AVCodecContext *avctx)
     if (avctx->extradata_size <= 7)
         return AVERROR_INVALIDDATA;
     s->dict_entries = AV_RB16(avctx->extradata);
-    if (avctx->extradata_size < s->dict_entries * 4 + 7)
+    if (avctx->extradata_size < s->dict_entries * 4 + 7 ||
+        s->dict_entries == 0)
         return AVERROR_INVALIDDATA;
     s->delta_compression = AV_RB32(avctx->extradata + 2);
     s->sample = s->first_sample = avctx->extradata[avctx->extradata_size - 1];
@@ -63,7 +64,14 @@ static av_cold int hcom_init(AVCodecContext *avctx)
     for (int i = 0; i < s->dict_entries; i++) {
         s->dict[i].l = AV_RB16(avctx->extradata + 6 + 4 * i);
         s->dict[i].r = AV_RB16(avctx->extradata + 6 + 4 * i + 2);
+        if (s->dict[i].l >= 0 &&
+            (s->dict[i].l >= s->dict_entries ||
+             s->dict[i].r >= s->dict_entries ||
+             s->dict[i].r < 0 ))
+            return AVERROR_INVALIDDATA;
     }
+    if (s->dict[0].l < 0)
+        return AVERROR_INVALIDDATA;
 
     avctx->sample_fmt = AV_SAMPLE_FMT_U8;
     s->dict_entry = 0;
@@ -126,7 +134,7 @@ static av_cold int hcom_close(AVCodecContext *avctx)
     return 0;
 }
 
-AVCodec ff_hcom_decoder = {
+const AVCodec ff_hcom_decoder = {
     .name           = "hcom",
     .long_name      = NULL_IF_CONFIG_SMALL("HCOM Audio"),
     .type           = AVMEDIA_TYPE_AUDIO,
@@ -136,4 +144,5 @@ AVCodec ff_hcom_decoder = {
     .close          = hcom_close,
     .decode         = hcom_decode,
     .capabilities   = AV_CODEC_CAP_DR1,
+    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
 };