X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fhcom.c;h=8300676f98a6519af81954e9fd2097a89dcadef5;hb=6026384047ab8e895d416aab4e2531bd87c0c01d;hp=bce9e80aa52b3fcdd036e6ef65807141a3f02a53;hpb=c2631dfd0a0a12050cc1765fd41702c5e93abee5;p=ffmpeg

diff --git a/libavcodec/hcom.c b/libavcodec/hcom.c
index bce9e80aa52..8300676f98a 100644
--- a/libavcodec/hcom.c
+++ b/libavcodec/hcom.c
@@ -52,7 +52,8 @@ static av_cold int hcom_init(AVCodecContext *avctx)
     if (avctx->extradata_size <= 7)
         return AVERROR_INVALIDDATA;
     s->dict_entries = AV_RB16(avctx->extradata);
-    if (avctx->extradata_size < s->dict_entries * 4 + 7)
+    if (avctx->extradata_size < s->dict_entries * 4 + 7 ||
+        s->dict_entries == 0)
         return AVERROR_INVALIDDATA;
     s->delta_compression = AV_RB32(avctx->extradata + 2);
     s->sample = s->first_sample = avctx->extradata[avctx->extradata_size - 1];
@@ -65,8 +66,15 @@ static av_cold int hcom_init(AVCodecContext *avctx)
         s->dict[i].r = AV_RB16(avctx->extradata + 6 + 4 * i + 2);
         if (s->dict[i].l >= 0 &&
             (s->dict[i].l >= s->dict_entries ||
-             s->dict[i].r >= s->dict_entries))
+             s->dict[i].r >= s->dict_entries ||
+             s->dict[i].r < 0 )) {
+            av_freep(&s->dict);
             return AVERROR_INVALIDDATA;
+        }
+    }
+    if (s->dict[0].l < 0) {
+        av_freep(&s->dict);
+        return AVERROR_INVALIDDATA;
     }
 
     avctx->sample_fmt = AV_SAMPLE_FMT_U8;