X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Frasc.c;h=207d50c4524e6ba305dd41dfa08baa483767631b;hb=b06082d1d5d6eeed5f477456beba087dcf9432bc;hp=21fc43f325c761a8f0fec0cd5b87d9baaa75f9e4;hpb=ac4b5d86222006fa71ffe5922e1a34f1422507d8;p=ffmpeg

diff --git a/libavcodec/rasc.c b/libavcodec/rasc.c
index 21fc43f325c..207d50c4524 100644
--- a/libavcodec/rasc.c
+++ b/libavcodec/rasc.c
@@ -70,6 +70,9 @@ static void clear_plane(AVCodecContext *avctx, AVFrame *frame)
     RASCContext *s = avctx->priv_data;
     uint8_t *dst = frame->data[0];
 
+    if (!dst)
+        return;
+
     for (int y = 0; y < avctx->height; y++) {
         memset(dst, 0, avctx->width * s->bpp);
         dst += frame->linesize[0];
@@ -109,7 +112,7 @@ static int init_frames(AVCodecContext *avctx)
 }
 
 static int decode_fint(AVCodecContext *avctx,
-                       AVPacket *avpkt, unsigned size)
+                       const AVPacket *avpkt, unsigned size)
 {
     RASCContext *s = avctx->priv_data;
     GetByteContext *gb = &s->gb;
@@ -124,6 +127,8 @@ static int decode_fint(AVCodecContext *avctx,
         clear_plane(avctx, s->frame1);
         return 0;
     }
+    if (bytestream2_get_bytes_left(gb) < 72)
+        return AVERROR_INVALIDDATA;
 
     bytestream2_skip(gb, 8);
     w = bytestream2_get_le32(gb);
@@ -166,7 +171,7 @@ static int decode_fint(AVCodecContext *avctx,
     return 0;
 }
 
-static int decode_zlib(AVCodecContext *avctx, AVPacket *avpkt,
+static int decode_zlib(AVCodecContext *avctx, const AVPacket *avpkt,
                        unsigned size, unsigned uncompressed_size)
 {
     RASCContext *s = avctx->priv_data;
@@ -200,7 +205,7 @@ static int decode_zlib(AVCodecContext *avctx, AVPacket *avpkt,
 }
 
 static int decode_move(AVCodecContext *avctx,
-                       AVPacket *avpkt, unsigned size)
+                       const AVPacket *avpkt, unsigned size)
 {
     RASCContext *s = avctx->priv_data;
     GetByteContext *gb = &s->gb;
@@ -324,7 +329,7 @@ static int decode_move(AVCodecContext *avctx,
     len--;
 
 static int decode_dlta(AVCodecContext *avctx,
-                       AVPacket *avpkt, unsigned size)
+                       const AVPacket *avpkt, unsigned size)
 {
     RASCContext *s = avctx->priv_data;
     GetByteContext *gb = &s->gb;
@@ -466,7 +471,7 @@ static int decode_dlta(AVCodecContext *avctx,
 }
 
 static int decode_kfrm(AVCodecContext *avctx,
-                       AVPacket *avpkt, unsigned size)
+                       const AVPacket *avpkt, unsigned size)
 {
     RASCContext *s = avctx->priv_data;
     GetByteContext *gb = &s->gb;
@@ -529,7 +534,7 @@ static int decode_kfrm(AVCodecContext *avctx,
 }
 
 static int decode_mous(AVCodecContext *avctx,
-                       AVPacket *avpkt, unsigned size)
+                       const AVPacket *avpkt, unsigned size)
 {
     RASCContext *s = avctx->priv_data;
     GetByteContext *gb = &s->gb;
@@ -569,7 +574,7 @@ static int decode_mous(AVCodecContext *avctx,
 }
 
 static int decode_mpos(AVCodecContext *avctx,
-                       AVPacket *avpkt, unsigned size)
+                       const AVPacket *avpkt, unsigned size)
 {
     RASCContext *s = avctx->priv_data;
     GetByteContext *gb = &s->gb;