X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fscpr.c;h=2a0ebcecfcd3938d3ea40f2c97cc2fbccb6a6f1c;hb=2d90d51c561c2e4c36a00d1ba666adee5028663c;hp=750cf59fe49ee38e8c72e5e87abe1f2717185b37;hpb=29929fc8e2449d2db8bd144b2badc8d1e6347412;p=ffmpeg

diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c
index 750cf59fe49..2a0ebcecfcd 100644
--- a/libavcodec/scpr.c
+++ b/libavcodec/scpr.c
@@ -359,7 +359,7 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
         ret = decode_run_i(avctx, ptype, run, &x, &y, clr,
                            dst, linesize, &lx, &ly,
                            backstep, off, &cx, &cx1);
-        if (run < 0)
+        if (ret < 0)
             return ret;
     }
 
@@ -382,8 +382,11 @@ static int decompress_p(AVCodecContext *avctx,
 
     ret  = decode_value(s, s->range_model, 256, 1, &min);
     ret |= decode_value(s, s->range_model, 256, 1, &temp);
+    if (ret < 0)
+        return ret;
+
     min += temp << 8;
-    ret |= decode_value(s, s->range_model, 256, 1, &max);
+    ret  = decode_value(s, s->range_model, 256, 1, &max);
     ret |= decode_value(s, s->range_model, 256, 1, &temp);
     if (ret < 0)
         return ret;
@@ -409,6 +412,10 @@ static int decompress_p(AVCodecContext *avctx,
         }
     }
 
+    ret = av_frame_copy(s->current_frame, s->last_frame);
+    if (ret < 0)
+        return ret;
+
     for (y = 0; y < s->nby; y++) {
         for (x = 0; x < s->nbx; x++) {
             int sy1 = 0, sy2 = 16, sx1 = 0, sx2 = 16;
@@ -497,7 +504,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             return ret;
     }
 
-    if ((ret = ff_reget_buffer(avctx, s->current_frame)) < 0)
+    if ((ret = ff_reget_buffer(avctx, s->current_frame, 0)) < 0)
         return ret;
 
     bytestream2_init(gb, avpkt->data, avpkt->size);
@@ -525,7 +532,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
                             s->current_frame->linesize[0] / 4);
     } else if (type == 17 || type == 33) {
         uint32_t clr, *dst = (uint32_t *)s->current_frame->data[0];
-        int x, y;
+        int y;
+
+        if (bytestream2_get_bytes_left(gb) < 3)
+            return AVERROR_INVALIDDATA;
 
         frame->key_frame = 1;
         bytestream2_skip(gb, 1);
@@ -541,18 +551,13 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             clr = bytestream2_get_le24(gb);
         }
         for (y = 0; y < avctx->height; y++) {
-            for (x = 0; x < avctx->width; x++) {
-                dst[x] = clr;
-            }
+            dst[0] = clr;
+            av_memcpy_backptr((uint8_t*)(dst+1), 4, 4*avctx->width - 4);
             dst += s->current_frame->linesize[0] / 4;
         }
     } else if (type == 0 || type == 1) {
         frame->key_frame = 0;
 
-        ret = av_frame_copy(s->current_frame, s->last_frame);
-        if (ret < 0)
-            return ret;
-
         if (s->version == 1 || s->version == 2)
             ret = decompress_p(avctx, (uint32_t *)s->current_frame->data[0],
                                s->current_frame->linesize[0] / 4,
@@ -572,6 +577,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     if (ret < 0)
         return ret;
 
+    if (bytestream2_get_bytes_left(gb) > 5)
+        return AVERROR_INVALIDDATA;
+
     if (avctx->bits_per_coded_sample != 16) {
         ret = av_frame_ref(data, s->current_frame);
         if (ret < 0)