X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fscpr.c;h=2a0ebcecfcd3938d3ea40f2c97cc2fbccb6a6f1c;hb=f66ac83c22d8c088832ce8df922b08a0caa11833;hp=ce614ffacff9c2f51408209e0f0075ba64cfaf6e;hpb=e645d7a6d452df83cedcbb1d6708429ceea156da;p=ffmpeg

diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c
index ce614ffacff..2a0ebcecfcd 100644
--- a/libavcodec/scpr.c
+++ b/libavcodec/scpr.c
@@ -359,7 +359,7 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
         ret = decode_run_i(avctx, ptype, run, &x, &y, clr,
                            dst, linesize, &lx, &ly,
                            backstep, off, &cx, &cx1);
-        if (run < 0)
+        if (ret < 0)
             return ret;
     }
 
@@ -504,7 +504,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             return ret;
     }
 
-    if ((ret = ff_reget_buffer(avctx, s->current_frame)) < 0)
+    if ((ret = ff_reget_buffer(avctx, s->current_frame, 0)) < 0)
         return ret;
 
     bytestream2_init(gb, avpkt->data, avpkt->size);
@@ -532,7 +532,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
                             s->current_frame->linesize[0] / 4);
     } else if (type == 17 || type == 33) {
         uint32_t clr, *dst = (uint32_t *)s->current_frame->data[0];
-        int x, y;
+        int y;
+
+        if (bytestream2_get_bytes_left(gb) < 3)
+            return AVERROR_INVALIDDATA;
 
         frame->key_frame = 1;
         bytestream2_skip(gb, 1);
@@ -548,9 +551,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             clr = bytestream2_get_le24(gb);
         }
         for (y = 0; y < avctx->height; y++) {
-            for (x = 0; x < avctx->width; x++) {
-                dst[x] = clr;
-            }
+            dst[0] = clr;
+            av_memcpy_backptr((uint8_t*)(dst+1), 4, 4*avctx->width - 4);
             dst += s->current_frame->linesize[0] / 4;
         }
     } else if (type == 0 || type == 1) {
@@ -575,6 +577,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     if (ret < 0)
         return ret;
 
+    if (bytestream2_get_bytes_left(gb) > 5)
+        return AVERROR_INVALIDDATA;
+
     if (avctx->bits_per_coded_sample != 16) {
         ret = av_frame_ref(data, s->current_frame);
         if (ret < 0)