X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fscpr.c;h=ba6e849c66ee60d57ee6f434af2bda7ef67711ce;hb=90262f3fb4afe4b903888e45cc40e2116cb69683;hp=cf511f83ccc8f4d1d9a25e7cb1d24e77adc58bf7;hpb=0a319bcce5714f7183b0537892f7d37d7a31493a;p=ffmpeg

diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c
index cf511f83ccc..ba6e849c66e 100644
--- a/libavcodec/scpr.c
+++ b/libavcodec/scpr.c
@@ -359,7 +359,7 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
         ret = decode_run_i(avctx, ptype, run, &x, &y, clr,
                            dst, linesize, &lx, &ly,
                            backstep, off, &cx, &cx1);
-        if (run < 0)
+        if (ret < 0)
             return ret;
     }
 
@@ -372,7 +372,7 @@ static int decompress_p(AVCodecContext *avctx,
 {
     SCPRContext *s = avctx->priv_data;
     GetByteContext *gb = &s->gb;
-    int ret, temp, min, max, x, y, cx = 0, cx1 = 0;
+    int ret, temp = 0, min, max, x, y, cx = 0, cx1 = 0;
     int backstep = linesize - avctx->width;
 
     if (bytestream2_get_byte(gb) == 0)
@@ -382,8 +382,11 @@ static int decompress_p(AVCodecContext *avctx,
 
     ret  = decode_value(s, s->range_model, 256, 1, &min);
     ret |= decode_value(s, s->range_model, 256, 1, &temp);
+    if (ret < 0)
+        return ret;
+
     min += temp << 8;
-    ret |= decode_value(s, s->range_model, 256, 1, &max);
+    ret  = decode_value(s, s->range_model, 256, 1, &max);
     ret |= decode_value(s, s->range_model, 256, 1, &temp);
     if (ret < 0)
         return ret;
@@ -409,6 +412,10 @@ static int decompress_p(AVCodecContext *avctx,
         }
     }
 
+    ret = av_frame_copy(s->current_frame, s->last_frame);
+    if (ret < 0)
+        return ret;
+
     for (y = 0; y < s->nby; y++) {
         for (x = 0; x < s->nbx; x++) {
             int sy1 = 0, sy2 = 16, sx1 = 0, sx2 = 16;
@@ -497,7 +504,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             return ret;
     }
 
-    if ((ret = ff_reget_buffer(avctx, s->current_frame)) < 0)
+    if ((ret = ff_reget_buffer(avctx, s->current_frame, 0)) < 0)
         return ret;
 
     bytestream2_init(gb, avpkt->data, avpkt->size);
@@ -525,7 +532,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
                             s->current_frame->linesize[0] / 4);
     } else if (type == 17 || type == 33) {
         uint32_t clr, *dst = (uint32_t *)s->current_frame->data[0];
-        int x, y;
+        int y;
+
+        if (bytestream2_get_bytes_left(gb) < 3)
+            return AVERROR_INVALIDDATA;
 
         frame->key_frame = 1;
         bytestream2_skip(gb, 1);
@@ -541,18 +551,13 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             clr = bytestream2_get_le24(gb);
         }
         for (y = 0; y < avctx->height; y++) {
-            for (x = 0; x < avctx->width; x++) {
-                dst[x] = clr;
-            }
+            dst[0] = clr;
+            av_memcpy_backptr((uint8_t*)(dst+1), 4, 4*avctx->width - 4);
             dst += s->current_frame->linesize[0] / 4;
         }
     } else if (type == 0 || type == 1) {
         frame->key_frame = 0;
 
-        ret = av_frame_copy(s->current_frame, s->last_frame);
-        if (ret < 0)
-            return ret;
-
         if (s->version == 1 || s->version == 2)
             ret = decompress_p(avctx, (uint32_t *)s->current_frame->data[0],
                                s->current_frame->linesize[0] / 4,
@@ -572,6 +577,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     if (ret < 0)
         return ret;
 
+    if (bytestream2_get_bytes_left(gb) > 5)
+        return AVERROR_INVALIDDATA;
+
     if (avctx->bits_per_coded_sample != 16) {
         ret = av_frame_ref(data, s->current_frame);
         if (ret < 0)
@@ -659,7 +667,7 @@ static av_cold int decode_close(AVCodecContext *avctx)
     return 0;
 }
 
-AVCodec ff_scpr_decoder = {
+const AVCodec ff_scpr_decoder = {
     .name             = "scpr",
     .long_name        = NULL_IF_CONFIG_SMALL("ScreenPressor"),
     .type             = AVMEDIA_TYPE_VIDEO,