X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fscpr.h;h=15cb87c464e687c9aeae08c7287da8e3aeed07a3;hb=c31ba86c37d6caeed6983343b22e8dbc99dce3cf;hp=bb9b4d6a9bbcc434a4a968bcb2ef6ebf75f56298;hpb=609e2e64f6e0b348ce861ccd8d17c7a7651b9157;p=ffmpeg

diff --git a/libavcodec/scpr.h b/libavcodec/scpr.h
index bb9b4d6a9bb..15cb87c464e 100644
--- a/libavcodec/scpr.h
+++ b/libavcodec/scpr.h
@@ -89,12 +89,12 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
     uint32_t lx = *plx,
              ly = *ply;
 
+    if (y >= avctx->height)
+        return AVERROR_INVALIDDATA;
+
     switch (ptype) {
     case 0:
         while (run-- > 0) {
-            if (y >= avctx->height)
-                return AVERROR_INVALIDDATA;
-
             dst[y * linesize + x] = clr;
             lx = x;
             ly = y;
@@ -102,14 +102,13 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         break;
     case 1:
         while (run-- > 0) {
-            if (y >= avctx->height)
-                return AVERROR_INVALIDDATA;
-
             dst[y * linesize + x] = dst[ly * linesize + lx];
             lx = x;
             ly = y;
@@ -117,15 +116,17 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         clr = dst[ly * linesize + lx];
         break;
     case 2:
-        while (run-- > 0) {
-            if (y < 1 || y >= avctx->height)
-                return AVERROR_INVALIDDATA;
+        if (y < 1)
+            return AVERROR_INVALIDDATA;
 
+        while (run-- > 0) {
             clr = dst[y * linesize + x + off + 1];
             dst[y * linesize + x] = clr;
             lx = x;
@@ -134,32 +135,35 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         break;
     case 4:
+        if (y < 1 || (y == 1 && x == 0))
+            return AVERROR_INVALIDDATA;
+
         while (run-- > 0) {
             uint8_t *odst = (uint8_t *)dst;
-
-            if (y < 1 || y >= avctx->height ||
-                (y == 1 && x == 0))
-                return AVERROR_INVALIDDATA;
+            int off1 = (ly * linesize + lx) * 4;
+            int off2 = ((y * linesize + x) + off) * 4;
 
             if (x == 0) {
-                z = backstep;
+                z = backstep * 4;
             } else {
                 z = 0;
             }
 
-            r = odst[(ly * linesize + lx) * 4] +
-                odst[((y * linesize + x) + off) * 4 + 4] -
-                odst[((y * linesize + x) + off - z) * 4];
-            g = odst[(ly * linesize + lx) * 4 + 1] +
-                odst[((y * linesize + x) + off) * 4 + 5] -
-                odst[((y * linesize + x) + off - z) * 4 + 1];
-            b = odst[(ly * linesize + lx) * 4 + 2] +
-                odst[((y * linesize + x) + off) * 4 + 6] -
-                odst[((y * linesize + x) + off - z) * 4 + 2];
+            r = odst[off1] +
+                odst[off2 + 4] -
+                odst[off2 - z ];
+            g = odst[off1 + 1] +
+                odst[off2 + 5] -
+                odst[off2 - z  + 1];
+            b = odst[off1 + 2] +
+                odst[off2 + 6] -
+                odst[off2 - z  + 2];
             clr = ((b & 0xFF) << 16) + ((g & 0xFF) << 8) + (r & 0xFF);
             dst[y * linesize + x] = clr;
             lx = x;
@@ -168,15 +172,16 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         break;
     case 5:
-        while (run-- > 0) {
-            if (y < 1 || y >= avctx->height ||
-                (y == 1 && x == 0))
-                return AVERROR_INVALIDDATA;
+        if (y < 1 || (y == 1 && x == 0))
+            return AVERROR_INVALIDDATA;
 
+        while (run-- > 0) {
             if (x == 0) {
                 z = backstep;
             } else {
@@ -191,6 +196,8 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         break;