X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fscpr.h;h=15cb87c464e687c9aeae08c7287da8e3aeed07a3;hb=d6fc5dc24aa09e026c6271a7565e63798dfe46f3;hp=e22188ab3a10d2ccb13e1993aa79f30d11f3ccda;hpb=20564d23fd931c7f7b55b878b5bcd60e24e0a739;p=ffmpeg

diff --git a/libavcodec/scpr.h b/libavcodec/scpr.h
index e22188ab3a1..15cb87c464e 100644
--- a/libavcodec/scpr.h
+++ b/libavcodec/scpr.h
@@ -89,12 +89,12 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
     uint32_t lx = *plx,
              ly = *ply;
 
+    if (y >= avctx->height)
+        return AVERROR_INVALIDDATA;
+
     switch (ptype) {
     case 0:
         while (run-- > 0) {
-            if (y >= avctx->height)
-                return AVERROR_INVALIDDATA;
-
             dst[y * linesize + x] = clr;
             lx = x;
             ly = y;
@@ -102,14 +102,13 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         break;
     case 1:
         while (run-- > 0) {
-            if (y >= avctx->height)
-                return AVERROR_INVALIDDATA;
-
             dst[y * linesize + x] = dst[ly * linesize + lx];
             lx = x;
             ly = y;
@@ -117,15 +116,17 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         clr = dst[ly * linesize + lx];
         break;
     case 2:
-        while (run-- > 0) {
-            if (y < 1 || y >= avctx->height)
-                return AVERROR_INVALIDDATA;
+        if (y < 1)
+            return AVERROR_INVALIDDATA;
 
+        while (run-- > 0) {
             clr = dst[y * linesize + x + off + 1];
             dst[y * linesize + x] = clr;
             lx = x;
@@ -134,19 +135,20 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         break;
     case 4:
+        if (y < 1 || (y == 1 && x == 0))
+            return AVERROR_INVALIDDATA;
+
         while (run-- > 0) {
             uint8_t *odst = (uint8_t *)dst;
             int off1 = (ly * linesize + lx) * 4;
             int off2 = ((y * linesize + x) + off) * 4;
 
-            if (y < 1 || y >= avctx->height ||
-                (y == 1 && x == 0))
-                return AVERROR_INVALIDDATA;
-
             if (x == 0) {
                 z = backstep * 4;
             } else {
@@ -170,15 +172,16 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         break;
     case 5:
-        while (run-- > 0) {
-            if (y < 1 || y >= avctx->height ||
-                (y == 1 && x == 0))
-                return AVERROR_INVALIDDATA;
+        if (y < 1 || (y == 1 && x == 0))
+            return AVERROR_INVALIDDATA;
 
+        while (run-- > 0) {
             if (x == 0) {
                 z = backstep;
             } else {
@@ -193,6 +196,8 @@ static int decode_run_i(AVCodecContext *avctx, uint32_t ptype, int run,
             if (x >= avctx->width) {
                 x = 0;
                 (y)++;
+                if (y >= avctx->height && run)
+                    return AVERROR_INVALIDDATA;
             }
         }
         break;