avcodec/scpr3: Check bx

Fixes: Out of array access Fixes: 55102/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-4877396618903552

Michael Niedermayer committed 3 years ago

Commit cc7e9841 parent 4d42d821 file · +3 −0Browse files

Unified · Split

@@ -1167,6 +1167,9 @@ static int decompress_p3(AVCodecContext *avctx, · 1166 unmodified lines
1167	1167	int run, bx = x * 16 + sx1, by = y * 16 + sy1;
1168	1168	uint32_t clr, ptype = 0, r, g, b;
1169	1169
	1170	+ if (bx >= avctx->width)
	1171	+ return AVERROR_INVALIDDATA;
	1172	+
1170	1173	for (; by < y * 16 + sy2 && by < avctx->height;) {
1171	1174	ret = decode_value3(s, 5, &s->op_model3[ptype].cntsum,
1172	1175	s->op_model3[ptype].freqs[0],

Keyboard shortcuts