Fixes: Out of array access Fixes: 55102/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SCPR_fuzzer-4877396618903552
Unified · Split
| @@ -1167,6 +1167,9 @@ static int decompress_p3(AVCodecContext *avctx, · 1166 unmodified lines | |||
| 1167 | int run, bx = x * 16 + sx1, by = y * 16 + sy1; | 1167 | int run, bx = x * 16 + sx1, by = y * 16 + sy1; |
| 1168 | uint32_t clr, ptype = 0, r, g, b; | 1168 | uint32_t clr, ptype = 0, r, g, b; |
| 1169 | 1169 | ||
| 1170 | if (bx >= avctx->width) | ||
| 1171 | return AVERROR_INVALIDDATA; | ||
| 1172 | |||
| 1170 | for (; by < y * 16 + sy2 && by < avctx->height;) { | 1173 | for (; by < y * 16 + sy2 && by < avctx->height;) { |
| 1171 | ret = decode_value3(s, 5, &s->op_model3[ptype].cntsum, | 1174 | ret = decode_value3(s, 5, &s->op_model3[ptype].cntsum, |
| 1172 | s->op_model3[ptype].freqs[0], | 1175 | s->op_model3[ptype].freqs[0], |