[FFmpeg-cvslog] avcodec/scpr: error out if run length is <= 0

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Wed Aug 29 23:11:45 2018 +0200| [d71dfc087bce47197209a7e33640853cbb986775] | committer: Paul B Mahol

avcodec/scpr: error out if run length is <= 0

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d71dfc087bce47197209a7e33640853cbb986775
---

 libavcodec/scpr.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c
index d76148998b..965a3ed22f 100644
--- a/libavcodec/scpr.c
+++ b/libavcodec/scpr.c
@@ -334,6 +334,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
         ret = decode_value(s, s->run_model[0], 256, 400, &run);
         if (ret < 0)
             return ret;
+        if (run <= 0)
+            return AVERROR_INVALIDDATA;
 
         clr = (b << 16) + (g << 8) + r;
         k += run;
@@ -382,6 +384,8 @@ static int decompress_i(AVCodecContext *avctx, uint32_t *dst, int linesize)
         ret = decode_value(s, s->run_model[ptype], 256, 400, &run);
         if (ret < 0)
             return ret;
+        if (run <= 0)
+            return AVERROR_INVALIDDATA;
 
         switch (ptype) {
         case 0:
@@ -615,6 +619,8 @@ static int decompress_p(AVCodecContext *avctx,
                     ret = decode_value(s, s->run_model[ptype], 256, 400, &run);
                     if (ret < 0)
                         return ret;
+                    if (run <= 0)
+                        return AVERROR_INVALIDDATA;
 
                     switch (ptype) {
                     case 0: