From fe7fbf3a2273b2f13c3190fcda58b9663b535157 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 19 Sep 2019 18:51:29 +0200
Subject: [PATCH] avcodec/jpeglsdec: Return error codes from ls_decode_line()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/jpeglsdec.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c
index 5308b744df..79f7fc1322 100644
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@@ -222,7 +222,7 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state,
 /**
  * Decode one line of image
  */
-static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s,
+static inline int ls_decode_line(JLSState *state, MJpegDecodeContext *s,
                                   void *last, void *dst, int last2, int w,
                                   int stride, int comp, int bits)
 {
@@ -234,7 +234,7 @@ static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s,
         int err, pred;
 
         if (get_bits_left(&s->gb) <= 0)
-            return;
+            return AVERROR_INVALIDDATA;
 
         /* compute gradients */
         Ra = x ? R(dst, x - stride) : R(last, x);
@@ -263,11 +263,11 @@ static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s,
                 }
                 /* if EOL reached, we stop decoding */
                 if (r != 1 << ff_log2_run[state->run_index[comp]])
-                    return;
+                    return 0;
                 if (state->run_index[comp] < 31)
                     state->run_index[comp]++;
                 if (x + stride > w)
-                    return;
+                    return 0;
             }
             /* decode aborted run */
             r = ff_log2_run[state->run_index[comp]];
@@ -284,7 +284,7 @@ static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s,
             if (x >= w) {
                 av_log(NULL, AV_LOG_ERROR, "run overflow\n");
                 av_assert0(x <= w);
-                return;
+                return AVERROR_INVALIDDATA;
             }
 
             /* decode run termination value */
@@ -341,6 +341,8 @@ static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s,
         W(dst, x, pred);
         x += stride;
     }
+
+    return 0;
 }
 
 int ff_jpegls_decode_picture(MJpegDecodeContext *s, int near,
@@ -407,13 +409,16 @@ int ff_jpegls_decode_picture(MJpegDecodeContext *s, int near,
         width  = s->width * stride;
         cur   += off;
         for (i = 0; i < s->height; i++) {
+            int ret;
             if (s->bits <= 8) {
-                ls_decode_line(state, s, last, cur, t, width, stride, off, 8);
+                ret = ls_decode_line(state, s, last, cur, t, width, stride, off, 8);
                 t = last[0];
             } else {
-                ls_decode_line(state, s, last, cur, t, width, stride, off, 16);
+                ret = ls_decode_line(state, s, last, cur, t, width, stride, off, 16);
                 t = *((uint16_t *)last);
             }
+            if (ret < 0)
+                break;
             last = cur;
             cur += s->picture_ptr->linesize[0];
 
@@ -429,9 +434,12 @@ int ff_jpegls_decode_picture(MJpegDecodeContext *s, int near,
         memset(cur, 0, s->picture_ptr->linesize[0]);
         width = s->width * stride;
         for (i = 0; i < s->height; i++) {
+            int ret;
             for (j = 0; j < stride; j++) {
-                ls_decode_line(state, s, last + j, cur + j,
+                ret = ls_decode_line(state, s, last + j, cur + j,
                                Rc[j], width, stride, j, 8);
+                if (ret < 0)
+                    break;
                 Rc[j] = last[j];
 
                 if (s->restart_interval && !--s->restart_count) {
@@ -439,6 +447,8 @@ int ff_jpegls_decode_picture(MJpegDecodeContext *s, int near,
                     skip_bits(&s->gb, 16); /* skip RSTn */
                 }
             }
+            if (ret < 0)
+                break;
             last = cur;
             cur += s->picture_ptr->linesize[0];
         }