[FFmpeg-cvslog] avcodec/scpr: Fix reading a pixel before the first

[Michael Niedermayer]

ffmpeg | branch: release/3.3 | Michael Niedermayer <michael at niedermayer.cc> | Sat Feb  3 18:49:07 2018 +0100| [55e6c6b5feb7e2a9110fab1dc06ced23360b14e2] | committer: Michael Niedermayer

avcodec/scpr: Fix reading a pixel before the first

Fixes: 5540/clusterfuzz-testcase-minimized-6122458273808384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 0fb33a82890753233225c61863fff1fcc9d970d4)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=55e6c6b5feb7e2a9110fab1dc06ced23360b14e2
---

 libavcodec/scpr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c
index 78a6d5c0cd..694450abf0 100644
--- a/libavcodec/scpr.c
+++ b/libavcodec/scpr.c
@@ -679,6 +679,8 @@ static int decompress_p(AVCodecContext *avctx,
                                 return AVERROR_INVALIDDATA;
 
                             if (bx == 0) {
+                                if (by < 2)
+                                    return AVERROR_INVALIDDATA;
                                 z = backstep;
                             } else {
                                 z = 0;
@@ -708,6 +710,8 @@ static int decompress_p(AVCodecContext *avctx,
                                 return AVERROR_INVALIDDATA;
 
                             if (bx == 0) {
+                                if (by < 2)
+                                    return AVERROR_INVALIDDATA;
                                 z = backstep;
                             } else {
                                 z = 0;