[FFmpeg-cvslog] avcodec/scpr: Fix reading a pixel before the first

[Michael Niedermayer]

ffmpeg | branch: release/3.4 | Michael Niedermayer <michael at niedermayer.cc> | Sat Feb  3 18:49:07 2018 +0100| [c4153d40d5d8a38a9762fbc9626728beba5887e4] | committer: Michael Niedermayer

avcodec/scpr: Fix reading a pixel before the first

Fixes: 5540/clusterfuzz-testcase-minimized-6122458273808384

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 0fb33a82890753233225c61863fff1fcc9d970d4)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c4153d40d5d8a38a9762fbc9626728beba5887e4
---

 libavcodec/scpr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/scpr.c b/libavcodec/scpr.c
index cbe1bc40d9..ad6073dbf0 100644
--- a/libavcodec/scpr.c
+++ b/libavcodec/scpr.c
@@ -681,6 +681,8 @@ static int decompress_p(AVCodecContext *avctx,
                                 return AVERROR_INVALIDDATA;
 
                             if (bx == 0) {
+                                if (by < 2)
+                                    return AVERROR_INVALIDDATA;
                                 z = backstep;
                             } else {
                                 z = 0;
@@ -710,6 +712,8 @@ static int decompress_p(AVCodecContext *avctx,
                                 return AVERROR_INVALIDDATA;
 
                             if (bx == 0) {
+                                if (by < 2)
+                                    return AVERROR_INVALIDDATA;
                                 z = backstep;
                             } else {
                                 z = 0;