avcodec/rv60: negative qp guard

Fixes CID 1634472
2024-11-06 07:57:17 +11:00 · 2024-11-06 07:57:17 +11:00 · d51a920556
parent 82467b635e
commit d51a920556
1 changed files with 2 additions and 0 deletions
--- a/libavcodec/rv60dec.c
+++ b/libavcodec/rv60dec.c
@ -2270,6 +2270,8 @@ static int decode_slice(AVCodecContext *avctx, void *tdata, int cu_y, int thread
            ff_thread_progress_await(&s->progress[cu_y - 1], cu_x + 2);

        qp = s->qp + read_qp_offset(&gb, s->qp_off_type);
+        if (qp < 0)
+            return AVERROR_INVALIDDATA;
        sel_qp = calc_sel_qp(s->osvquant, qp);

        memset(thread.coded_blk, 0, sizeof(thread.coded_blk));