virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

rpza: Check the blocks left before processing one

Browse Source 
Bug-Id: 903
CC: libav-stable@libav.org
Reported-By: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Luca Barbato 2015-11-01 04:07:42 +01:00
parent 0b699920f3
commit 60f50374f1
1 changed files with 31 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
libavcodec/rpza.c
View File

@ -52,23 +52,25 @@ typedef struct RpzaContext {
GetByteContext gb; GetByteContext gb;
} RpzaContext; } RpzaContext;
#define ADVANCE_BLOCK() \ #define CHECK_BLOCK() \
{ \ if (total_blocks < 1) { \
pixel_ptr += 4; \ av_log(s->avctx, AV_LOG_ERROR, \
if (pixel_ptr >= width) \ "Block counter just went negative (this should not happen)\n"); \
{ \ return AVERROR_INVALIDDATA; \
pixel_ptr = 0; \ } \
row_ptr += stride * 4; \
} \
total_blocks--; \
if (total_blocks < 0) \
{ \
av_log(s->avctx, AV_LOG_ERROR, "warning: block counter just went negative (this should not happen)\n"); \
return; \
} \
}
static void rpza_decode_stream(RpzaContext *s) #define ADVANCE_BLOCK() \
{ \
pixel_ptr += 4; \
if (pixel_ptr >= width) \
{ \
pixel_ptr = 0; \
row_ptr += stride * 4; \
} \
total_blocks--; \
}
static int rpza_decode_stream(RpzaContext *s)
{ {
int width = s->avctx->width; int width = s->avctx->width;
int stride = s->frame->linesize[0] / 2; int stride = s->frame->linesize[0] / 2;
@ -126,7 +128,8 @@ static void rpza_decode_stream(RpzaContext *s)
/* Skip blocks */ /* Skip blocks */
case 0x80: case 0x80:
while (n_blocks--) { while (n_blocks--) {
ADVANCE_BLOCK(); CHECK_BLOCK();
ADVANCE_BLOCK();
} }
break; break;
@ -134,6 +137,7 @@ static void rpza_decode_stream(RpzaContext *s)
case 0xa0: case 0xa0:
colorA = bytestream2_get_be16(&s->gb); colorA = bytestream2_get_be16(&s->gb);
while (n_blocks--) { while (n_blocks--) {
CHECK_BLOCK();
block_ptr = row_ptr + pixel_ptr; block_ptr = row_ptr + pixel_ptr;
for (pixel_y = 0; pixel_y < 4; pixel_y++) { for (pixel_y = 0; pixel_y < 4; pixel_y++) {
for (pixel_x = 0; pixel_x < 4; pixel_x++){ for (pixel_x = 0; pixel_x < 4; pixel_x++){
@ -177,8 +181,9 @@ static void rpza_decode_stream(RpzaContext *s)
color4[2] |= ((21 * ta + 11 * tb) >> 5); color4[2] |= ((21 * ta + 11 * tb) >> 5);
if (bytestream2_get_bytes_left(&s->gb) < n_blocks * 4) if (bytestream2_get_bytes_left(&s->gb) < n_blocks * 4)
return; return AVERROR_INVALIDDATA;
while (n_blocks--) { while (n_blocks--) {
CHECK_BLOCK();
block_ptr = row_ptr + pixel_ptr; block_ptr = row_ptr + pixel_ptr;
for (pixel_y = 0; pixel_y < 4; pixel_y++) { for (pixel_y = 0; pixel_y < 4; pixel_y++) {
uint8_t index = bytestream2_get_byteu(&s->gb); uint8_t index = bytestream2_get_byteu(&s->gb);
@ -196,7 +201,8 @@ static void rpza_decode_stream(RpzaContext *s)
/* Fill block with 16 colors */ /* Fill block with 16 colors */
case 0x00: case 0x00:
if (bytestream2_get_bytes_left(&s->gb) < 30) if (bytestream2_get_bytes_left(&s->gb) < 30)
return; return AVERROR_INVALIDDATA;
CHECK_BLOCK();
block_ptr = row_ptr + pixel_ptr; block_ptr = row_ptr + pixel_ptr;
for (pixel_y = 0; pixel_y < 4; pixel_y++) { for (pixel_y = 0; pixel_y < 4; pixel_y++) {
for (pixel_x = 0; pixel_x < 4; pixel_x++){ for (pixel_x = 0; pixel_x < 4; pixel_x++){
@ -216,9 +222,11 @@ static void rpza_decode_stream(RpzaContext *s)
av_log(s->avctx, AV_LOG_ERROR, "Unknown opcode %d in rpza chunk." av_log(s->avctx, AV_LOG_ERROR, "Unknown opcode %d in rpza chunk."
" Skip remaining %d bytes of chunk data.\n", opcode, " Skip remaining %d bytes of chunk data.\n", opcode,
bytestream2_get_bytes_left(&s->gb)); bytestream2_get_bytes_left(&s->gb));
return; return AVERROR_INVALIDDATA;
} /* Opcode switch */ } /* Opcode switch */
} }
return 0;
} }
static av_cold int rpza_decode_init(AVCodecContext *avctx) static av_cold int rpza_decode_init(AVCodecContext *avctx)
@ -249,7 +257,9 @@ static int rpza_decode_frame(AVCodecContext *avctx,
return ret; return ret;
} }
rpza_decode_stream(s); ret = rpza_decode_stream(s);
if (ret < 0)
return ret;
if ((ret = av_frame_ref(data, s->frame)) < 0) if ((ret = av_frame_ref(data, s->frame)) < 0)
return ret; return ret;