virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

loco: take decode overflow into account.

Browse Source 
Commit 2bf0982 introduced an overflow check in loco_decode_plane,
but the error code is never taken into account, leading to
completely idiotic return values.
This commit is contained in:
Nicolas George
2012-07-29 00:12:27 +02:00
parent b2814b034e
commit 91ec1c6cc3
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
libavcodec/loco.c
View File

@@ -179,51 +179,56 @@ static int decode_frame(AVCodecContext *avctx,
} }
p->key_frame = 1; p->key_frame = 1;
#define ADVANCE_BY_DECODED do { \
if (decoded < 0) goto stop; \
buf += decoded; buf_size -= decoded; \
} while(0)
switch(l->mode) { switch(l->mode) {
case LOCO_CYUY2: case LOCO_YUY2: case LOCO_UYVY: case LOCO_CYUY2: case LOCO_YUY2: case LOCO_UYVY:
decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height, decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height,
p->linesize[0], buf, buf_size, 1); p->linesize[0], buf, buf_size, 1);
buf += decoded; buf_size -= decoded; ADVANCE_BY_DECODED;
decoded = loco_decode_plane(l, p->data[1], avctx->width / 2, avctx->height, decoded = loco_decode_plane(l, p->data[1], avctx->width / 2, avctx->height,
p->linesize[1], buf, buf_size, 1); p->linesize[1], buf, buf_size, 1);
buf += decoded; buf_size -= decoded; ADVANCE_BY_DECODED;
decoded = loco_decode_plane(l, p->data[2], avctx->width / 2, avctx->height, decoded = loco_decode_plane(l, p->data[2], avctx->width / 2, avctx->height,
p->linesize[2], buf, buf_size, 1); p->linesize[2], buf, buf_size, 1);
break; break;
case LOCO_CYV12: case LOCO_YV12: case LOCO_CYV12: case LOCO_YV12:
decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height, decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height,
p->linesize[0], buf, buf_size, 1); p->linesize[0], buf, buf_size, 1);
buf += decoded; buf_size -= decoded; ADVANCE_BY_DECODED;
decoded = loco_decode_plane(l, p->data[2], avctx->width / 2, avctx->height / 2, decoded = loco_decode_plane(l, p->data[2], avctx->width / 2, avctx->height / 2,
p->linesize[2], buf, buf_size, 1); p->linesize[2], buf, buf_size, 1);
buf += decoded; buf_size -= decoded; ADVANCE_BY_DECODED;
decoded = loco_decode_plane(l, p->data[1], avctx->width / 2, avctx->height / 2, decoded = loco_decode_plane(l, p->data[1], avctx->width / 2, avctx->height / 2,
p->linesize[1], buf, buf_size, 1); p->linesize[1], buf, buf_size, 1);
break; break;
case LOCO_CRGB: case LOCO_RGB: case LOCO_CRGB: case LOCO_RGB:
decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1), avctx->width, avctx->height, decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1), avctx->width, avctx->height,
-p->linesize[0], buf, buf_size, 3); -p->linesize[0], buf, buf_size, 3);
buf += decoded; buf_size -= decoded; ADVANCE_BY_DECODED;
decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 1, avctx->width, avctx->height, decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 1, avctx->width, avctx->height,
-p->linesize[0], buf, buf_size, 3); -p->linesize[0], buf, buf_size, 3);
buf += decoded; buf_size -= decoded; ADVANCE_BY_DECODED;
decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 2, avctx->width, avctx->height, decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 2, avctx->width, avctx->height,
-p->linesize[0], buf, buf_size, 3); -p->linesize[0], buf, buf_size, 3);
break; break;
case LOCO_CRGBA: case LOCO_RGBA: case LOCO_CRGBA: case LOCO_RGBA:
decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height, decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height,
p->linesize[0], buf, buf_size, 4); p->linesize[0], buf, buf_size, 4);
buf += decoded; buf_size -= decoded; ADVANCE_BY_DECODED;
decoded = loco_decode_plane(l, p->data[0] + 1, avctx->width, avctx->height, decoded = loco_decode_plane(l, p->data[0] + 1, avctx->width, avctx->height,
p->linesize[0], buf, buf_size, 4); p->linesize[0], buf, buf_size, 4);
buf += decoded; buf_size -= decoded; ADVANCE_BY_DECODED;
decoded = loco_decode_plane(l, p->data[0] + 2, avctx->width, avctx->height, decoded = loco_decode_plane(l, p->data[0] + 2, avctx->width, avctx->height,
p->linesize[0], buf, buf_size, 4); p->linesize[0], buf, buf_size, 4);
buf += decoded; buf_size -= decoded; ADVANCE_BY_DECODED;
decoded = loco_decode_plane(l, p->data[0] + 3, avctx->width, avctx->height, decoded = loco_decode_plane(l, p->data[0] + 3, avctx->width, avctx->height,
p->linesize[0], buf, buf_size, 4); p->linesize[0], buf, buf_size, 4);
break; break;
} }
stop:
*data_size = sizeof(AVFrame); *data_size = sizeof(AVFrame);
*(AVFrame*)data = l->pic; *(AVFrame*)data = l->pic;