virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avcodec/sanm: FOBJ left/top are signed values

Browse Source 
The left/top parameters of a FOBJ are signed values.  Adjust
codec1 code accordingly to not draw outside the buffer area.
Rebel Assault 1 makes heavy use of this.

Signed-off-by: Manuel Lauss <manuel.lauss@gmail.com>
This commit is contained in:
Manuel Lauss
2025-03-11 13:20:05 +01:00
parent a48dd03fd9
commit f6c6ba95fd
1 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
libavcodec/sanm.c
View File

@ -558,18 +558,18 @@ static int rle_decode(SANMVideoContext *ctx, uint8_t *dst, const int out_size)
static int old_codec1(SANMVideoContext *ctx, int top, static int old_codec1(SANMVideoContext *ctx, int top,
int left, int width, int height) int left, int width, int height)
{ {
uint8_t *dst = ((uint8_t *)ctx->frm0) + left + top * ctx->pitch; int i, j, len, flag, code, val, end, pxoff;
int i, j, len, flag, code, val, pos, end; const int maxpxo = ctx->height * ctx->pitch;
uint8_t *dst = (uint8_t *)ctx->frm0;
for (i = 0; i < height; i++) { for (i = 0; i < height; i++) {
pos = 0;
if (bytestream2_get_bytes_left(&ctx->gb) < 2) if (bytestream2_get_bytes_left(&ctx->gb) < 2)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
len = bytestream2_get_le16u(&ctx->gb); len = bytestream2_get_le16u(&ctx->gb);
end = bytestream2_tell(&ctx->gb) + len; end = bytestream2_tell(&ctx->gb) + len;
pxoff = left + ((top + i) * ctx->pitch);
while (bytestream2_tell(&ctx->gb) < end) { while (bytestream2_tell(&ctx->gb) < end) {
if (bytestream2_get_bytes_left(&ctx->gb) < 2) if (bytestream2_get_bytes_left(&ctx->gb) < 2)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
@ -577,25 +577,28 @@ static int old_codec1(SANMVideoContext *ctx, int top,
code = bytestream2_get_byteu(&ctx->gb); code = bytestream2_get_byteu(&ctx->gb);
flag = code & 1; flag = code & 1;
code = (code >> 1) + 1; code = (code >> 1) + 1;
if (pos + code > width)
return AVERROR_INVALIDDATA;
if (flag) { if (flag) {
val = bytestream2_get_byteu(&ctx->gb); val = bytestream2_get_byteu(&ctx->gb);
if (val) if (val) {
memset(dst + pos, val, code); for (j = 0; j < code; j++) {
pos += code; if (pxoff >= 0 && pxoff < maxpxo)
*(dst + pxoff) = val;
pxoff++;
}
} else {
pxoff += code;
}
} else { } else {
if (bytestream2_get_bytes_left(&ctx->gb) < code) if (bytestream2_get_bytes_left(&ctx->gb) < code)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
for (j = 0; j < code; j++) { for (j = 0; j < code; j++) {
val = bytestream2_get_byteu(&ctx->gb); val = bytestream2_get_byteu(&ctx->gb);
if (val) if ((pxoff >= 0) && (pxoff < maxpxo) && val)
dst[pos] = val; *(dst + pxoff) = val;
pos++; pxoff++;
} }
} }
} }
dst += ctx->pitch;
} }
ctx->rotate_code = 0; ctx->rotate_code = 0;
@ -1236,8 +1239,8 @@ static int old_codec48(SANMVideoContext *ctx, int width, int height)
static int process_frame_obj(SANMVideoContext *ctx) static int process_frame_obj(SANMVideoContext *ctx)
{ {
uint16_t codec = bytestream2_get_le16u(&ctx->gb); uint16_t codec = bytestream2_get_le16u(&ctx->gb);
uint16_t left = bytestream2_get_le16u(&ctx->gb); int16_t left = bytestream2_get_le16u(&ctx->gb);
uint16_t top = bytestream2_get_le16u(&ctx->gb); int16_t top = bytestream2_get_le16u(&ctx->gb);
uint16_t w = bytestream2_get_le16u(&ctx->gb); uint16_t w = bytestream2_get_le16u(&ctx->gb);
uint16_t h = bytestream2_get_le16u(&ctx->gb); uint16_t h = bytestream2_get_le16u(&ctx->gb);