generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

vmd: return meaningful errors

Browse Source 
CC: libav-stable@libav.org
(cherry picked from commit c8f3cb9119)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Conflicts:
	libavcodec/vmdav.c
This commit is contained in:
Luca Barbato
2013-05-28 22:00:12 +02:00
committed by Reinhard Tartler
parent 4f6fbe47a9
commit 5a8dcc993d
1 changed files with 24 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
libavcodec/vmdav.c
View File

@@ -192,7 +192,7 @@ static int rle_unpack(const unsigned char *src, unsigned char *dest,
return bytestream2_tell(&gb); return bytestream2_tell(&gb);
} }
static void vmd_decode(VmdVideoContext *s) static int vmd_decode(VmdVideoContext *s)
{ {
int i; int i;
unsigned int *palette32; unsigned int *palette32;
@@ -216,13 +216,21 @@ static void vmd_decode(VmdVideoContext *s)
if (frame_x < 0 || frame_width < 0 || if (frame_x < 0 || frame_width < 0 ||
frame_x >= s->avctx->width || frame_x >= s->avctx->width ||
frame_width > s->avctx->width || frame_width > s->avctx->width ||
frame_x + frame_width > s->avctx->width) frame_x + frame_width > s->avctx->width) {
return; av_log(s->avctx, AV_LOG_ERROR,
"Invalid horizontal range %d-%d\n",
frame_x, frame_width);
return AVERROR_INVALIDDATA;
}
if (frame_y < 0 || frame_height < 0 || if (frame_y < 0 || frame_height < 0 ||
frame_y >= s->avctx->height || frame_y >= s->avctx->height ||
frame_height > s->avctx->height || frame_height > s->avctx->height ||
frame_y + frame_height > s->avctx->height) frame_y + frame_height > s->avctx->height) {
return; av_log(s->avctx, AV_LOG_ERROR,
"Invalid vertical range %d-%d\n",
frame_x, frame_width);
return AVERROR_INVALIDDATA;
}
if ((frame_width == s->avctx->width && frame_height == s->avctx->height) && if ((frame_width == s->avctx->width && frame_height == s->avctx->height) &&
(frame_x || frame_y)) { (frame_x || frame_y)) {
@@ -255,6 +263,9 @@ static void vmd_decode(VmdVideoContext *s)
b = bytestream2_get_byteu(&gb) * 4; b = bytestream2_get_byteu(&gb) * 4;
palette32[i] = (r << 16) | (g << 8) | (b); palette32[i] = (r << 16) | (g << 8) | (b);
} }
} else {
av_log(s->avctx, AV_LOG_ERROR, "Incomplete palette\n");
return AVERROR_INVALIDDATA;
} }
s->size -= (256 * 3 + 2); s->size -= (256 * 3 + 2);
} }
@@ -262,7 +273,7 @@ static void vmd_decode(VmdVideoContext *s)
/* originally UnpackFrame in VAG's code */ /* originally UnpackFrame in VAG's code */
bytestream2_init(&gb, gb.buffer, s->buf + s->size - gb.buffer); bytestream2_init(&gb, gb.buffer, s->buf + s->size - gb.buffer);
if (bytestream2_get_bytes_left(&gb) < 1) if (bytestream2_get_bytes_left(&gb) < 1)
return; return AVERROR_INVALIDDATA;
meth = bytestream2_get_byteu(&gb); meth = bytestream2_get_byteu(&gb);
if (meth & 0x80) { if (meth & 0x80) {
lz_unpack(gb.buffer, bytestream2_get_bytes_left(&gb), lz_unpack(gb.buffer, bytestream2_get_bytes_left(&gb),
@@ -282,13 +293,13 @@ static void vmd_decode(VmdVideoContext *s)
if (len & 0x80) { if (len & 0x80) {
len = (len & 0x7F) + 1; len = (len & 0x7F) + 1;
if (ofs + len > frame_width || bytestream2_get_bytes_left(&gb) < len) if (ofs + len > frame_width || bytestream2_get_bytes_left(&gb) < len)
return; return AVERROR_INVALIDDATA;
bytestream2_get_buffer(&gb, &dp[ofs], len); bytestream2_get_buffer(&gb, &dp[ofs], len);
ofs += len; ofs += len;
} else { } else {
/* interframe pixel copy */ /* interframe pixel copy */
if (ofs + len + 1 > frame_width || !s->prev_frame.data[0]) if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
return; return AVERROR_INVALIDDATA;
memcpy(&dp[ofs], &pp[ofs], len + 1); memcpy(&dp[ofs], &pp[ofs], len + 1);
ofs += len + 1; ofs += len + 1;
} }
@@ -296,7 +307,7 @@ static void vmd_decode(VmdVideoContext *s)
if (ofs > frame_width) { if (ofs > frame_width) {
av_log(s->avctx, AV_LOG_ERROR, "VMD video: offset > width (%d > %d)\n", av_log(s->avctx, AV_LOG_ERROR, "VMD video: offset > width (%d > %d)\n",
ofs, frame_width); ofs, frame_width);
break; return AVERROR_INVALIDDATA;
} }
dp += s->frame.linesize[0]; dp += s->frame.linesize[0];
pp += s->prev_frame.linesize[0]; pp += s->prev_frame.linesize[0];
@@ -328,7 +339,7 @@ static void vmd_decode(VmdVideoContext *s)
} else { } else {
/* interframe pixel copy */ /* interframe pixel copy */
if (ofs + len + 1 > frame_width || !s->prev_frame.data[0]) if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
return; return AVERROR_INVALIDDATA;
memcpy(&dp[ofs], &pp[ofs], len + 1); memcpy(&dp[ofs], &pp[ofs], len + 1);
ofs += len + 1; ofs += len + 1;
} }
@@ -336,6 +347,7 @@ static void vmd_decode(VmdVideoContext *s)
if (ofs > frame_width) { if (ofs > frame_width) {
av_log(s->avctx, AV_LOG_ERROR, "VMD video: offset > width (%d > %d)\n", av_log(s->avctx, AV_LOG_ERROR, "VMD video: offset > width (%d > %d)\n",
ofs, frame_width); ofs, frame_width);
return AVERROR_INVALIDDATA;
} }
dp += s->frame.linesize[0]; dp += s->frame.linesize[0];
pp += s->prev_frame.linesize[0]; pp += s->prev_frame.linesize[0];
@@ -343,6 +355,7 @@ static void vmd_decode(VmdVideoContext *s)
break; break;
} }
} }
return 0;
} }
static av_cold int vmdvideo_decode_init(AVCodecContext *avctx) static av_cold int vmdvideo_decode_init(AVCodecContext *avctx)
@@ -396,7 +409,7 @@ static int vmdvideo_decode_frame(AVCodecContext *avctx,
s->size = buf_size; s->size = buf_size;
if (buf_size < 16) if (buf_size < 16)
return buf_size; return AVERROR_INVALIDDATA;
s->frame.reference = 1; s->frame.reference = 1;
if (ff_get_buffer(avctx, &s->frame)) { if (ff_get_buffer(avctx, &s->frame)) {