generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge commit '8dc4b2c92e492aa172327d10c926d5ca3a04371c' into release/1.1

Browse Source 
* commit '8dc4b2c92e492aa172327d10c926d5ca3a04371c':
  pictordec: break out of both decoding loops when y drops below 0
  vcr1: add sanity checks

Conflicts:
	libavcodec/pictordec.c
	libavcodec/vcr1.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2013-09-07 13:13:12 +02:00
parent 701543a081 8dc4b2c92e
commit 6bfa823b70
2 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libavcodec/pictordec.c
View File

@@ -237,6 +237,8 @@ static int decode_frame(AVCodecContext *avctx,
if (bits_per_plane == 8) { if (bits_per_plane == 8) {
picmemset_8bpp(s, val, run, &x, &y); picmemset_8bpp(s, val, run, &x, &y);
if (y < 0)
goto finish;
} else { } else {
picmemset(s, val, run, &x, &y, &plane, bits_per_plane); picmemset(s, val, run, &x, &y, &plane, bits_per_plane);
} }
@@ -257,6 +259,7 @@ static int decode_frame(AVCodecContext *avctx,
y--; y--;
} }
} }
finish:
*got_frame = 1; *got_frame = 1;
*(AVFrame*)data = s->frame; *(AVFrame*)data = s->frame;

21
libavcodec/vcr1.c
View File

@@ -52,9 +52,10 @@ static av_cold int vcr1_decode_init(AVCodecContext *avctx)
avctx->pix_fmt = AV_PIX_FMT_YUV410P; avctx->pix_fmt = AV_PIX_FMT_YUV410P;
if (avctx->width % 8 || avctx->height%4) { if (avctx->width % 8 || avctx->height%4) {
av_log_ask_for_sample(avctx, "odd dimensions are not supported\n"); av_log_ask_for_sample(avctx, "odd dimensions (%d x %d) support", avctx->width, avctx->height);
return AVERROR_PATCHWELCOME; return AVERROR_INVALIDDATA;
} }
return 0; return 0;
} }
@@ -95,9 +96,13 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
p->pict_type = AV_PICTURE_TYPE_I; p->pict_type = AV_PICTURE_TYPE_I;
p->key_frame = 1; p->key_frame = 1;
if (buf_size < 32)
goto packet_small;
for (i = 0; i < 16; i++) { for (i = 0; i < 16; i++) {
a->delta[i] = *bytestream++; a->delta[i] = *bytestream++;
bytestream++; bytestream++;
buf_size--;
} }
for (y = 0; y < avctx->height; y++) { for (y = 0; y < avctx->height; y++) {
@@ -108,8 +113,12 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
uint8_t *cb = &a->picture.data[1][(y >> 2) * a->picture.linesize[1]]; uint8_t *cb = &a->picture.data[1][(y >> 2) * a->picture.linesize[1]];
uint8_t *cr = &a->picture.data[2][(y >> 2) * a->picture.linesize[2]]; uint8_t *cr = &a->picture.data[2][(y >> 2) * a->picture.linesize[2]];
if (buf_size < 4 + avctx->width)
goto packet_small;
for (i = 0; i < 4; i++) for (i = 0; i < 4; i++)
a->offset[i] = *bytestream++; a->offset[i] = *bytestream++;
buf_size -= 4;
offset = a->offset[0] - a->delta[bytestream[2] & 0xF]; offset = a->offset[0] - a->delta[bytestream[2] & 0xF];
for (x = 0; x < avctx->width; x += 4) { for (x = 0; x < avctx->width; x += 4) {
@@ -123,8 +132,12 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
*cr++ = bytestream[1]; *cr++ = bytestream[1];
bytestream += 4; bytestream += 4;
buf_size -= 4;
} }
} else { } else {
if (buf_size < avctx->width / 2)
goto packet_small;
offset = a->offset[y & 3] - a->delta[bytestream[2] & 0xF]; offset = a->offset[y & 3] - a->delta[bytestream[2] & 0xF];
for (x = 0; x < avctx->width; x += 8) { for (x = 0; x < avctx->width; x += 8) {
@@ -138,6 +151,7 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
luma[7] = offset += a->delta[bytestream[1] >> 4]; luma[7] = offset += a->delta[bytestream[1] >> 4];
luma += 8; luma += 8;
bytestream += 4; bytestream += 4;
buf_size -= 4;
} }
} }
} }
@@ -146,6 +160,9 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
*got_frame = 1; *got_frame = 1;
return buf_size; return buf_size;
packet_small:
av_log(avctx, AV_LOG_ERROR, "Input packet too small.\n");
return AVERROR_INVALIDDATA;
} }
AVCodec ff_vcr1_decoder = { AVCodec ff_vcr1_decoder = {