generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge commit 'dbaf3f7b0bc9e99dff8e06bd29fcb3e84eebfe7c' into release/1.1

Browse Source 
* commit 'dbaf3f7b0bc9e99dff8e06bd29fcb3e84eebfe7c':
  vmd: drop incomplete chunks and spurious samples
  vmd: return meaningful errors

Conflicts:
	libavcodec/vmdav.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2013-06-03 01:56:10 +02:00
parent 2a39548181 dbaf3f7b0b
commit d6373f1586
1 changed files with 31 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
libavcodec/vmdav.c
View File

@@ -43,6 +43,7 @@
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include "libavutil/avassert.h"
#include "libavutil/channel_layout.h" #include "libavutil/channel_layout.h"
#include "libavutil/common.h" #include "libavutil/common.h"
#include "libavutil/intreadwrite.h" #include "libavutil/intreadwrite.h"
@@ -192,7 +193,7 @@ static int rle_unpack(const unsigned char *src, unsigned char *dest,
return bytestream2_tell(&gb); return bytestream2_tell(&gb);
} }
static void vmd_decode(VmdVideoContext *s) static int vmd_decode(VmdVideoContext *s)
{ {
int i; int i;
unsigned int *palette32; unsigned int *palette32;
@@ -216,13 +217,21 @@ static void vmd_decode(VmdVideoContext *s)
if (frame_x < 0 || frame_width < 0 || if (frame_x < 0 || frame_width < 0 ||
frame_x >= s->avctx->width || frame_x >= s->avctx->width ||
frame_width > s->avctx->width || frame_width > s->avctx->width ||
frame_x + frame_width > s->avctx->width) frame_x + frame_width > s->avctx->width) {
return; av_log(s->avctx, AV_LOG_ERROR,
"Invalid horizontal range %d-%d\n",
frame_x, frame_width);
return AVERROR_INVALIDDATA;
}
if (frame_y < 0 || frame_height < 0 || if (frame_y < 0 || frame_height < 0 ||
frame_y >= s->avctx->height || frame_y >= s->avctx->height ||
frame_height > s->avctx->height || frame_height > s->avctx->height ||
frame_y + frame_height > s->avctx->height) frame_y + frame_height > s->avctx->height) {
return; av_log(s->avctx, AV_LOG_ERROR,
"Invalid vertical range %d-%d\n",
frame_x, frame_width);
return AVERROR_INVALIDDATA;
}
if ((frame_width == s->avctx->width && frame_height == s->avctx->height) && if ((frame_width == s->avctx->width && frame_height == s->avctx->height) &&
(frame_x || frame_y)) { (frame_x || frame_y)) {
@@ -256,13 +265,16 @@ static void vmd_decode(VmdVideoContext *s)
palette32[i] = 0xFFU << 24 | (r << 16) | (g << 8) | (b); palette32[i] = 0xFFU << 24 | (r << 16) | (g << 8) | (b);
palette32[i] |= palette32[i] >> 6 & 0x30303; palette32[i] |= palette32[i] >> 6 & 0x30303;
} }
} else {
av_log(s->avctx, AV_LOG_ERROR, "Incomplete palette\n");
return AVERROR_INVALIDDATA;
} }
} }
if (s->size > 0) { if (s->size > 0) {
/* originally UnpackFrame in VAG's code */ /* originally UnpackFrame in VAG's code */
bytestream2_init(&gb, gb.buffer, s->buf + s->size - gb.buffer); bytestream2_init(&gb, gb.buffer, s->buf + s->size - gb.buffer);
if (bytestream2_get_bytes_left(&gb) < 1) if (bytestream2_get_bytes_left(&gb) < 1)
return; return AVERROR_INVALIDDATA;
meth = bytestream2_get_byteu(&gb); meth = bytestream2_get_byteu(&gb);
if (meth & 0x80) { if (meth & 0x80) {
lz_unpack(gb.buffer, bytestream2_get_bytes_left(&gb), lz_unpack(gb.buffer, bytestream2_get_bytes_left(&gb),
@@ -282,13 +294,13 @@ static void vmd_decode(VmdVideoContext *s)
if (len & 0x80) { if (len & 0x80) {
len = (len & 0x7F) + 1; len = (len & 0x7F) + 1;
if (ofs + len > frame_width || bytestream2_get_bytes_left(&gb) < len) if (ofs + len > frame_width || bytestream2_get_bytes_left(&gb) < len)
return; return AVERROR_INVALIDDATA;
bytestream2_get_buffer(&gb, &dp[ofs], len); bytestream2_get_buffer(&gb, &dp[ofs], len);
ofs += len; ofs += len;
} else { } else {
/* interframe pixel copy */ /* interframe pixel copy */
if (ofs + len + 1 > frame_width || !s->prev_frame.data[0]) if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
return; return AVERROR_INVALIDDATA;
memcpy(&dp[ofs], &pp[ofs], len + 1); memcpy(&dp[ofs], &pp[ofs], len + 1);
ofs += len + 1; ofs += len + 1;
} }
@@ -296,7 +308,7 @@ static void vmd_decode(VmdVideoContext *s)
if (ofs > frame_width) { if (ofs > frame_width) {
av_log(s->avctx, AV_LOG_ERROR, "offset > width (%d > %d)\n", av_log(s->avctx, AV_LOG_ERROR, "offset > width (%d > %d)\n",
ofs, frame_width); ofs, frame_width);
break; return AVERROR_INVALIDDATA;
} }
dp += s->frame.linesize[0]; dp += s->frame.linesize[0];
pp += s->prev_frame.linesize[0]; pp += s->prev_frame.linesize[0];
@@ -328,7 +340,7 @@ static void vmd_decode(VmdVideoContext *s)
} else { } else {
/* interframe pixel copy */ /* interframe pixel copy */
if (ofs + len + 1 > frame_width || !s->prev_frame.data[0]) if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
return; return AVERROR_INVALIDDATA;
memcpy(&dp[ofs], &pp[ofs], len + 1); memcpy(&dp[ofs], &pp[ofs], len + 1);
ofs += len + 1; ofs += len + 1;
} }
@@ -336,6 +348,7 @@ static void vmd_decode(VmdVideoContext *s)
if (ofs > frame_width) { if (ofs > frame_width) {
av_log(s->avctx, AV_LOG_ERROR, "offset > width (%d > %d)\n", av_log(s->avctx, AV_LOG_ERROR, "offset > width (%d > %d)\n",
ofs, frame_width); ofs, frame_width);
return AVERROR_INVALIDDATA;
} }
dp += s->frame.linesize[0]; dp += s->frame.linesize[0];
pp += s->prev_frame.linesize[0]; pp += s->prev_frame.linesize[0];
@@ -343,6 +356,7 @@ static void vmd_decode(VmdVideoContext *s)
break; break;
} }
} }
return 0;
} }
static av_cold int vmdvideo_decode_init(AVCodecContext *avctx) static av_cold int vmdvideo_decode_init(AVCodecContext *avctx)
@@ -399,7 +413,7 @@ static int vmdvideo_decode_frame(AVCodecContext *avctx,
s->size = buf_size; s->size = buf_size;
if (buf_size < 16) if (buf_size < 16)
return buf_size; return AVERROR_INVALIDDATA;
s->frame.reference = 3; s->frame.reference = 3;
if (ff_get_buffer(avctx, &s->frame)) { if (ff_get_buffer(avctx, &s->frame)) {
@@ -576,6 +590,9 @@ static int vmdaudio_decode_frame(AVCodecContext *avctx, void *data,
/* ensure output buffer is large enough */ /* ensure output buffer is large enough */
audio_chunks = buf_size / s->chunk_size; audio_chunks = buf_size / s->chunk_size;
/* drop incomplete chunks */
buf_size = audio_chunks * s->chunk_size;
/* get output buffer */ /* get output buffer */
s->frame.nb_samples = ((silent_chunks + audio_chunks) * avctx->block_align) / avctx->channels; s->frame.nb_samples = ((silent_chunks + audio_chunks) * avctx->block_align) / avctx->channels;
if ((ret = ff_get_buffer(avctx, &s->frame)) < 0) { if ((ret = ff_get_buffer(avctx, &s->frame)) < 0) {
@@ -587,7 +604,8 @@ static int vmdaudio_decode_frame(AVCodecContext *avctx, void *data,
/* decode silent chunks */ /* decode silent chunks */
if (silent_chunks > 0) { if (silent_chunks > 0) {
int silent_size = avctx->block_align * silent_chunks; int silent_size = FFMIN(avctx->block_align * silent_chunks,
s->frame.nb_samples * avctx->channels);
if (s->out_bps == 2) { if (s->out_bps == 2) {
memset(output_samples_s16, 0x00, silent_size * 2); memset(output_samples_s16, 0x00, silent_size * 2);
output_samples_s16 += silent_size; output_samples_s16 += silent_size;
@@ -600,6 +618,7 @@ static int vmdaudio_decode_frame(AVCodecContext *avctx, void *data,
/* decode audio chunks */ /* decode audio chunks */
if (audio_chunks > 0) { if (audio_chunks > 0) {
buf_end = buf + buf_size; buf_end = buf + buf_size;
av_assert0((buf_size & (avctx->channels > 1)) == 0);
while (buf_end - buf >= s->chunk_size) { while (buf_end - buf >= s->chunk_size) {
if (s->out_bps == 2) { if (s->out_bps == 2) {
decode_audio_s16(output_samples_s16, buf, s->chunk_size, decode_audio_s16(output_samples_s16, buf, s->chunk_size,