Fixes out of array reads Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
		
			
				
	
	
		
			347 lines
		
	
	
		
			11 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			347 lines
		
	
	
		
			11 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
/*
 | 
						|
 * Motion Pixels Video Decoder
 | 
						|
 * Copyright (c) 2008 Gregory Montoir (cyx@users.sourceforge.net)
 | 
						|
 *
 | 
						|
 * This file is part of FFmpeg.
 | 
						|
 *
 | 
						|
 * FFmpeg is free software; you can redistribute it and/or
 | 
						|
 * modify it under the terms of the GNU Lesser General Public
 | 
						|
 * License as published by the Free Software Foundation; either
 | 
						|
 * version 2.1 of the License, or (at your option) any later version.
 | 
						|
 *
 | 
						|
 * FFmpeg is distributed in the hope that it will be useful,
 | 
						|
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 | 
						|
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 | 
						|
 * Lesser General Public License for more details.
 | 
						|
 *
 | 
						|
 * You should have received a copy of the GNU Lesser General Public
 | 
						|
 * License along with FFmpeg; if not, write to the Free Software
 | 
						|
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 | 
						|
 */
 | 
						|
 | 
						|
#include "avcodec.h"
 | 
						|
#include "get_bits.h"
 | 
						|
#include "dsputil.h"
 | 
						|
 | 
						|
#define MAX_HUFF_CODES 16
 | 
						|
 | 
						|
#include "motionpixels_tablegen.h"
 | 
						|
 | 
						|
typedef struct HuffCode {
 | 
						|
    int code;
 | 
						|
    uint8_t size;
 | 
						|
    uint8_t delta;
 | 
						|
} HuffCode;
 | 
						|
 | 
						|
typedef struct MotionPixelsContext {
 | 
						|
    AVCodecContext *avctx;
 | 
						|
    AVFrame frame;
 | 
						|
    DSPContext dsp;
 | 
						|
    uint8_t *changes_map;
 | 
						|
    int offset_bits_len;
 | 
						|
    int codes_count, current_codes_count;
 | 
						|
    int max_codes_bits;
 | 
						|
    HuffCode codes[MAX_HUFF_CODES];
 | 
						|
    VLC vlc;
 | 
						|
    YuvPixel *vpt, *hpt;
 | 
						|
    uint8_t gradient_scale[3];
 | 
						|
    uint8_t *bswapbuf;
 | 
						|
    int bswapbuf_size;
 | 
						|
} MotionPixelsContext;
 | 
						|
 | 
						|
static av_cold int mp_decode_init(AVCodecContext *avctx)
 | 
						|
{
 | 
						|
    MotionPixelsContext *mp = avctx->priv_data;
 | 
						|
    int w4 = (avctx->width  + 3) & ~3;
 | 
						|
    int h4 = (avctx->height + 3) & ~3;
 | 
						|
 | 
						|
    if(avctx->extradata_size < 2){
 | 
						|
        av_log(avctx, AV_LOG_ERROR, "extradata too small\n");
 | 
						|
        return AVERROR_INVALIDDATA;
 | 
						|
    }
 | 
						|
 | 
						|
    motionpixels_tableinit();
 | 
						|
    mp->avctx = avctx;
 | 
						|
    ff_dsputil_init(&mp->dsp, avctx);
 | 
						|
    mp->changes_map = av_mallocz(avctx->width * h4);
 | 
						|
    mp->offset_bits_len = av_log2(avctx->width * avctx->height) + 1;
 | 
						|
    mp->vpt = av_mallocz(avctx->height * sizeof(YuvPixel));
 | 
						|
    mp->hpt = av_mallocz(h4 * w4 / 16 * sizeof(YuvPixel));
 | 
						|
    avctx->pix_fmt = AV_PIX_FMT_RGB555;
 | 
						|
    avcodec_get_frame_defaults(&mp->frame);
 | 
						|
    return 0;
 | 
						|
}
 | 
						|
 | 
						|
static void mp_read_changes_map(MotionPixelsContext *mp, GetBitContext *gb, int count, int bits_len, int read_color)
 | 
						|
{
 | 
						|
    uint16_t *pixels;
 | 
						|
    int offset, w, h, color = 0, x, y, i;
 | 
						|
 | 
						|
    while (count--) {
 | 
						|
        offset = get_bits_long(gb, mp->offset_bits_len);
 | 
						|
        w      = get_bits(gb, bits_len) + 1;
 | 
						|
        h      = get_bits(gb, bits_len) + 1;
 | 
						|
        if (read_color)
 | 
						|
            color = get_bits(gb, 15);
 | 
						|
        x = offset % mp->avctx->width;
 | 
						|
        y = offset / mp->avctx->width;
 | 
						|
        if (y >= mp->avctx->height)
 | 
						|
            continue;
 | 
						|
        w = FFMIN(w, mp->avctx->width  - x);
 | 
						|
        h = FFMIN(h, mp->avctx->height - y);
 | 
						|
        pixels = (uint16_t *)&mp->frame.data[0][y * mp->frame.linesize[0] + x * 2];
 | 
						|
        while (h--) {
 | 
						|
            mp->changes_map[offset] = w;
 | 
						|
            if (read_color)
 | 
						|
                for (i = 0; i < w; ++i)
 | 
						|
                    pixels[i] = color;
 | 
						|
            offset += mp->avctx->width;
 | 
						|
            pixels += mp->frame.linesize[0] / 2;
 | 
						|
        }
 | 
						|
    }
 | 
						|
}
 | 
						|
 | 
						|
static int mp_get_code(MotionPixelsContext *mp, GetBitContext *gb, int size, int code)
 | 
						|
{
 | 
						|
    while (get_bits1(gb)) {
 | 
						|
        ++size;
 | 
						|
        if (size > mp->max_codes_bits) {
 | 
						|
            av_log(mp->avctx, AV_LOG_ERROR, "invalid code size %d/%d\n", size, mp->max_codes_bits);
 | 
						|
            return AVERROR_INVALIDDATA;
 | 
						|
        }
 | 
						|
        code <<= 1;
 | 
						|
        if (mp_get_code(mp, gb, size, code + 1) < 0)
 | 
						|
            return AVERROR_INVALIDDATA;
 | 
						|
    }
 | 
						|
    if (mp->current_codes_count >= MAX_HUFF_CODES) {
 | 
						|
        av_log(mp->avctx, AV_LOG_ERROR, "too many codes\n");
 | 
						|
        return AVERROR_INVALIDDATA;
 | 
						|
    }
 | 
						|
 | 
						|
    mp->codes[mp->current_codes_count  ].code = code;
 | 
						|
    mp->codes[mp->current_codes_count++].size = size;
 | 
						|
    return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int mp_read_codes_table(MotionPixelsContext *mp, GetBitContext *gb)
 | 
						|
{
 | 
						|
    if (mp->codes_count == 1) {
 | 
						|
        mp->codes[0].delta = get_bits(gb, 4);
 | 
						|
    } else {
 | 
						|
        int i;
 | 
						|
        int ret;
 | 
						|
 | 
						|
        mp->max_codes_bits = get_bits(gb, 4);
 | 
						|
        for (i = 0; i < mp->codes_count; ++i)
 | 
						|
            mp->codes[i].delta = get_bits(gb, 4);
 | 
						|
        mp->current_codes_count = 0;
 | 
						|
        if ((ret = mp_get_code(mp, gb, 0, 0)) < 0)
 | 
						|
            return ret;
 | 
						|
        if (mp->current_codes_count < mp->codes_count) {
 | 
						|
            av_log(mp->avctx, AV_LOG_ERROR, "too few codes\n");
 | 
						|
            return AVERROR_INVALIDDATA;
 | 
						|
        }
 | 
						|
   }
 | 
						|
   return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int mp_gradient(MotionPixelsContext *mp, int component, int v)
 | 
						|
{
 | 
						|
    int delta;
 | 
						|
 | 
						|
    delta = (v - 7) * mp->gradient_scale[component];
 | 
						|
    mp->gradient_scale[component] = (v == 0 || v == 14) ? 2 : 1;
 | 
						|
    return delta;
 | 
						|
}
 | 
						|
 | 
						|
static YuvPixel mp_get_yuv_from_rgb(MotionPixelsContext *mp, int x, int y)
 | 
						|
{
 | 
						|
    int color;
 | 
						|
 | 
						|
    color = *(uint16_t *)&mp->frame.data[0][y * mp->frame.linesize[0] + x * 2];
 | 
						|
    return mp_rgb_yuv_table[color];
 | 
						|
}
 | 
						|
 | 
						|
static void mp_set_rgb_from_yuv(MotionPixelsContext *mp, int x, int y, const YuvPixel *p)
 | 
						|
{
 | 
						|
    int color;
 | 
						|
 | 
						|
    color = mp_yuv_to_rgb(p->y, p->v, p->u, 1);
 | 
						|
    *(uint16_t *)&mp->frame.data[0][y * mp->frame.linesize[0] + x * 2] = color;
 | 
						|
}
 | 
						|
 | 
						|
static int mp_get_vlc(MotionPixelsContext *mp, GetBitContext *gb)
 | 
						|
{
 | 
						|
    int i;
 | 
						|
 | 
						|
    i = (mp->codes_count == 1) ? 0 : get_vlc2(gb, mp->vlc.table, mp->max_codes_bits, 1);
 | 
						|
    return mp->codes[i].delta;
 | 
						|
}
 | 
						|
 | 
						|
static void mp_decode_line(MotionPixelsContext *mp, GetBitContext *gb, int y)
 | 
						|
{
 | 
						|
    YuvPixel p;
 | 
						|
    const int y0 = y * mp->avctx->width;
 | 
						|
    int w, i, x = 0;
 | 
						|
 | 
						|
    p = mp->vpt[y];
 | 
						|
    if (mp->changes_map[y0 + x] == 0) {
 | 
						|
        memset(mp->gradient_scale, 1, sizeof(mp->gradient_scale));
 | 
						|
        ++x;
 | 
						|
    }
 | 
						|
    while (x < mp->avctx->width) {
 | 
						|
        w = mp->changes_map[y0 + x];
 | 
						|
        if (w != 0) {
 | 
						|
            if ((y & 3) == 0) {
 | 
						|
                if (mp->changes_map[y0 + x + mp->avctx->width] < w ||
 | 
						|
                    mp->changes_map[y0 + x + mp->avctx->width * 2] < w ||
 | 
						|
                    mp->changes_map[y0 + x + mp->avctx->width * 3] < w) {
 | 
						|
                    for (i = (x + 3) & ~3; i < x + w; i += 4) {
 | 
						|
                        mp->hpt[((y / 4) * mp->avctx->width + i) / 4] = mp_get_yuv_from_rgb(mp, i, y);
 | 
						|
                    }
 | 
						|
                }
 | 
						|
            }
 | 
						|
            x += w;
 | 
						|
            memset(mp->gradient_scale, 1, sizeof(mp->gradient_scale));
 | 
						|
            p = mp_get_yuv_from_rgb(mp, x - 1, y);
 | 
						|
        } else {
 | 
						|
            p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
 | 
						|
            p.y = av_clip(p.y, 0, 31);
 | 
						|
            if ((x & 3) == 0) {
 | 
						|
                if ((y & 3) == 0) {
 | 
						|
                    p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
 | 
						|
                    p.v = av_clip(p.v, -32, 31);
 | 
						|
                    p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
 | 
						|
                    p.u = av_clip(p.u, -32, 31);
 | 
						|
                    mp->hpt[((y / 4) * mp->avctx->width + x) / 4] = p;
 | 
						|
                } else {
 | 
						|
                    p.v = mp->hpt[((y / 4) * mp->avctx->width + x) / 4].v;
 | 
						|
                    p.u = mp->hpt[((y / 4) * mp->avctx->width + x) / 4].u;
 | 
						|
                }
 | 
						|
            }
 | 
						|
            mp_set_rgb_from_yuv(mp, x, y, &p);
 | 
						|
            ++x;
 | 
						|
        }
 | 
						|
    }
 | 
						|
}
 | 
						|
 | 
						|
static void mp_decode_frame_helper(MotionPixelsContext *mp, GetBitContext *gb)
 | 
						|
{
 | 
						|
    YuvPixel p;
 | 
						|
    int y, y0;
 | 
						|
 | 
						|
    av_assert1(mp->changes_map[0]);
 | 
						|
 | 
						|
    for (y = 0; y < mp->avctx->height; ++y) {
 | 
						|
        if (mp->changes_map[y * mp->avctx->width] != 0) {
 | 
						|
            memset(mp->gradient_scale, 1, sizeof(mp->gradient_scale));
 | 
						|
            p = mp_get_yuv_from_rgb(mp, 0, y);
 | 
						|
        } else {
 | 
						|
            p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
 | 
						|
            p.y = av_clip(p.y, 0, 31);
 | 
						|
            if ((y & 3) == 0) {
 | 
						|
                p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
 | 
						|
                p.v = av_clip(p.v, -32, 31);
 | 
						|
                p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
 | 
						|
                p.u = av_clip(p.u, -32, 31);
 | 
						|
            }
 | 
						|
            mp->vpt[y] = p;
 | 
						|
            mp_set_rgb_from_yuv(mp, 0, y, &p);
 | 
						|
        }
 | 
						|
    }
 | 
						|
    for (y0 = 0; y0 < 2; ++y0)
 | 
						|
        for (y = y0; y < mp->avctx->height; y += 2)
 | 
						|
            mp_decode_line(mp, gb, y);
 | 
						|
}
 | 
						|
 | 
						|
static int mp_decode_frame(AVCodecContext *avctx,
 | 
						|
                                 void *data, int *got_frame,
 | 
						|
                                 AVPacket *avpkt)
 | 
						|
{
 | 
						|
    const uint8_t *buf = avpkt->data;
 | 
						|
    int buf_size = avpkt->size;
 | 
						|
    MotionPixelsContext *mp = avctx->priv_data;
 | 
						|
    GetBitContext gb;
 | 
						|
    int i, count1, count2, sz, ret;
 | 
						|
 | 
						|
    mp->frame.reference = 3;
 | 
						|
    mp->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
 | 
						|
    if ((ret = avctx->reget_buffer(avctx, &mp->frame)) < 0) {
 | 
						|
        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
 | 
						|
        return ret;
 | 
						|
    }
 | 
						|
 | 
						|
    /* le32 bitstream msb first */
 | 
						|
    av_fast_malloc(&mp->bswapbuf, &mp->bswapbuf_size, buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
 | 
						|
    if (!mp->bswapbuf)
 | 
						|
        return AVERROR(ENOMEM);
 | 
						|
    mp->dsp.bswap_buf((uint32_t *)mp->bswapbuf, (const uint32_t *)buf, buf_size / 4);
 | 
						|
    if (buf_size & 3)
 | 
						|
        memcpy(mp->bswapbuf + (buf_size & ~3), buf + (buf_size & ~3), buf_size & 3);
 | 
						|
    memset(mp->bswapbuf + buf_size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
 | 
						|
    init_get_bits(&gb, mp->bswapbuf, buf_size * 8);
 | 
						|
 | 
						|
    memset(mp->changes_map, 0, avctx->width * avctx->height);
 | 
						|
    for (i = !(avctx->extradata[1] & 2); i < 2; ++i) {
 | 
						|
        count1 = get_bits(&gb, 12);
 | 
						|
        count2 = get_bits(&gb, 12);
 | 
						|
        mp_read_changes_map(mp, &gb, count1, 8, i);
 | 
						|
        mp_read_changes_map(mp, &gb, count2, 4, i);
 | 
						|
    }
 | 
						|
 | 
						|
    mp->codes_count = get_bits(&gb, 4);
 | 
						|
    if (mp->codes_count == 0)
 | 
						|
        goto end;
 | 
						|
 | 
						|
    if (mp->changes_map[0] == 0) {
 | 
						|
        *(uint16_t *)mp->frame.data[0] = get_bits(&gb, 15);
 | 
						|
        mp->changes_map[0] = 1;
 | 
						|
    }
 | 
						|
    if (mp_read_codes_table(mp, &gb) < 0)
 | 
						|
        goto end;
 | 
						|
 | 
						|
    sz = get_bits(&gb, 18);
 | 
						|
    if (avctx->extradata[0] != 5)
 | 
						|
        sz += get_bits(&gb, 18);
 | 
						|
    if (sz == 0)
 | 
						|
        goto end;
 | 
						|
 | 
						|
    if (mp->max_codes_bits <= 0)
 | 
						|
        goto end;
 | 
						|
    if (init_vlc(&mp->vlc, mp->max_codes_bits, mp->codes_count, &mp->codes[0].size, sizeof(HuffCode), 1, &mp->codes[0].code, sizeof(HuffCode), 4, 0))
 | 
						|
        goto end;
 | 
						|
    mp_decode_frame_helper(mp, &gb);
 | 
						|
    ff_free_vlc(&mp->vlc);
 | 
						|
 | 
						|
end:
 | 
						|
    *got_frame       = 1;
 | 
						|
    *(AVFrame *)data = mp->frame;
 | 
						|
    return buf_size;
 | 
						|
}
 | 
						|
 | 
						|
static av_cold int mp_decode_end(AVCodecContext *avctx)
 | 
						|
{
 | 
						|
    MotionPixelsContext *mp = avctx->priv_data;
 | 
						|
 | 
						|
    av_freep(&mp->changes_map);
 | 
						|
    av_freep(&mp->vpt);
 | 
						|
    av_freep(&mp->hpt);
 | 
						|
    av_freep(&mp->bswapbuf);
 | 
						|
    if (mp->frame.data[0])
 | 
						|
        avctx->release_buffer(avctx, &mp->frame);
 | 
						|
 | 
						|
    return 0;
 | 
						|
}
 | 
						|
 | 
						|
AVCodec ff_motionpixels_decoder = {
 | 
						|
    .name           = "motionpixels",
 | 
						|
    .type           = AVMEDIA_TYPE_VIDEO,
 | 
						|
    .id             = AV_CODEC_ID_MOTIONPIXELS,
 | 
						|
    .priv_data_size = sizeof(MotionPixelsContext),
 | 
						|
    .init           = mp_decode_init,
 | 
						|
    .close          = mp_decode_end,
 | 
						|
    .decode         = mp_decode_frame,
 | 
						|
    .capabilities   = CODEC_CAP_DR1,
 | 
						|
    .long_name      = NULL_IF_CONFIG_SMALL("Motion Pixels video"),
 | 
						|
};
 |