diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-24 12:57:08 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-24 13:08:42 +0100 |
| commit | 714ff44858a07578e592dfabd9e1f0a5edbf80bf (patch) | |
| tree | 4cb4d03407e52ad0ca4a170eff7e95c1eadf095d | |
| parent | 4ba35194a9d79b80a606aafe8744d82de5b4bcf4 (diff) | |
| parent | 067432c1c95882c7221e694f33d9f3bdbe46de7f (diff) | |
| download | ffmpeg-714ff44858a07578e592dfabd9e1f0a5edbf80bf.tar.gz | |
Merge commit '067432c1c95882c7221e694f33d9f3bdbe46de7f'
* commit '067432c1c95882c7221e694f33d9f3bdbe46de7f':
loco: check that there is data left after decoding a plane.
lagarith: avoid infinite loop in lag_rac_refill()
Conflicts:
libavcodec/loco.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/lagarithrac.h | 3 | ||||
| -rw-r--r-- | libavcodec/loco.c | 9 |
2 files changed, 9 insertions, 3 deletions
diff --git a/libavcodec/lagarithrac.h b/libavcodec/lagarithrac.h index d8d38f2054..9892d11fb3 100644 --- a/libavcodec/lagarithrac.h +++ b/libavcodec/lagarithrac.h @@ -107,6 +107,9 @@ static inline uint8_t lag_get_rac(lag_rac *l) l->range -= range_scaled * l->prob[255]; } + if (!l->range) + l->range = 0x80; + l->low -= range_scaled * l->prob[val]; return val; diff --git a/libavcodec/loco.c b/libavcodec/loco.c index 9958c148c7..559f7c2026 100644 --- a/libavcodec/loco.c +++ b/libavcodec/loco.c @@ -190,7 +190,7 @@ static int decode_frame(AVCodecContext *avctx, p->key_frame = 1; #define ADVANCE_BY_DECODED do { \ - if (decoded < 0) goto stop; \ + if (decoded < 0 || decoded >= buf_size) goto buf_too_small; \ buf += decoded; buf_size -= decoded; \ } while(0) switch(l->mode) { @@ -224,7 +224,8 @@ static int decode_frame(AVCodecContext *avctx, decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 2, avctx->width, avctx->height, -p->linesize[0], buf, buf_size, 3); break; - case LOCO_CRGBA: case LOCO_RGBA: + case LOCO_CRGBA: + case LOCO_RGBA: decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1), avctx->width, avctx->height, -p->linesize[0], buf, buf_size, 4); ADVANCE_BY_DECODED; @@ -238,12 +239,14 @@ static int decode_frame(AVCodecContext *avctx, -p->linesize[0], buf, buf_size, 4); break; } -stop: *got_frame = 1; *(AVFrame*)data = l->pic; return buf_size < 0 ? -1 : avpkt->size - buf_size; +buf_too_small: + av_log(avctx, AV_LOG_ERROR, "Input data too small.\n"); + return AVERROR(EINVAL); } static av_cold int decode_init(AVCodecContext *avctx) |