Merge commit '9d5f4f025304ac7c69775179044e6f69f370441a' into release/0.10

* commit '9d5f4f025304ac7c69775179044e6f69f370441a':
  svq1: do not modify the input packet

Merged-by: Michael Niedermayer <michaelni@gmx.at>

2 files changed, 26 insertions, 5 deletions

diff --git a/libavcodec/mpegvideo.h b/libavcodec/mpegvideo.h
index f7c8fb784e..810367541b 100644
--- a/libavcodec/mpegvideo.h
+++ b/libavcodec/mpegvideo.h
@@ -686,6 +686,9 @@ typedef struct MpegEncContext {
     int (*dct_quantize)(struct MpegEncContext *s, DCTELEM *block/*align 16*/, int n, int qscale, int *overflow);
     int (*fast_dct_quantize)(struct MpegEncContext *s, DCTELEM *block/*align 16*/, int n, int qscale, int *overflow);
     void (*denoise_dct)(struct MpegEncContext *s, DCTELEM *block);
+
+    uint8_t *pkt_swapped;
+    int pkt_swapped_allocated;
 } MpegEncContext;
 
 #define REBASE_PICTURE(pic, new_ctx, old_ctx) (pic ? \
diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c
index cccc152906..224aef5ed1 100644
--- a/libavcodec/svq1dec.c
+++ b/libavcodec/svq1dec.c
@@ -644,13 +644,29 @@ static int svq1_decode_frame(AVCodecContext *avctx,
     return -1;
 
   /* swap some header bytes (why?) */
-  if (s->f_code != 0x20) {
-    uint32_t *src = (uint32_t *) (buf + 4);
+    if (s->f_code != 0x20) {
+        uint32_t *src;
 
-    for (i=0; i < 4; i++) {
-      src[i] = ((src[i] << 16) | (src[i] >> 16)) ^ src[7 - i];
+        if (buf_size < 9 * 4) {
+            av_log(avctx, AV_LOG_ERROR, "Input packet too small\n");
+            return AVERROR_INVALIDDATA;
+        }
+
+        av_fast_malloc(s->pkt_swapped, &s->pkt_swapped_allocated,
+                       buf_size);
+        if (!s->pkt_swapped)
+            return AVERROR(ENOMEM);
+
+        memcpy(s->pkt_swapped, buf, buf_size);
+        buf = s->pkt_swapped;
+        init_get_bits(&s->gb, buf, buf_size * 8);
+        skip_bits(&s->gb, 22);
+
+        src = (uint32_t *)(s->pkt_swapped + 4);
+
+        for (i = 0; i < 4; i++)
+            src[i] = ((src[i] << 16) | (src[i] >> 16)) ^ src[7 - i];
     }
-  }
 
   result = svq1_decode_frame_header (&s->gb, s);
 
@@ -804,6 +820,8 @@ static av_cold int svq1_decode_end(AVCodecContext *avctx)
 {
     MpegEncContext *s = avctx->priv_data;
 
+    av_freep(&s->pkt_swapped);
+
     MPV_common_end(s);
     return 0;
 }