diff options
| author | Paul B Mahol <onemda@gmail.com> | 2017-02-27 11:39:36 +0100 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2017-02-27 11:39:36 +0100 |
| commit | dc78696ea4b82b46e4c1a26e6bb1ebe0f4652101 (patch) | |
| tree | 5dddb92171652819978c026ee1b08da363ad9634 | |
| parent | 05aa53dc553a9f824d81d7eaa0eb16b978264276 (diff) | |
| download | ffmpeg-dc78696ea4b82b46e4c1a26e6bb1ebe0f4652101.tar.gz | |
avcodec/qdrw: fix decoding odd size images for 2bpp and 4bpp
Signed-off-by: Paul B Mahol <onemda@gmail.com>
| -rw-r--r-- | libavcodec/qdrw.c | 60 |
1 files changed, 24 insertions, 36 deletions
diff --git a/libavcodec/qdrw.c b/libavcodec/qdrw.c index e09872bf3e..11a06751ac 100644 --- a/libavcodec/qdrw.c +++ b/libavcodec/qdrw.c @@ -91,31 +91,27 @@ static int decode_rle_bpp2(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb if (code & 0x80 ) { /* run */ pix = bytestream2_get_byte(gbc); for (j = 0; j < 257 - code; j++) { - out[pos++] = (pix & 0xC0) >> 6; - out[pos++] = (pix & 0x30) >> 4; - out[pos++] = (pix & 0x0C) >> 2; - out[pos++] = (pix & 0x03); - if (pos >= offset) { - pos -= offset; - pos++; - } - if (pos >= offset) - return AVERROR_INVALIDDATA; + if (pos < offset) + out[pos++] = (pix & 0xC0) >> 6; + if (pos < offset) + out[pos++] = (pix & 0x30) >> 4; + if (pos < offset) + out[pos++] = (pix & 0x0C) >> 2; + if (pos < offset) + out[pos++] = (pix & 0x03); } left -= 2; } else { /* copy */ for (j = 0; j < code + 1; j++) { pix = bytestream2_get_byte(gbc); - out[pos++] = (pix & 0xC0) >> 6; - out[pos++] = (pix & 0x30) >> 4; - out[pos++] = (pix & 0x0C) >> 2; - out[pos++] = (pix & 0x03); - if (pos >= offset) { - pos -= offset; - pos++; - } - if (pos >= offset) - return AVERROR_INVALIDDATA; + if (pos < offset) + out[pos++] = (pix & 0xC0) >> 6; + if (pos < offset) + out[pos++] = (pix & 0x30) >> 4; + if (pos < offset) + out[pos++] = (pix & 0x0C) >> 2; + if (pos < offset) + out[pos++] = (pix & 0x03); } left -= 1 + (code + 1); } @@ -147,27 +143,19 @@ static int decode_rle_bpp4(AVCodecContext *avctx, AVFrame *p, GetByteContext *gb if (code & 0x80 ) { /* run */ pix = bytestream2_get_byte(gbc); for (j = 0; j < 257 - code; j++) { - out[pos++] = (pix & 0xF0) >> 4; - out[pos++] = pix & 0xF; - if (pos >= offset) { - pos -= offset; - pos++; - } - if (pos >= offset) - return AVERROR_INVALIDDATA; + if (pos < offset) + out[pos++] = (pix & 0xF0) >> 4; + if (pos < offset) + out[pos++] = pix & 0xF; } left -= 2; } else { /* copy */ for (j = 0; j < code + 1; j++) { pix = bytestream2_get_byte(gbc); - out[pos++] = (pix & 0xF0) >> 4; - out[pos++] = pix & 0xF; - if (pos >= offset) { - pos -= offset; - pos++; - } - if (pos >= offset) - return AVERROR_INVALIDDATA; + if (pos < offset) + out[pos++] = (pix & 0xF0) >> 4; + if (pos < offset) + out[pos++] = pix & 0xF; } left -= 1 + (code + 1); } |