diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2014-08-07 02:06:45 +0200 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2014-08-07 02:08:56 +0200 |
commit | e55e09949e59163bed71b6e9e9ee4098186a1f21 (patch) | |
tree | f688ebd1050d86120172f784c7eb675c1fce099f /libavcodec/svq1dec.c | |
parent | c62862799575e720b02cf640429da598d43d8b07 (diff) | |
parent | 7b588bb691644e1b3c168b99accf74248a24e3cf (diff) | |
download | ffmpeg-e55e09949e59163bed71b6e9e9ee4098186a1f21.tar.gz |
Merge commit '7b588bb691644e1b3c168b99accf74248a24e3cf'
* commit '7b588bb691644e1b3c168b99accf74248a24e3cf':
svq1: do not modify the input packet
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/svq1dec.c')
-rw-r--r-- | libavcodec/svq1dec.c | 24 |
1 files changed, 23 insertions, 1 deletions
diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c index 1e7ab494a8..cab9bac901 100644 --- a/libavcodec/svq1dec.c +++ b/libavcodec/svq1dec.c @@ -60,6 +60,10 @@ typedef struct SVQ1Context { HpelDSPContext hdsp; GetBitContext gb; AVFrame *prev; + + uint8_t *pkt_swapped; + int pkt_swapped_allocated; + int width; int height; int frame_code; @@ -624,7 +628,24 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data, /* swap some header bytes (why?) */ if (s->frame_code != 0x20) { - uint32_t *src = (uint32_t *)(buf + 4); + uint32_t *src; + + if (buf_size < 9 * 4) { + av_log(avctx, AV_LOG_ERROR, "Input packet too small\n"); + return AVERROR_INVALIDDATA; + } + + av_fast_malloc(s->pkt_swapped, &s->pkt_swapped_allocated, + buf_size); + if (!s->pkt_swapped) + return AVERROR(ENOMEM); + + memcpy(s->pkt_swapped, buf, buf_size); + buf = s->pkt_swapped; + init_get_bits(&s->gb, buf, buf_size * 8); + skip_bits(&s->gb, 22); + + src = (uint32_t *)(s->pkt_swapped + 4); if (buf_size < 36) return AVERROR_INVALIDDATA; @@ -796,6 +817,7 @@ static av_cold int svq1_decode_end(AVCodecContext *avctx) SVQ1Context *s = avctx->priv_data; av_frame_free(&s->prev); + av_freep(&s->pkt_swapped); return 0; } |