aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/svq1dec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2014-08-07 02:06:45 +0200
committerMichael Niedermayer <michaelni@gmx.at>2014-08-07 02:08:56 +0200
commite55e09949e59163bed71b6e9e9ee4098186a1f21 (patch)
treef688ebd1050d86120172f784c7eb675c1fce099f /libavcodec/svq1dec.c
parentc62862799575e720b02cf640429da598d43d8b07 (diff)
parent7b588bb691644e1b3c168b99accf74248a24e3cf (diff)
downloadffmpeg-e55e09949e59163bed71b6e9e9ee4098186a1f21.tar.gz
Merge commit '7b588bb691644e1b3c168b99accf74248a24e3cf'
* commit '7b588bb691644e1b3c168b99accf74248a24e3cf': svq1: do not modify the input packet Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/svq1dec.c')
-rw-r--r--libavcodec/svq1dec.c24
1 files changed, 23 insertions, 1 deletions
diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c
index 1e7ab494a8..cab9bac901 100644
--- a/libavcodec/svq1dec.c
+++ b/libavcodec/svq1dec.c
@@ -60,6 +60,10 @@ typedef struct SVQ1Context {
HpelDSPContext hdsp;
GetBitContext gb;
AVFrame *prev;
+
+ uint8_t *pkt_swapped;
+ int pkt_swapped_allocated;
+
int width;
int height;
int frame_code;
@@ -624,7 +628,24 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data,
/* swap some header bytes (why?) */
if (s->frame_code != 0x20) {
- uint32_t *src = (uint32_t *)(buf + 4);
+ uint32_t *src;
+
+ if (buf_size < 9 * 4) {
+ av_log(avctx, AV_LOG_ERROR, "Input packet too small\n");
+ return AVERROR_INVALIDDATA;
+ }
+
+ av_fast_malloc(s->pkt_swapped, &s->pkt_swapped_allocated,
+ buf_size);
+ if (!s->pkt_swapped)
+ return AVERROR(ENOMEM);
+
+ memcpy(s->pkt_swapped, buf, buf_size);
+ buf = s->pkt_swapped;
+ init_get_bits(&s->gb, buf, buf_size * 8);
+ skip_bits(&s->gb, 22);
+
+ src = (uint32_t *)(s->pkt_swapped + 4);
if (buf_size < 36)
return AVERROR_INVALIDDATA;
@@ -796,6 +817,7 @@ static av_cold int svq1_decode_end(AVCodecContext *avctx)
SVQ1Context *s = avctx->priv_data;
av_frame_free(&s->prev);
+ av_freep(&s->pkt_swapped);
return 0;
}