diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2013-09-03 13:17:20 +0200 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2013-09-03 13:44:44 +0200 |
commit | 8ba683e629bd44f5c222ff8fe9cfdc101177dc0f (patch) | |
tree | 41d00f799cc67751e1c7ccaf03e3b4f5938a2212 /libavcodec/vcr1.c | |
parent | 92b7e7b31817cd470c38f84bac2053cd565ae521 (diff) | |
parent | 8aba7968dd604aae91ee42cbce0be3dad7dceb30 (diff) | |
download | ffmpeg-8ba683e629bd44f5c222ff8fe9cfdc101177dc0f.tar.gz |
Merge commit '8aba7968dd604aae91ee42cbce0be3dad7dceb30'
* commit '8aba7968dd604aae91ee42cbce0be3dad7dceb30':
vcr1: add sanity checks
Conflicts:
libavcodec/vcr1.c
See: 845724c82c1a732ab398c9e8cedd178f96f1626d
See: 8e09482e4d27d65bbce2ce5c2f4392216011ed09
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vcr1.c')
-rw-r--r-- | libavcodec/vcr1.c | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/libavcodec/vcr1.c b/libavcodec/vcr1.c index 60bfcce41e..a5ea82d1d6 100644 --- a/libavcodec/vcr1.c +++ b/libavcodec/vcr1.c @@ -38,9 +38,10 @@ static av_cold int vcr1_decode_init(AVCodecContext *avctx) avctx->pix_fmt = AV_PIX_FMT_YUV410P; if (avctx->width % 8 || avctx->height%4) { - avpriv_request_sample(avctx, "odd dimensions support"); - return AVERROR_PATCHWELCOME; + avpriv_request_sample(avctx, "odd dimensions (%d x %d) support", avctx->width, avctx->height); + return AVERROR_INVALIDDATA; } + return 0; } @@ -64,9 +65,13 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, p->pict_type = AV_PICTURE_TYPE_I; p->key_frame = 1; + if (buf_size < 32) + goto packet_small; + for (i = 0; i < 16; i++) { a->delta[i] = *bytestream++; bytestream++; + buf_size--; } for (y = 0; y < avctx->height; y++) { @@ -77,8 +82,12 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, uint8_t *cb = &p->data[1][(y >> 2) * p->linesize[1]]; uint8_t *cr = &p->data[2][(y >> 2) * p->linesize[2]]; + if (buf_size < 4 + avctx->width) + goto packet_small; + for (i = 0; i < 4; i++) a->offset[i] = *bytestream++; + buf_size -= 4; offset = a->offset[0] - a->delta[bytestream[2] & 0xF]; for (x = 0; x < avctx->width; x += 4) { @@ -92,8 +101,12 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, *cr++ = bytestream[1]; bytestream += 4; + buf_size -= 4; } } else { + if (buf_size < avctx->width / 2) + goto packet_small; + offset = a->offset[y & 3] - a->delta[bytestream[2] & 0xF]; for (x = 0; x < avctx->width; x += 8) { @@ -107,6 +120,7 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, luma[7] = offset += a->delta[bytestream[1] >> 4]; luma += 8; bytestream += 4; + buf_size -= 4; } } } @@ -114,6 +128,9 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, *got_frame = 1; return buf_size; +packet_small: + av_log(avctx, AV_LOG_ERROR, "Input packet too small.\n"); + return AVERROR_INVALIDDATA; } AVCodec ff_vcr1_decoder = { |