diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-01-27 01:42:53 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-27 02:09:58 +0100 |
commit | 01fcbdf9cedcf14418b5886205261e532167f949 (patch) | |
tree | 8022d29d337142d81b3a05a0927a5ec90a67b25f /libavcodec | |
parent | a8ae00b68cb9895f4a819950dbc740bc8fc7c1e1 (diff) | |
parent | 9adf25c1cf78dbf1d71bf386c49dc74cb8a60df0 (diff) | |
download | ffmpeg-01fcbdf9cedcf14418b5886205261e532167f949.tar.gz |
Merge remote-tracking branch 'qatar/master'n0.11-dev
* qatar/master:
smacker: Sanity check huffman tables found in the headers.
smacker: remove dead store
qdm2: Check data block size for bytes to bits overflow.
mxfdec: Fix files with essence containers larger than 2 GiB.
mxfdec: Employ correct printf conversion specifiers for POSIX int types.
vc1: always read the bfraction element for interlaced fields
fate: add XWD image regression test
lavf: prevent infinite loops while flushing in avformat_find_stream_info
matroskadec: Pad AAC extradata.
ismindex: Fix build on mingw
Conflicts:
libavformat/mxfdec.c
libavformat/utils.c
tests/lavf-regression.sh
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
-rw-r--r-- | libavcodec/smacker.c | 26 | ||||
-rw-r--r-- | libavcodec/vc1.c | 26 |
2 files changed, 26 insertions, 26 deletions
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index 2a8bae8a1b..a60a2b051b 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -128,12 +128,12 @@ static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t pref */ static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx) { + if (hc->current + 1 >= hc->length) { + av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n"); + return -1; + } if(!get_bits1(gb)){ //Leaf int val, i1, i2, b1, b2; - if(hc->current >= hc->length){ - av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n"); - return -1; - } b1 = get_bits_count(gb); i1 = ctx->v1->table ? get_vlc2(gb, ctx->v1->table, SMKTREE_BITS, 3) : 0; b1 = get_bits_count(gb) - b1; @@ -157,7 +157,7 @@ static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx hc->values[hc->current++] = val; return 1; } else { //Node - int r = 0, t; + int r = 0, r_new, t; t = hc->current++; r = smacker_decode_bigtree(gb, hc, ctx); @@ -165,8 +165,10 @@ static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx return r; hc->values[t] = SMK_NODE | r; r++; - r += smacker_decode_bigtree(gb, hc, ctx); - return r; + r_new = smacker_decode_bigtree(gb, hc, ctx); + if (r_new < 0) + return r_new; + return r + r_new; } } @@ -181,6 +183,7 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int VLC vlc[2]; int escapes[3]; DBCtx ctx; + int err = 0; if(size >= UINT_MAX>>4){ // (((size + 3) >> 2) + 3) << 2 must not overflow av_log(smk->avctx, AV_LOG_ERROR, "size too large\n"); @@ -254,7 +257,8 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int huff.current = 0; huff.values = av_mallocz(huff.length * sizeof(int)); - smacker_decode_bigtree(gb, &huff, &ctx); + if (smacker_decode_bigtree(gb, &huff, &ctx) < 0) + err = -1; skip_bits1(gb); if(ctx.last[0] == -1) ctx.last[0] = huff.current++; if(ctx.last[1] == -1) ctx.last[1] = huff.current++; @@ -278,7 +282,7 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int av_free(tmp2.lengths); av_free(tmp2.values); - return 0; + return err; } static int decode_header_trees(SmackVContext *smk) { @@ -339,16 +343,14 @@ static av_always_inline void last_reset(int *recode, int *last) { /* get code and update history */ static av_always_inline int smk_get_code(GetBitContext *gb, int *recode, int *last) { register int *table = recode; - int v, b; + int v; - b = get_bits_count(gb); while(*table & SMK_NODE) { if(get_bits1(gb)) table += (*table) & (~SMK_NODE); table++; } v = *table; - b = get_bits_count(gb) - b; if(v != recode[last[0]]) { recode[last[2]] = recode[last[1]]; diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c index 64884fcc50..a012967e3e 100644 --- a/libavcodec/vc1.c +++ b/libavcodec/vc1.c @@ -901,20 +901,18 @@ int vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb) if (v->field_mode) { if (!v->refdist_flag) v->refdist = 0; - else { - if ((v->s.pict_type != AV_PICTURE_TYPE_B) - && (v->s.pict_type != AV_PICTURE_TYPE_BI)) { - v->refdist = get_bits(gb, 2); - if (v->refdist == 3) - v->refdist += get_unary(gb, 0, 16); - } else { - v->bfraction_lut_index = get_vlc2(gb, ff_vc1_bfraction_vlc.table, VC1_BFRACTION_VLC_BITS, 1); - v->bfraction = ff_vc1_bfraction_lut[v->bfraction_lut_index]; - v->frfd = (v->bfraction * v->refdist) >> 8; - v->brfd = v->refdist - v->frfd - 1; - if (v->brfd < 0) - v->brfd = 0; - } + else if ((v->s.pict_type != AV_PICTURE_TYPE_B) && (v->s.pict_type != AV_PICTURE_TYPE_BI)) { + v->refdist = get_bits(gb, 2); + if (v->refdist == 3) + v->refdist += get_unary(gb, 0, 16); + } + if ((v->s.pict_type == AV_PICTURE_TYPE_B) || (v->s.pict_type == AV_PICTURE_TYPE_BI)) { + v->bfraction_lut_index = get_vlc2(gb, ff_vc1_bfraction_vlc.table, VC1_BFRACTION_VLC_BITS, 1); + v->bfraction = ff_vc1_bfraction_lut[v->bfraction_lut_index]; + v->frfd = (v->bfraction * v->refdist) >> 8; + v->brfd = v->refdist - v->frfd - 1; + if (v->brfd < 0) + v->brfd = 0; } goto parse_common_info; } |