ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-19 21:06:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

dxa: port to bytestream2 API

Browse Source 
Protects against overreads in input buffer.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
This commit is contained in:
Paul B Mahol 2012-12-06 18:38:07 +00:00
parent 547b8aeed4
commit 586c2528a0
1 changed files with 18 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
libavcodec/dxa.c
View File

@ -29,6 +29,7 @@
#include "libavutil/common.h" #include "libavutil/common.h"
#include "libavutil/intreadwrite.h" #include "libavutil/intreadwrite.h"
#include "bytestream.h"
#include "avcodec.h" #include "avcodec.h"
#include "internal.h" #include "internal.h"
@ -191,29 +192,23 @@ static int decode_13(AVCodecContext *avctx, DxaDecContext *c, uint8_t* dst, uint
static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPacket *avpkt) static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPacket *avpkt)
{ {
const uint8_t *buf = avpkt->data;
int buf_size = avpkt->size;
DxaDecContext * const c = avctx->priv_data; DxaDecContext * const c = avctx->priv_data;
uint8_t *outptr, *srcptr, *tmpptr; uint8_t *outptr, *srcptr, *tmpptr;
unsigned long dsize; unsigned long dsize;
int i, j, compr, ret; int i, j, compr, ret;
int stride; int stride;
int orig_buf_size = buf_size;
int pc = 0; int pc = 0;
GetByteContext gb;
bytestream2_init(&gb, avpkt->data, avpkt->size);
/* make the palette available on the way out */ /* make the palette available on the way out */
if(buf[0]=='C' && buf[1]=='M' && buf[2]=='A' && buf[3]=='P'){ if (bytestream2_peek_le32(&gb) == MKTAG('C','M','A','P')) {
int r, g, b; bytestream2_skip(&gb, 4);
buf += 4;
for(i = 0; i < 256; i++){ for(i = 0; i < 256; i++){
r = *buf++; c->pal[i] = 0xFFU << 24 | bytestream2_get_be24(&gb);
g = *buf++;
b = *buf++;
c->pal[i] = 0xFFU << 24 | r << 16 | g << 8 | b;
} }
pc = 1; pc = 1;
buf_size -= 768+4;
} }
if ((ret = ff_get_buffer(avctx, &c->pic)) < 0){ if ((ret = ff_get_buffer(avctx, &c->pic)) < 0){
@ -228,15 +223,19 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
tmpptr = c->prev.data[0]; tmpptr = c->prev.data[0];
stride = c->pic.linesize[0]; stride = c->pic.linesize[0];
if(buf[0]=='N' && buf[1]=='U' && buf[2]=='L' && buf[3]=='L') if (bytestream2_get_le32(&gb) == MKTAG('N','U','L','L'))
compr = -1; compr = -1;
else else
compr = buf[4]; compr = bytestream2_get_byte(&gb);
dsize = c->dsize; dsize = c->dsize;
if((compr != 4 && compr != -1) && uncompress(c->decomp_buf, &dsize, buf + 9, buf_size - 9) != Z_OK){ if (compr != 4 && compr != -1) {
av_log(avctx, AV_LOG_ERROR, "Uncompress failed!\n"); bytestream2_skip(&gb, 4);
return AVERROR_INVALIDDATA; if (uncompress(c->decomp_buf, &dsize, avpkt->data + bytestream2_tell(&gb),
bytestream2_get_bytes_left(&gb)) != Z_OK) {
av_log(avctx, AV_LOG_ERROR, "Uncompress failed!\n");
return AVERROR_INVALIDDATA;
}
} }
switch(compr){ switch(compr){
case -1: case -1:
@ -278,7 +277,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
decode_13(avctx, c, c->pic.data[0], srcptr, c->prev.data[0]); decode_13(avctx, c, c->pic.data[0], srcptr, c->prev.data[0]);
break; break;
default: default:
av_log(avctx, AV_LOG_ERROR, "Unknown/unsupported compression type %d\n", buf[4]); av_log(avctx, AV_LOG_ERROR, "Unknown/unsupported compression type %d\n", compr);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
@ -290,7 +289,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
*(AVFrame*)data = c->prev; *(AVFrame*)data = c->prev;
/* always report that the buffer was completely consumed */ /* always report that the buffer was completely consumed */
return orig_buf_size; return avpkt->size;
} }
static av_cold int decode_init(AVCodecContext *avctx) static av_cold int decode_init(AVCodecContext *avctx)