Mercurial > libavcodec.hg
annotate xsubdec.c @ 5817:ced30500e2b1 libavcodec
prevent infinite loop and memcpy of negative amounts
fixes issue194
author | michael |
---|---|
date | Sat, 13 Oct 2007 12:25:31 +0000 |
parents | 80b481ec72a6 |
children | 1900b70712ab |
rev | line source |
---|---|
5493 | 1 /* |
2 * XSUB subtitle decoder | |
3 * Copyright (c) 2007 Reimar Döffinger | |
4 * | |
5 * This file is part of FFmpeg. | |
6 * | |
7 * FFmpeg is free software; you can redistribute it and/or | |
8 * modify it under the terms of the GNU Lesser General Public | |
9 * License as published by the Free Software Foundation; either | |
10 * version 2.1 of the License, or (at your option) any later version. | |
11 * | |
12 * FFmpeg is distributed in the hope that it will be useful, | |
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
15 * Lesser General Public License for more details. | |
16 * | |
17 * You should have received a copy of the GNU Lesser General Public | |
18 * License along with FFmpeg; if not, write to the Free Software | |
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | |
20 */ | |
5483 | 21 #include "avcodec.h" |
22 #include "bitstream.h" | |
23 #include "bytestream.h" | |
24 | |
25 static int decode_init(AVCodecContext *avctx) { | |
26 avctx->pix_fmt = PIX_FMT_PAL8; | |
27 return 0; | |
28 } | |
29 | |
5484 | 30 static const uint8_t tc_offsets[9] = { 0, 1, 3, 4, 6, 7, 9, 10, 11 }; |
31 static const uint8_t tc_muls[9] = { 10, 6, 10, 6, 10, 6, 10, 10, 1 }; | |
32 | |
5492
922a668222f0
Remove AVCodecContext parameter from parse_timecode function
reimar
parents:
5491
diff
changeset
|
33 static uint64_t parse_timecode(uint8_t *buf) { |
5484 | 34 int i; |
35 int64_t ms = 0; | |
36 if (buf[2] != ':' || buf[5] != ':' || buf[8] != '.') | |
37 return AV_NOPTS_VALUE; | |
38 for (i = 0; i < sizeof(tc_offsets); i++) { | |
39 uint8_t c = buf[tc_offsets[i]] - '0'; | |
40 if (c > 9) return AV_NOPTS_VALUE; | |
41 ms = (ms + c) * tc_muls[i]; | |
42 } | |
43 return ms; | |
44 } | |
45 | |
5483 | 46 static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, |
47 uint8_t *buf, int buf_size) { | |
48 AVSubtitle *sub = data; | |
49 uint8_t *buf_end = buf + buf_size; | |
50 uint8_t *bitmap; | |
51 int w, h, x, y, rlelen, i; | |
52 GetBitContext gb; | |
53 | |
54 // check that at least header fits | |
55 if (buf_size < 27 + 7 * 2 + 4 * 3) { | |
56 av_log(avctx, AV_LOG_ERROR, "coded frame too small\n"); | |
57 return -1; | |
58 } | |
59 | |
5484 | 60 // read start and end time |
61 if (buf[0] != '[' || buf[13] != '-' || buf[26] != ']') { | |
62 av_log(avctx, AV_LOG_ERROR, "invalid time code\n"); | |
63 return -1; | |
64 } | |
5492
922a668222f0
Remove AVCodecContext parameter from parse_timecode function
reimar
parents:
5491
diff
changeset
|
65 sub->start_display_time = parse_timecode(buf + 1); |
922a668222f0
Remove AVCodecContext parameter from parse_timecode function
reimar
parents:
5491
diff
changeset
|
66 sub->end_display_time = parse_timecode(buf + 14); |
5484 | 67 buf += 27; |
68 | |
5483 | 69 // read header |
70 w = bytestream_get_le16(&buf); | |
71 h = bytestream_get_le16(&buf); | |
72 if (avcodec_check_dimensions(avctx, w, h) < 0) | |
73 return -1; | |
74 x = bytestream_get_le16(&buf); | |
75 y = bytestream_get_le16(&buf); | |
76 // skip bottom right position, it gives no new information | |
77 bytestream_get_le16(&buf); | |
78 bytestream_get_le16(&buf); | |
79 rlelen = bytestream_get_le16(&buf); | |
80 | |
81 // allocate sub and set values | |
82 if (!sub->rects) { | |
83 sub->rects = av_mallocz(sizeof(AVSubtitleRect)); | |
84 sub->num_rects = 1; | |
85 } | |
5485 | 86 av_freep(&sub->rects[0].bitmap); |
5483 | 87 sub->rects[0].x = x; sub->rects[0].y = y; |
88 sub->rects[0].w = w; sub->rects[0].h = h; | |
89 sub->rects[0].linesize = w; | |
90 sub->rects[0].bitmap = av_malloc(w * h); | |
91 sub->rects[0].nb_colors = 4; | |
92 sub->rects[0].rgba_palette = av_malloc(sub->rects[0].nb_colors * 4); | |
93 | |
94 // read palette | |
95 for (i = 0; i < sub->rects[0].nb_colors; i++) | |
96 sub->rects[0].rgba_palette[i] = bytestream_get_be24(&buf); | |
5489
dc54869af30b
Colours except background should not be transparent
reimar
parents:
5488
diff
changeset
|
97 // make all except background (first entry) non-transparent |
dc54869af30b
Colours except background should not be transparent
reimar
parents:
5488
diff
changeset
|
98 for (i = 1; i < sub->rects[0].nb_colors; i++) |
dc54869af30b
Colours except background should not be transparent
reimar
parents:
5488
diff
changeset
|
99 sub->rects[0].rgba_palette[i] |= 0xff000000; |
5483 | 100 |
101 // process RLE-compressed data | |
102 rlelen = FFMIN(rlelen, buf_end - buf); | |
103 init_get_bits(&gb, buf, rlelen * 8); | |
104 bitmap = sub->rects[0].bitmap; | |
105 for (y = 0; y < h; y++) { | |
5490 | 106 // interlaced: do odd lines |
5491 | 107 if (y == (h + 1) / 2) bitmap = sub->rects[0].bitmap + w; |
5483 | 108 for (x = 0; x < w; ) { |
109 int log2 = ff_log2_tab[show_bits(&gb, 8)]; | |
5487
3039b660bf35
get rid of xsubdec array and calculate value instead
reimar
parents:
5486
diff
changeset
|
110 int run = get_bits(&gb, 14 - 4 * (log2 >> 1)); |
5483 | 111 int colour = get_bits(&gb, 2); |
112 run = FFMIN(run, w - x); | |
113 // run length 0 means till end of row | |
114 if (!run) run = w - x; | |
115 memset(bitmap, colour, run); | |
116 bitmap += run; | |
117 x += run; | |
118 } | |
5490 | 119 // interlaced, skip every second line |
120 bitmap += w; | |
5483 | 121 align_get_bits(&gb); |
122 } | |
123 *data_size = 1; | |
124 return buf_size; | |
125 } | |
126 | |
127 AVCodec xsub_decoder = { | |
128 "xsub", | |
129 CODEC_TYPE_SUBTITLE, | |
130 CODEC_ID_XSUB, | |
131 0, | |
132 decode_init, | |
133 NULL, | |
134 NULL, | |
135 decode_frame, | |
136 }; |