Mercurial > libavcodec.hg

comparison flicvideo.c @ 4199:214d3d9b69dc libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix possible overflows. Found by Steven Johnson
author alex
date Tue, 14 Nov 2006 19:19:13 +0000
parents 1bf7bc44430f
children cb5e46ee0495
comparison
equal deleted inserted replaced
4198:18a371831f05 4199:214d3d9b69dc
154 int lines; 154 int lines;
155 int compressed_lines; 155 int compressed_lines;
156 int starting_line; 156 int starting_line;
157 signed short line_packets; 157 signed short line_packets;
158 int y_ptr; 158 int y_ptr;
159 signed char byte_run; 159 int byte_run;
160 int pixel_skip; 160 int pixel_skip;
161 int pixel_countdown; 161 int pixel_countdown;
162 unsigned char *pixels; 162 unsigned char *pixels;
163 int pixel_limit; 163 int pixel_limit;
164 164
256 for (i = 0; i < line_packets; i++) { 256 for (i = 0; i < line_packets; i++) {
257 /* account for the skip bytes */ 257 /* account for the skip bytes */
258 pixel_skip = buf[stream_ptr++]; 258 pixel_skip = buf[stream_ptr++];
259 pixel_ptr += pixel_skip; 259 pixel_ptr += pixel_skip;
260 pixel_countdown -= pixel_skip; 260 pixel_countdown -= pixel_skip;
261 byte_run = buf[stream_ptr++]; 261 byte_run = (signed char)(buf[stream_ptr++]);
262 if (byte_run < 0) { 262 if (byte_run < 0) {
263 byte_run = -byte_run; 263 byte_run = -byte_run;
264 palette_idx1 = buf[stream_ptr++]; 264 palette_idx1 = buf[stream_ptr++];
265 palette_idx2 = buf[stream_ptr++]; 265 palette_idx2 = buf[stream_ptr++];
266 CHECK_PIXEL_PTR(byte_run); 266 CHECK_PIXEL_PTR(byte_run);
299 for (i = 0; i < line_packets; i++) { 299 for (i = 0; i < line_packets; i++) {
300 /* account for the skip bytes */ 300 /* account for the skip bytes */
301 pixel_skip = buf[stream_ptr++]; 301 pixel_skip = buf[stream_ptr++];
302 pixel_ptr += pixel_skip; 302 pixel_ptr += pixel_skip;
303 pixel_countdown -= pixel_skip; 303 pixel_countdown -= pixel_skip;
304 byte_run = buf[stream_ptr++]; 304 byte_run = (signed char)(buf[stream_ptr++]);
305 if (byte_run > 0) { 305 if (byte_run > 0) {
306 CHECK_PIXEL_PTR(byte_run); 306 CHECK_PIXEL_PTR(byte_run);
307 for (j = 0; j < byte_run; j++, pixel_countdown--) { 307 for (j = 0; j < byte_run; j++, pixel_countdown--) {
308 palette_idx1 = buf[stream_ptr++]; 308 palette_idx1 = buf[stream_ptr++];
309 pixels[pixel_ptr++] = palette_idx1; 309 pixels[pixel_ptr++] = palette_idx1;
339 /* disregard the line packets; instead, iterate through all 339 /* disregard the line packets; instead, iterate through all
340 * pixels on a row */ 340 * pixels on a row */
341 stream_ptr++; 341 stream_ptr++;
342 pixel_countdown = s->avctx->width; 342 pixel_countdown = s->avctx->width;
343 while (pixel_countdown > 0) { 343 while (pixel_countdown > 0) {
344 byte_run = buf[stream_ptr++]; 344 byte_run = (signed char)(buf[stream_ptr++]);
345 if (byte_run > 0) { 345 if (byte_run > 0) {
346 palette_idx1 = buf[stream_ptr++]; 346 palette_idx1 = buf[stream_ptr++];
347 CHECK_PIXEL_PTR(byte_run); 347 CHECK_PIXEL_PTR(byte_run);
348 for (j = 0; j < byte_run; j++) { 348 for (j = 0; j < byte_run; j++) {
349 pixels[pixel_ptr++] = palette_idx1; 349 pixels[pixel_ptr++] = palette_idx1;
441 441
442 int lines; 442 int lines;
443 int compressed_lines; 443 int compressed_lines;
444 signed short line_packets; 444 signed short line_packets;
445 int y_ptr; 445 int y_ptr;
446 signed char byte_run; 446 int byte_run;
447 int pixel_skip; 447 int pixel_skip;
448 int pixel_countdown; 448 int pixel_countdown;
449 unsigned char *pixels; 449 unsigned char *pixels;
450 int pixel; 450 int pixel;
451 int pixel_limit; 451 int pixel_limit;
501 for (i = 0; i < line_packets; i++) { 501 for (i = 0; i < line_packets; i++) {
502 /* account for the skip bytes */ 502 /* account for the skip bytes */
503 pixel_skip = buf[stream_ptr++]; 503 pixel_skip = buf[stream_ptr++];
504 pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */ 504 pixel_ptr += (pixel_skip*2); /* Pixel is 2 bytes wide */
505 pixel_countdown -= pixel_skip; 505 pixel_countdown -= pixel_skip;
506 byte_run = buf[stream_ptr++]; 506 byte_run = (signed char)(buf[stream_ptr++]);
507 if (byte_run < 0) { 507 if (byte_run < 0) {
508 byte_run = -byte_run; 508 byte_run = -byte_run;
509 pixel = LE_16(&buf[stream_ptr]); 509 pixel = LE_16(&buf[stream_ptr]);
510 stream_ptr += 2; 510 stream_ptr += 2;
511 CHECK_PIXEL_PTR(byte_run); 511 CHECK_PIXEL_PTR(byte_run);
547 * pixels on a row */ 547 * pixels on a row */
548 stream_ptr++; 548 stream_ptr++;
549 pixel_countdown = (s->avctx->width * 2); 549 pixel_countdown = (s->avctx->width * 2);
550 550
551 while (pixel_countdown > 0) { 551 while (pixel_countdown > 0) {
552 byte_run = buf[stream_ptr++]; 552 byte_run = (signed char)(buf[stream_ptr++]);
553 if (byte_run > 0) { 553 if (byte_run > 0) {
554 palette_idx1 = buf[stream_ptr++]; 554 palette_idx1 = buf[stream_ptr++];
555 CHECK_PIXEL_PTR(byte_run); 555 CHECK_PIXEL_PTR(byte_run);
556 for (j = 0; j < byte_run; j++) { 556 for (j = 0; j < byte_run; j++) {
557 pixels[pixel_ptr++] = palette_idx1; 557 pixels[pixel_ptr++] = palette_idx1;
601 * pixels on a row */ 601 * pixels on a row */
602 stream_ptr++; 602 stream_ptr++;
603 pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */ 603 pixel_countdown = s->avctx->width; /* Width is in pixels, not bytes */
604 604
605 while (pixel_countdown > 0) { 605 while (pixel_countdown > 0) {
606 byte_run = buf[stream_ptr++]; 606 byte_run = (signed char)(buf[stream_ptr++]);
607 if (byte_run > 0) { 607 if (byte_run > 0) {
608 pixel = LE_16(&buf[stream_ptr]); 608 pixel = LE_16(&buf[stream_ptr]);
609 stream_ptr += 2; 609 stream_ptr += 2;
610 CHECK_PIXEL_PTR(byte_run); 610 CHECK_PIXEL_PTR(byte_run);
611 for (j = 0; j < byte_run; j++) { 611 for (j = 0; j < byte_run; j++) {