comparison vp3.c @ 11636:a9e758788a12 libavcodec

vp3: More buffer length checks .5% slower to fix some crashes on invalid streams
author conrad
date Fri, 16 Apr 2010 12:21:44 +0000
parents 0c2b399b2e27
children f7281af560fe
comparison
equal deleted inserted replaced
11635:0c2b399b2e27 11636:a9e758788a12
377 377
378 } else { 378 } else {
379 379
380 /* unpack the list of partially-coded superblocks */ 380 /* unpack the list of partially-coded superblocks */
381 bit = get_bits1(gb); 381 bit = get_bits1(gb);
382 while (current_superblock < s->superblock_count) { 382 while (current_superblock < s->superblock_count && get_bits_left(gb) > 0) {
383 current_run = get_vlc2(gb, 383 current_run = get_vlc2(gb,
384 s->superblock_run_length_vlc.table, 6, 2) + 1; 384 s->superblock_run_length_vlc.table, 6, 2) + 1;
385 if (current_run == 34) 385 if (current_run == 34)
386 current_run += get_bits(gb, 12); 386 current_run += get_bits(gb, 12);
387 387
407 if (num_partial_superblocks < s->superblock_count) { 407 if (num_partial_superblocks < s->superblock_count) {
408 int superblocks_decoded = 0; 408 int superblocks_decoded = 0;
409 409
410 current_superblock = 0; 410 current_superblock = 0;
411 bit = get_bits1(gb); 411 bit = get_bits1(gb);
412 while (superblocks_decoded < s->superblock_count - num_partial_superblocks) { 412 while (superblocks_decoded < s->superblock_count - num_partial_superblocks
413 && get_bits_left(gb) > 0) {
413 current_run = get_vlc2(gb, 414 current_run = get_vlc2(gb,
414 s->superblock_run_length_vlc.table, 6, 2) + 1; 415 s->superblock_run_length_vlc.table, 6, 2) + 1;
415 if (current_run == 34) 416 if (current_run == 34)
416 current_run += get_bits(gb, 12); 417 current_run += get_bits(gb, 12);
417 418
456 for (plane = 0; plane < 3; plane++) { 457 for (plane = 0; plane < 3; plane++) {
457 int sb_start = superblock_starts[plane]; 458 int sb_start = superblock_starts[plane];
458 int sb_end = sb_start + (plane ? s->c_superblock_count : s->y_superblock_count); 459 int sb_end = sb_start + (plane ? s->c_superblock_count : s->y_superblock_count);
459 int num_coded_frags = 0; 460 int num_coded_frags = 0;
460 461
461 for (i = sb_start; i < sb_end; i++) { 462 for (i = sb_start; i < sb_end && get_bits_left(gb) > 0; i++) {
462 463
463 /* iterate through all 16 fragments in a superblock */ 464 /* iterate through all 16 fragments in a superblock */
464 for (j = 0; j < 16; j++) { 465 for (j = 0; j < 16; j++) {
465 466
466 /* if the fragment is in bounds, check its coding status */ 467 /* if the fragment is in bounds, check its coding status */
540 541
541 /* iterate through all of the macroblocks that contain 1 or more 542 /* iterate through all of the macroblocks that contain 1 or more
542 * coded fragments */ 543 * coded fragments */
543 for (sb_y = 0; sb_y < s->y_superblock_height; sb_y++) { 544 for (sb_y = 0; sb_y < s->y_superblock_height; sb_y++) {
544 for (sb_x = 0; sb_x < s->y_superblock_width; sb_x++) { 545 for (sb_x = 0; sb_x < s->y_superblock_width; sb_x++) {
546 if (get_bits_left(gb) <= 0)
547 return -1;
545 548
546 for (j = 0; j < 4; j++) { 549 for (j = 0; j < 4; j++) {
547 int mb_x = 2*sb_x + (j>>1); 550 int mb_x = 2*sb_x + (j>>1);
548 int mb_y = 2*sb_y + (((j>>1)+j)&1); 551 int mb_y = 2*sb_y + (((j>>1)+j)&1);
549 current_macroblock = mb_y * s->macroblock_width + mb_x; 552 current_macroblock = mb_y * s->macroblock_width + mb_x;
634 637
635 /* iterate through all of the macroblocks that contain 1 or more 638 /* iterate through all of the macroblocks that contain 1 or more
636 * coded fragments */ 639 * coded fragments */
637 for (sb_y = 0; sb_y < s->y_superblock_height; sb_y++) { 640 for (sb_y = 0; sb_y < s->y_superblock_height; sb_y++) {
638 for (sb_x = 0; sb_x < s->y_superblock_width; sb_x++) { 641 for (sb_x = 0; sb_x < s->y_superblock_width; sb_x++) {
642 if (get_bits_left(gb) <= 0)
643 return -1;
639 644
640 for (j = 0; j < 4; j++) { 645 for (j = 0; j < 4; j++) {
641 int mb_x = 2*sb_x + (j>>1); 646 int mb_x = 2*sb_x + (j>>1);
642 int mb_y = 2*sb_y + (((j>>1)+j)&1); 647 int mb_y = 2*sb_y + (((j>>1)+j)&1);
643 current_macroblock = mb_y * s->macroblock_width + mb_x; 648 current_macroblock = mb_y * s->macroblock_width + mb_x;
818 823
819 if (run_length == MAXIMUM_LONG_BIT_RUN) 824 if (run_length == MAXIMUM_LONG_BIT_RUN)
820 bit = get_bits1(gb); 825 bit = get_bits1(gb);
821 else 826 else
822 bit ^= 1; 827 bit ^= 1;
823 } while (blocks_decoded < num_blocks); 828 } while (blocks_decoded < num_blocks && get_bits_left(gb) > 0);
824 829
825 num_blocks -= num_blocks_at_qpi; 830 num_blocks -= num_blocks_at_qpi;
826 } 831 }
827 832
828 return 0; 833 return 0;