Mercurial > libavcodec.hg
comparison indeo2.c @ 2619:c39756a516a5 libavcodec
buffer overflows
| author | michael |
|---|---|
| date | Wed, 20 Apr 2005 09:52:04 +0000 |
| parents | fc91ca5b9066 |
| children | 0a55e35d3e5e |
comparison
equal
deleted
inserted
replaced
| 2618:fc91ca5b9066 | 2619:c39756a516a5 |
|---|---|
| 51 if (value > 255) \ | 51 if (value > 255) \ |
| 52 value = 255; \ | 52 value = 255; \ |
| 53 else if (value < 0) \ | 53 else if (value < 0) \ |
| 54 value = 0; \ | 54 value = 0; \ |
| 55 | 55 |
| 56 static void ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *dst, int stride, | 56 static int ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *dst, int stride, |
| 57 const uint8_t *table) | 57 const uint8_t *table) |
| 58 { | 58 { |
| 59 int i; | 59 int i; |
| 60 int j; | 60 int j; |
| 61 int out = 0; | 61 int out = 0; |
| 62 int c; | 62 int c; |
| 63 int t; | 63 int t; |
| 64 | 64 |
| 65 if(width&1) | |
| 66 return -1; | |
| 67 | |
| 65 /* first line contain absolute values, other lines contain deltas */ | 68 /* first line contain absolute values, other lines contain deltas */ |
| 66 while (out < width){ | 69 while (out < width){ |
| 67 c = ir2_get_code(&ctx->gb); | 70 c = ir2_get_code(&ctx->gb); |
| 68 if(c > 0x80) { /* we have a run */ | 71 if(c > 0x80) { /* we have a run */ |
| 69 c -= 0x80; | 72 c -= 0x80; |
| 73 if(out + c*2 > width) | |
| 74 return -1; | |
| 70 for (i = 0; i < c * 2; i++) | 75 for (i = 0; i < c * 2; i++) |
| 71 dst[out++] = 0x80; | 76 dst[out++] = 0x80; |
| 72 } else { /* copy two values from table */ | 77 } else { /* copy two values from table */ |
| 73 dst[out++] = table[c * 2]; | 78 dst[out++] = table[c * 2]; |
| 74 dst[out++] = table[(c * 2) + 1]; | 79 dst[out++] = table[(c * 2) + 1]; |
| 80 out = 0; | 85 out = 0; |
| 81 while (out < width){ | 86 while (out < width){ |
| 82 c = ir2_get_code(&ctx->gb); | 87 c = ir2_get_code(&ctx->gb); |
| 83 if(c > 0x80) { /* we have a skip */ | 88 if(c > 0x80) { /* we have a skip */ |
| 84 c -= 0x80; | 89 c -= 0x80; |
| 90 if(out + c*2 > width) | |
| 91 return -1; | |
| 85 for (i = 0; i < c * 2; i++) { | 92 for (i = 0; i < c * 2; i++) { |
| 86 dst[out] = dst[out - stride]; | 93 dst[out] = dst[out - stride]; |
| 87 out++; | 94 out++; |
| 88 } | 95 } |
| 89 } else { /* add two deltas from table */ | 96 } else { /* add two deltas from table */ |
| 97 out++; | 104 out++; |
| 98 } | 105 } |
| 99 } | 106 } |
| 100 dst += stride; | 107 dst += stride; |
| 101 } | 108 } |
| 102 } | 109 return 0; |
| 103 | 110 } |
| 104 static void ir2_decode_plane_inter(Ir2Context *ctx, int width, int height, uint8_t *dst, int stride, | 111 |
| 112 static int ir2_decode_plane_inter(Ir2Context *ctx, int width, int height, uint8_t *dst, int stride, | |
| 105 const uint8_t *table) | 113 const uint8_t *table) |
| 106 { | 114 { |
| 107 int j; | 115 int j; |
| 108 int out = 0; | 116 int out = 0; |
| 109 int c; | 117 int c; |
| 110 int t; | 118 int t; |
| 111 | 119 |
| 120 if(width&1) | |
| 121 return -1; | |
| 122 | |
| 112 for (j = 0; j < height; j++){ | 123 for (j = 0; j < height; j++){ |
| 113 out = 0; | 124 out = 0; |
| 114 while (out < width){ | 125 while (out < width){ |
| 115 c = ir2_get_code(&ctx->gb); | 126 c = ir2_get_code(&ctx->gb); |
| 116 if(c > 0x80) { /* we have a skip */ | 127 if(c > 0x80) { /* we have a skip */ |
| 127 out++; | 138 out++; |
| 128 } | 139 } |
| 129 } | 140 } |
| 130 dst += stride; | 141 dst += stride; |
| 131 } | 142 } |
| 143 return 0; | |
| 132 } | 144 } |
| 133 | 145 |
| 134 static int ir2_decode_frame(AVCodecContext *avctx, | 146 static int ir2_decode_frame(AVCodecContext *avctx, |
| 135 void *data, int *data_size, | 147 void *data, int *data_size, |
| 136 uint8_t *buf, int buf_size) | 148 uint8_t *buf, int buf_size) |