diff options
Diffstat (limited to 'libavcodec/4xm.c')
| -rw-r--r-- | libavcodec/4xm.c | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index e57ce90df6..d665436844 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -643,9 +643,17 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){ int x, y, x2, y2; const int width= f->avctx->width; const int height= f->avctx->height; + const int mbs = (FFALIGN(width, 16) >> 4) * (FFALIGN(height, 16) >> 4); uint16_t *dst= (uint16_t*)f->current_picture.data[0]; const int stride= f->current_picture.linesize[0]>>1; const uint8_t *buf_end = buf + length; + GetByteContext g3; + + if(length < mbs * 8) { + av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n"); + return AVERROR_INVALIDDATA; + } + bytestream2_init(&g3, buf, length); for(y=0; y<height; y+=16){ for(x=0; x<width; x+=16){ @@ -654,8 +662,8 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){ return -1; memset(color, 0, sizeof(color)); //warning following is purely guessed ... - color[0]= bytestream_get_le16(&buf); - color[1]= bytestream_get_le16(&buf); + color[0]= bytestream2_get_le16u(&g3); + color[1]= bytestream2_get_le16u(&g3); if(color[0]&0x8000) av_log(NULL, AV_LOG_ERROR, "unk bit 1\n"); if(color[1]&0x8000) av_log(NULL, AV_LOG_ERROR, "unk bit 2\n"); @@ -663,7 +671,7 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){ color[2]= mix(color[0], color[1]); color[3]= mix(color[1], color[0]); - bits= bytestream_get_le32(&buf); + bits= bytestream2_get_le32u(&g3); for(y2=0; y2<16; y2++){ for(x2=0; x2<16; x2++){ int index= 2*(x2>>2) + 8*(y2>>2); @@ -672,7 +680,7 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){ } dst+=16; } - dst += 16*stride - width; + dst += 16 * stride - x; } return 0; @@ -823,7 +831,7 @@ static int decode_frame(AVCodecContext *avctx, if(frame_4cc == AV_RL32("ifr2")){ p->pict_type= AV_PICTURE_TYPE_I; - if(decode_i2_frame(f, buf-4, frame_size+4) < 0){ + if(decode_i2_frame(f, buf-4, frame_size + 4) < 0) { av_log(f->avctx, AV_LOG_ERROR, "decode i2 frame failed\n"); return -1; } |