summaryrefslogtreecommitdiff
path: root/libavcodec/dsicinav.c
diff options
context:
space:
mode:
Diffstat (limited to 'libavcodec/dsicinav.c')
-rw-r--r--libavcodec/dsicinav.c22
1 files changed, 14 insertions, 8 deletions
diff --git a/libavcodec/dsicinav.c b/libavcodec/dsicinav.c
index d3b2cbded6..cd36564eb9 100644
--- a/libavcodec/dsicinav.c
+++ b/libavcodec/dsicinav.c
@@ -2,20 +2,20 @@
* Delphine Software International CIN Audio/Video Decoders
* Copyright (c) 2006 Gregory Montoir (cyx@users.sourceforge.net)
*
- * This file is part of Libav.
+ * This file is part of FFmpeg.
*
- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
@@ -95,6 +95,7 @@ static av_cold int cinvideo_decode_init(AVCodecContext *avctx)
cin->avctx = avctx;
avctx->pix_fmt = PIX_FMT_PAL8;
+ avcodec_get_frame_defaults(&cin->frame);
cin->frame.data[0] = NULL;
cin->bitmap_size = avctx->width * avctx->height;
@@ -178,24 +179,29 @@ static int cin_decode_lzss(const unsigned char *src, int src_size, unsigned char
return 0;
}
-static void cin_decode_rle(const unsigned char *src, int src_size, unsigned char *dst, int dst_size)
+static int cin_decode_rle(const unsigned char *src, int src_size, unsigned char *dst, int dst_size)
{
int len, code;
unsigned char *dst_end = dst + dst_size;
const unsigned char *src_end = src + src_size;
- while (src < src_end && dst < dst_end) {
+ while (src + 1 < src_end && dst < dst_end) {
code = *src++;
if (code & 0x80) {
len = code - 0x7F;
memset(dst, *src++, FFMIN(len, dst_end - dst));
} else {
len = code + 1;
+ if (len > src_end-src) {
+ av_log(0, AV_LOG_ERROR, "RLE overread\n");
+ return AVERROR_INVALIDDATA;
+ }
memcpy(dst, src, FFMIN(len, dst_end - dst));
src += len;
}
dst += len;
}
+ return 0;
}
static int cinvideo_decode_frame(AVCodecContext *avctx,
@@ -221,12 +227,12 @@ static int cinvideo_decode_frame(AVCodecContext *avctx,
if (palette_colors_count > 256)
return AVERROR_INVALIDDATA;
for (i = 0; i < palette_colors_count; ++i) {
- cin->palette[i] = bytestream_get_le24(&buf);
+ cin->palette[i] = 0xFF << 24 | bytestream_get_le24(&buf);
bitmap_frame_size -= 3;
}
} else {
for (i = 0; i < palette_colors_count; ++i) {
- cin->palette[buf[0]] = AV_RL24(buf+1);
+ cin->palette[buf[0]] = 0xFF << 24 | AV_RL24(buf+1);
buf += 4;
bitmap_frame_size -= 4;
}