summaryrefslogtreecommitdiff
path: root/libavcodec/faxcompr.c
diff options
context:
space:
mode:
Diffstat (limited to 'libavcodec/faxcompr.c')
-rw-r--r--libavcodec/faxcompr.c31
1 files changed, 20 insertions, 11 deletions
diff --git a/libavcodec/faxcompr.c b/libavcodec/faxcompr.c
index 077e74030e..86be97792e 100644
--- a/libavcodec/faxcompr.c
+++ b/libavcodec/faxcompr.c
@@ -2,20 +2,20 @@
* CCITT Fax Group 3 and 4 decompression
* Copyright (c) 2008 Konstantin Shishkov
*
- * This file is part of Libav.
+ * This file is part of FFmpeg.
*
- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
@@ -163,8 +163,6 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
int run_off = *ref++;
unsigned int offs=0, run= 0;
- runend--; // for the last written 0
-
while(offs < width){
int cmode = get_vlc2(gb, ccitt_group3_2d_vlc.table, 9, 1);
if(cmode == -1){
@@ -172,10 +170,12 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
return -1;
}
if(!cmode){//pass mode
- run_off += *ref++;
+ if(run_off < width)
+ run_off += *ref++;
run = run_off - offs;
offs= run_off;
- run_off += *ref++;
+ if(run_off < width)
+ run_off += *ref++;
if(offs > width){
av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n");
return -1;
@@ -228,13 +228,19 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
mode = !mode;
}
//sync line pointers
- while(run_off <= offs){
+ while(offs < width && run_off <= offs){
run_off += *ref++;
run_off += *ref++;
}
}
*runs++ = saved_run;
- *runs++ = 0;
+ if (saved_run) {
+ if(runs >= runend){
+ av_log(avctx, AV_LOG_ERROR, "Run overrun\n");
+ return -1;
+ }
+ *runs++ = 0;
+ }
return 0;
}
@@ -279,6 +285,7 @@ int ff_ccitt_unpack(AVCodecContext *avctx,
int ret;
int runsize= avctx->width + 2;
int err = 0;
+ int has_eol;
runs = av_malloc(runsize * sizeof(runs[0]));
ref = av_malloc(runsize * sizeof(ref[0]));
@@ -290,6 +297,8 @@ int ff_ccitt_unpack(AVCodecContext *avctx,
ref[1] = 0;
ref[2] = 0;
init_get_bits(&gb, src, srcsize*8);
+ has_eol = show_bits(&gb, 12) == 1 || show_bits(&gb, 16) == 1;
+
for(j = 0; j < height; j++){
runend = runs + runsize;
if(compr == TIFF_G4){
@@ -300,7 +309,7 @@ int ff_ccitt_unpack(AVCodecContext *avctx,
}
}else{
int g3d1 = (compr == TIFF_G3) && !(opts & 1);
- if(compr!=TIFF_CCITT_RLE && find_group3_syncmarker(&gb, srcsize*8) < 0)
+ if(compr!=TIFF_CCITT_RLE && has_eol && find_group3_syncmarker(&gb, srcsize*8) < 0)
break;
if(compr==TIFF_CCITT_RLE || g3d1 || get_bits1(&gb))
ret = decode_group3_1d_line(avctx, &gb, avctx->width, runs, runend);