summaryrefslogtreecommitdiff
path: root/libavcodec
diff options
context:
space:
mode:
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/4xm.c18
-rw-r--r--libavcodec/adpcm.c6
-rw-r--r--libavcodec/amrnbdec.c4
-rw-r--r--libavcodec/mjpegdec.c27
-rw-r--r--libavcodec/truemotion2.c6
-rw-r--r--libavcodec/vp3.c2
6 files changed, 44 insertions, 19 deletions
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index e57ce90df6..d665436844 100644
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -643,9 +643,17 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){
int x, y, x2, y2;
const int width= f->avctx->width;
const int height= f->avctx->height;
+ const int mbs = (FFALIGN(width, 16) >> 4) * (FFALIGN(height, 16) >> 4);
uint16_t *dst= (uint16_t*)f->current_picture.data[0];
const int stride= f->current_picture.linesize[0]>>1;
const uint8_t *buf_end = buf + length;
+ GetByteContext g3;
+
+ if(length < mbs * 8) {
+ av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n");
+ return AVERROR_INVALIDDATA;
+ }
+ bytestream2_init(&g3, buf, length);
for(y=0; y<height; y+=16){
for(x=0; x<width; x+=16){
@@ -654,8 +662,8 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){
return -1;
memset(color, 0, sizeof(color));
//warning following is purely guessed ...
- color[0]= bytestream_get_le16(&buf);
- color[1]= bytestream_get_le16(&buf);
+ color[0]= bytestream2_get_le16u(&g3);
+ color[1]= bytestream2_get_le16u(&g3);
if(color[0]&0x8000) av_log(NULL, AV_LOG_ERROR, "unk bit 1\n");
if(color[1]&0x8000) av_log(NULL, AV_LOG_ERROR, "unk bit 2\n");
@@ -663,7 +671,7 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){
color[2]= mix(color[0], color[1]);
color[3]= mix(color[1], color[0]);
- bits= bytestream_get_le32(&buf);
+ bits= bytestream2_get_le32u(&g3);
for(y2=0; y2<16; y2++){
for(x2=0; x2<16; x2++){
int index= 2*(x2>>2) + 8*(y2>>2);
@@ -672,7 +680,7 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){
}
dst+=16;
}
- dst += 16*stride - width;
+ dst += 16 * stride - x;
}
return 0;
@@ -823,7 +831,7 @@ static int decode_frame(AVCodecContext *avctx,
if(frame_4cc == AV_RL32("ifr2")){
p->pict_type= AV_PICTURE_TYPE_I;
- if(decode_i2_frame(f, buf-4, frame_size+4) < 0){
+ if(decode_i2_frame(f, buf-4, frame_size + 4) < 0) {
av_log(f->avctx, AV_LOG_ERROR, "decode i2 frame failed\n");
return -1;
}
diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index 688fba430c..c176b5e03d 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
@@ -91,9 +91,13 @@ typedef struct ADPCMDecodeContext {
static av_cold int adpcm_decode_init(AVCodecContext * avctx)
{
ADPCMDecodeContext *c = avctx->priv_data;
+ unsigned int min_channels = 1;
unsigned int max_channels = 2;
switch(avctx->codec->id) {
+ case CODEC_ID_ADPCM_EA:
+ min_channels = 2;
+ break;
case CODEC_ID_ADPCM_EA_R1:
case CODEC_ID_ADPCM_EA_R2:
case CODEC_ID_ADPCM_EA_R3:
@@ -101,7 +105,7 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx)
max_channels = 6;
break;
}
- if (avctx->channels <= 0 || avctx->channels > max_channels) {
+ if (avctx->channels < min_channels || avctx->channels > max_channels) {
av_log(avctx, AV_LOG_ERROR, "Invalid number of channels\n");
return AVERROR(EINVAL);
}
diff --git a/libavcodec/amrnbdec.c b/libavcodec/amrnbdec.c
index 57c8ae9ae5..c560d69e88 100644
--- a/libavcodec/amrnbdec.c
+++ b/libavcodec/amrnbdec.c
@@ -978,6 +978,10 @@ static int amrnb_decode_frame(AVCodecContext *avctx, void *data,
pitch_sharpening(p, subframe, p->cur_frame_mode, &fixed_sparse);
+ if (fixed_sparse.pitch_lag == 0) {
+ av_log(avctx, AV_LOG_ERROR, "The file is corrupted, pitch_lag = 0 is not allowed\n");
+ return AVERROR_INVALIDDATA;
+ }
ff_set_fixed_vector(p->fixed_vector, &fixed_sparse, 1.0,
AMR_SUBFRAME_SIZE);
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index b1c3aeda6d..7c27f5d987 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -985,18 +985,21 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, i
}
}
- if (s->restart_interval) --s->restart_count;
- i= 8+((-get_bits_count(&s->gb))&7);
- if (s->restart_interval && show_bits(&s->gb, i) == (1<<i)-1){ /* skip RSTn */
- int pos= get_bits_count(&s->gb);
- align_get_bits(&s->gb);
- while(get_bits_count(&s->gb) < s->gb.size_in_bits && show_bits(&s->gb, 8) == 0xFF)
- skip_bits(&s->gb, 8);
- if(get_bits_count(&s->gb) < s->gb.size_in_bits && (get_bits(&s->gb, 8)&0xF8) == 0xD0){
- for (i=0; i<nb_components; i++) /* reset dc */
- s->last_dc[i] = 1024;
- }else{
- skip_bits_long(&s->gb, pos - get_bits_count(&s->gb));
+ if (s->restart_interval) {
+ s->restart_count--;
+ i = 8 + ((-get_bits_count(&s->gb)) & 7);
+ /* skip RSTn */
+ if (show_bits(&s->gb, i) == (1 << i) - 1) {
+ int pos = get_bits_count(&s->gb);
+ align_get_bits(&s->gb);
+ while (get_bits_left(&s->gb) >= 8 && show_bits(&s->gb, 8) == 0xFF)
+ skip_bits(&s->gb, 8);
+ if (get_bits_left(&s->gb) >= 8 && (get_bits(&s->gb, 8) & 0xF8) == 0xD0) {
+ for (i = 0; i < nb_components; i++) /* reset dc */
+ s->last_dc[i] = 1024;
+ } else {
+ skip_bits_long(&s->gb, pos - get_bits_count(&s->gb));
+ }
}
}
}
diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c
index 95487d9436..567383499a 100644
--- a/libavcodec/truemotion2.c
+++ b/libavcodec/truemotion2.c
@@ -272,6 +272,8 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i
len = AV_RB32(buf); buf += 4; cur += 4;
}
if(len > 0) {
+ if (skip <= cur)
+ return -1;
init_get_bits(&ctx->gb, buf, (skip - cur) * 8);
if(tm2_read_deltas(ctx, stream_id) == -1)
return -1;
@@ -286,7 +288,7 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i
buf += 4; cur += 4;
buf += 4; cur += 4; /* unused by decoder */
- if(skip < cur)
+ if (skip <= cur)
return -1;
init_get_bits(&ctx->gb, buf, (skip - cur) * 8);
if(tm2_build_huff_table(ctx, &codes) == -1)
@@ -305,6 +307,8 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i
ctx->tok_lens[stream_id] = toks;
len = AV_RB32(buf); buf += 4; cur += 4;
if(len > 0) {
+ if (skip <= cur)
+ return -1;
init_get_bits(&ctx->gb, buf, (skip - cur) * 8);
for(i = 0; i < toks; i++) {
if (get_bits_left(&ctx->gb) <= 0) {
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 80e71303fa..738ae9fd25 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -1378,6 +1378,8 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
return i;
}
} while (i < 64);
+ // return value is expected to be a valid level
+ i--;
end:
// the actual DC+prediction is in the fragment structure
block[0] = frag->dc * s->qmat[0][inter][plane][0];
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-18 17:20:54 +0000