Revision 65daa942 libavcodec/dfa.c
libavcodec/dfa.c | ||
---|---|---|
62 | 62 |
const uint8_t *frame_start = frame; |
63 | 63 |
const uint8_t *frame_end = frame + width * height; |
64 | 64 |
int mask = 0x10000, bitbuf = 0; |
65 |
int v, offset, count, segments; |
|
65 |
int v, count, segments; |
|
66 |
unsigned offset; |
|
66 | 67 |
|
67 | 68 |
segments = bytestream_get_le32(&src); |
68 |
frame += bytestream_get_le32(&src);
|
|
69 |
if (frame < frame_start || frame > frame_end)
|
|
69 |
offset = bytestream_get_le32(&src);
|
|
70 |
if (frame_end - frame <= offset)
|
|
70 | 71 |
return -1; |
72 |
frame += offset; |
|
71 | 73 |
while (segments--) { |
72 | 74 |
if (mask == 0x10000) { |
73 | 75 |
if (src >= src_end) |
... | ... | |
189 | 191 |
int count, lines, segments; |
190 | 192 |
|
191 | 193 |
count = bytestream_get_le16(&src); |
192 |
if (count >= height || width * count < 0)
|
|
194 |
if (count >= height) |
|
193 | 195 |
return -1; |
194 | 196 |
frame += width * count; |
195 | 197 |
lines = bytestream_get_le16(&src); |
196 |
if (frame + lines * width > frame_end || src >= src_end)
|
|
198 |
if (count + lines > height || src >= src_end)
|
|
197 | 199 |
return -1; |
198 | 200 |
|
199 | 201 |
while (lines--) { |
... | ... | |
203 | 205 |
while (segments--) { |
204 | 206 |
if (src_end - src < 3) |
205 | 207 |
return -1; |
206 |
line_ptr += *src++; |
|
207 |
if (line_ptr >= frame) |
|
208 |
if (frame - line_ptr <= *src) |
|
208 | 209 |
return -1; |
210 |
line_ptr += *src++; |
|
209 | 211 |
count = (int8_t)*src++; |
210 | 212 |
if (count >= 0) { |
211 |
if (line_ptr + count > frame || src_end - src < count)
|
|
213 |
if (frame - line_ptr < count || src_end - src < count)
|
|
212 | 214 |
return -1; |
213 | 215 |
bytestream_get_buffer(&src, line_ptr, count); |
214 | 216 |
} else { |
215 | 217 |
count = -count; |
216 |
if (line_ptr + count > frame || src >= src_end)
|
|
218 |
if (frame - line_ptr < count || src >= src_end)
|
|
217 | 219 |
return -1; |
218 | 220 |
memset(line_ptr, *src++, count); |
219 | 221 |
} |
... | ... | |
232 | 234 |
int count, i, v, lines, segments; |
233 | 235 |
|
234 | 236 |
lines = bytestream_get_le16(&src); |
235 |
if (frame + lines * width > frame_end || src >= src_end)
|
|
237 |
if (lines > height || src >= src_end)
|
|
236 | 238 |
return -1; |
237 | 239 |
|
238 | 240 |
while (lines--) { |
239 | 241 |
segments = bytestream_get_le16(&src); |
240 | 242 |
while ((segments & 0xC000) == 0xC000) { |
241 |
frame -= (int16_t)segments * width;
|
|
242 |
if (frame >= frame_end)
|
|
243 |
unsigned delta = -((int16_t)segments * width);
|
|
244 |
if (frame_end - frame <= delta)
|
|
243 | 245 |
return -1; |
246 |
frame += delta; |
|
244 | 247 |
segments = bytestream_get_le16(&src); |
245 | 248 |
} |
246 | 249 |
if (segments & 0x8000) { |
... | ... | |
252 | 255 |
while (segments--) { |
253 | 256 |
if (src_end - src < 2) |
254 | 257 |
return -1; |
255 |
line_ptr += *src++; |
|
256 |
if (line_ptr >= frame) |
|
258 |
if (frame - line_ptr <= *src) |
|
257 | 259 |
return -1; |
260 |
line_ptr += *src++; |
|
258 | 261 |
count = (int8_t)*src++; |
259 | 262 |
if (count >= 0) { |
260 |
if (line_ptr + count*2 > frame || src_end - src < count*2)
|
|
263 |
if (frame - line_ptr < count*2 || src_end - src < count*2)
|
|
261 | 264 |
return -1; |
262 | 265 |
bytestream_get_buffer(&src, line_ptr, count*2); |
263 | 266 |
line_ptr += count * 2; |
264 | 267 |
} else { |
265 | 268 |
count = -count; |
266 |
if (line_ptr + count*2 > frame || src_end - src < 2)
|
|
269 |
if (frame - line_ptr < count*2 || src_end - src < 2)
|
|
267 | 270 |
return -1; |
268 | 271 |
v = bytestream_get_le16(&src); |
269 | 272 |
for (i = 0; i < count; i++) |
Also available in: Unified diff