mirrors/librempeg
1
0
Fork 0
mirror of https://github.com/librempeg/librempeg synced 2024-11-23 19:58:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

4xm: Use bytestream2 functions to prevent overreads

Browse Source 
Fixes Bug 110.

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
This commit is contained in:
Aneesh Dogra 2011-12-20 03:54:50 +05:30 committed by Justin Ruggles
parent fd22616c59
commit 1443ea93d9
1 changed files with 15 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
libavcodec/4xm.c
View File

@ -132,8 +132,8 @@ typedef struct FourXContext{
AVFrame current_picture, last_picture; AVFrame current_picture, last_picture;
GetBitContext pre_gb; ///< ac/dc prefix GetBitContext pre_gb; ///< ac/dc prefix
GetBitContext gb; GetBitContext gb;
const uint8_t *bytestream; GetByteContext g;
const uint16_t *wordstream; GetByteContext g2;
int mv[256]; int mv[256];
VLC pre_vlc; VLC pre_vlc;
int last_dc; int last_dc;
@ -328,7 +328,7 @@ static void decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, int lo
assert(code>=0 && code<=6); assert(code>=0 && code<=6);
if(code == 0){ if(code == 0){
src += f->mv[ *f->bytestream++ ]; src += f->mv[bytestream2_get_byte(&f->g)];
if(start > src || src > end){ if(start > src || src > end){
av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n"); av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n");
return; return;
@ -345,21 +345,21 @@ static void decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, int lo
}else if(code == 3 && f->version<2){ }else if(code == 3 && f->version<2){
mcdc(dst, src, log2w, h, stride, 1, 0); mcdc(dst, src, log2w, h, stride, 1, 0);
}else if(code == 4){ }else if(code == 4){
src += f->mv[ *f->bytestream++ ]; src += f->mv[bytestream2_get_byte(&f->g)];
if(start > src || src > end){ if(start > src || src > end){
av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n"); av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n");
return; return;
} }
mcdc(dst, src, log2w, h, stride, 1, av_le2ne16(*f->wordstream++)); mcdc(dst, src, log2w, h, stride, 1, bytestream2_get_le16(&f->g2));
}else if(code == 5){ }else if(code == 5){
mcdc(dst, src, log2w, h, stride, 0, av_le2ne16(*f->wordstream++)); mcdc(dst, src, log2w, h, stride, 0, bytestream2_get_le16(&f->g2));
}else if(code == 6){ }else if(code == 6){
if(log2w){ if(log2w){
dst[0] = av_le2ne16(*f->wordstream++); dst[0] = bytestream2_get_le16(&f->g2);
dst[1] = av_le2ne16(*f->wordstream++); dst[1] = bytestream2_get_le16(&f->g2);
}else{ }else{
dst[0 ] = av_le2ne16(*f->wordstream++); dst[0 ] = bytestream2_get_le16(&f->g2);
dst[stride] = av_le2ne16(*f->wordstream++); dst[stride] = bytestream2_get_le16(&f->g2);
} }
} }
} }
@ -371,7 +371,7 @@ static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length){
uint16_t *src= (uint16_t*)f->last_picture.data[0]; uint16_t *src= (uint16_t*)f->last_picture.data[0];
uint16_t *dst= (uint16_t*)f->current_picture.data[0]; uint16_t *dst= (uint16_t*)f->current_picture.data[0];
const int stride= f->current_picture.linesize[0]>>1; const int stride= f->current_picture.linesize[0]>>1;
unsigned int bitstream_size, bytestream_size, wordstream_size, extra; unsigned int bitstream_size, bytestream_size, wordstream_size, extra, bytestream_offset, wordstream_offset;
if(f->version>1){ if(f->version>1){
extra=20; extra=20;
@ -402,8 +402,10 @@ static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length){
memset((uint8_t*)f->bitstream_buffer + bitstream_size, 0, FF_INPUT_BUFFER_PADDING_SIZE); memset((uint8_t*)f->bitstream_buffer + bitstream_size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
init_get_bits(&f->gb, f->bitstream_buffer, 8*bitstream_size); init_get_bits(&f->gb, f->bitstream_buffer, 8*bitstream_size);
f->wordstream= (const uint16_t*)(buf + extra + bitstream_size); wordstream_offset = extra + bitstream_size;
f->bytestream= buf + extra + bitstream_size + wordstream_size; bytestream_offset = extra + bitstream_size + wordstream_size;
bytestream2_init(&f->g2, buf + wordstream_offset, length - wordstream_offset);
bytestream2_init(&f->g, buf + bytestream_offset, length - bytestream_offset);
init_mv(f); init_mv(f);