Skip to content

F
Ffmpeg

小白菜888 / Ffmpeg

通知 3
Star 0
Fork 0
F
Ffmpeg

体验新版 GitCode，发现更多精彩内容 >>

提交 696634c5 编写于 作者: H Hendrik Leppkes
浏览文件
操作

Merge commit '6a6bc43f' 

* commit '6a6bc43f':
  dxtory: Factorize slice size checks
Merged-by: NHendrik Leppkes <h.leppkes@gmail.com>
上级 94d7060d 6a6bc43f
隐藏空白更改
内联 并排
Showing with 49 addition and 76 deletion
libavcodec/dxtory.c
浏览文件 @ 696634c5
......@@ -192,6 +192,34 @@ static inline uint8_t decode_sym(GetBitContext *gb, uint8_t lru[8])
return val;
}
static int check_slice_size(AVCodecContext *avctx,
const uint8_t *src, int src_size,
int slice_size, int off)
{
int cur_slice_size;
if (slice_size > src_size - off) {
av_log(avctx, AV_LOG_ERROR,
"invalid slice size %"PRIu32" (only %"PRIu32" bytes left)\n",
slice_size, src_size - off);
return AVERROR_INVALIDDATA;
}
if (slice_size <= 16) {
av_log(avctx, AV_LOG_ERROR, "invalid slice size %"PRIu32"\n",
slice_size);
return AVERROR_INVALIDDATA;
}
cur_slice_size = AV_RL32(src + off);
if (cur_slice_size != slice_size - 16) {
av_log(avctx, AV_LOG_ERROR,
"Slice sizes mismatch: got %"PRIu32" instead of %"PRIu32"\n",
cur_slice_size, slice_size - 16);
}
return 0;
}
static inline uint8_t decode_sym_565(GetBitContext *gb, uint8_t lru[8],
int bits)
{
......@@ -269,22 +297,11 @@ static int dxtory_decode_v2_565(AVCodecContext *avctx, AVFrame *pic,
dst = pic->data[0];
for (slice = 0; slice < nslices; slice++) {
slice_size = bytestream2_get_le32(&gb);
if (slice_size > src_size - off) {
av_log(avctx, AV_LOG_ERROR,
"invalid slice size %"PRIu32" (only %"PRIu32" bytes left)\n",
slice_size, src_size - off);
return AVERROR_INVALIDDATA;
}
if (slice_size <= 16) {
av_log(avctx, AV_LOG_ERROR, "invalid slice size %"PRIu32"\n", slice_size);
return AVERROR_INVALIDDATA;
}
if (AV_RL32(src + off) != slice_size - 16) {
av_log(avctx, AV_LOG_ERROR,
"Slice sizes mismatch: got %"PRIu32" instead of %"PRIu32"\n",
AV_RL32(src + off), slice_size - 16);
}
ret = check_slice_size(avctx, src, src_size, slice_size, off);
if (ret < 0)
return ret;
if ((ret = init_get_bits8(&gb2, src + off + 16, slice_size - 16)) < 0)
return ret;
dx2_decode_slice_565(&gb2, avctx->width, slice_height, dst,
......@@ -351,23 +368,11 @@ static int dxtory_decode_v2_rgb(AVCodecContext *avctx, AVFrame *pic,
dst = pic->data[0];
for (slice = 0; slice < nslices; slice++) {
slice_size = bytestream2_get_le32(&gb);
if (slice_size > src_size - off) {
av_log(avctx, AV_LOG_ERROR,
"invalid slice size %"PRIu32" (only %"PRIu32" bytes left)\n",
slice_size, src_size - off);
return AVERROR_INVALIDDATA;
}
if (slice_size <= 16) {
av_log(avctx, AV_LOG_ERROR, "invalid slice size %"PRIu32"\n",
slice_size);
return AVERROR_INVALIDDATA;
}
if (AV_RL32(src + off) != slice_size - 16) {
av_log(avctx, AV_LOG_ERROR,
"Slice sizes mismatch: got %"PRIu32" instead of %"PRIu32"\n",
AV_RL32(src + off), slice_size - 16);
}
ret = check_slice_size(avctx, src, src_size, slice_size, off);
if (ret < 0)
return ret;
if ((ret = init_get_bits8(&gb2, src + off + 16, slice_size - 16)) < 0)
return ret;
dx2_decode_slice_rgb(&gb2, avctx->width, slice_height, dst,
......@@ -450,24 +455,14 @@ static int dxtory_decode_v2_410(AVCodecContext *avctx, AVFrame *pic,
slice_size = bytestream2_get_le32(&gb);
next_y = ((slice + 1) * avctx->height) / nslices;
slice_height = (next_y & ~3) - (cur_y & ~3);
if (slice_size > src_size - off) {
av_log(avctx, AV_LOG_ERROR,
"invalid slice size %"PRIu32" (only %"PRIu32" bytes left)\n",
slice_size, src_size - off);
return AVERROR_INVALIDDATA;
}
if (slice_size <= 16) {
av_log(avctx, AV_LOG_ERROR, "invalid slice size %"PRIu32"\n", slice_size);
return AVERROR_INVALIDDATA;
}
if (AV_RL32(src + off) != slice_size - 16) {
av_log(avctx, AV_LOG_ERROR,
"Slice sizes mismatch: got %"PRIu32" instead of %"PRIu32"\n",
AV_RL32(src + off), slice_size - 16);
}
ret = check_slice_size(avctx, src, src_size, slice_size, off);
if (ret < 0)
return ret;
if ((ret = init_get_bits8(&gb2, src + off + 16, slice_size - 16)) < 0)
return ret;
dx2_decode_slice_410(&gb2, avctx->width, slice_height, Y, U, V,
pic->linesize[0], pic->linesize[1],
pic->linesize[2]);
......@@ -553,22 +548,11 @@ static int dxtory_decode_v2_420(AVCodecContext *avctx, AVFrame *pic,
slice_size = bytestream2_get_le32(&gb);
next_y = ((slice + 1) * avctx->height) / nslices;
slice_height = (next_y & ~1) - (cur_y & ~1);
if (slice_size > src_size - off) {
av_log(avctx, AV_LOG_ERROR,
"invalid slice size %"PRIu32" (only %"PRIu32" bytes left)\n",
slice_size, src_size - off);
return AVERROR_INVALIDDATA;
}
if (slice_size <= 16) {
av_log(avctx, AV_LOG_ERROR, "invalid slice size %"PRIu32"\n", slice_size);
return AVERROR_INVALIDDATA;
}
if (AV_RL32(src + off) != slice_size - 16) {
av_log(avctx, AV_LOG_ERROR,
"Slice sizes mismatch: got %"PRIu32" instead of %"PRIu32"\n",
AV_RL32(src + off), slice_size - 16);
}
ret = check_slice_size(avctx, src, src_size, slice_size, off);
if (ret < 0)
return ret;
if ((ret = init_get_bits8(&gb2, src + off + 16, slice_size - 16)) < 0)
return ret;
dx2_decode_slice_420(&gb2, avctx->width, slice_height, Y, U, V,
......@@ -646,22 +630,11 @@ static int dxtory_decode_v2_444(AVCodecContext *avctx, AVFrame *pic,
for (slice = 0; slice < nslices; slice++) {
slice_size = bytestream2_get_le32(&gb);
if (slice_size > src_size - off) {
av_log(avctx, AV_LOG_ERROR,
"invalid slice size %"PRIu32" (only %"PRIu32" bytes left)\n",
slice_size, src_size - off);
return AVERROR_INVALIDDATA;
}
if (slice_size <= 16) {
av_log(avctx, AV_LOG_ERROR, "invalid slice size %"PRIu32"\n", slice_size);
return AVERROR_INVALIDDATA;
}
if (AV_RL32(src + off) != slice_size - 16) {
av_log(avctx, AV_LOG_ERROR,
"Slice sizes mismatch: got %"PRIu32" instead of %"PRIu32"\n",
AV_RL32(src + off), slice_size - 16);
}
ret = check_slice_size(avctx, src, src_size, slice_size, off);
if (ret < 0)
return ret;
if ((ret = init_get_bits8(&gb2, src + off + 16, slice_size - 16)) < 0)
return ret;
dx2_decode_slice_444(&gb2, avctx->width, slice_height, Y, U, V,
......
Markdown is supported
0% 或 .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑！
想要评论请 注册 或