Skip to content

F
Ffmpeg

小白菜888 / Ffmpeg

通知 3
Star 0
Fork 0
F
Ffmpeg

体验新版 GitCode，发现更多精彩内容 >>

提交 cdbaa436 编写于 作者: V Vittorio Giovara 提交者： Diego Biurrun
浏览文件
操作

mpeg12dec: Always close reader on error 

A reader left open may lead to hangs.
Signed-off-by: NVittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: NDiego Biurrun <diego@biurrun.de>
上级 7a00653b
隐藏空白更改
内联 并排
Showing with 48 addition and 15 deletion
libavcodec/mpeg12dec.c
浏览文件 @ cdbaa436
...@@ -128,9 +128,10 @@ static int mpeg_decode_motion(MpegEncContext *s, int fcode, int pred) ...@@ -128,9 +128,10 @@ static int mpeg_decode_motion(MpegEncContext *s, int fcode, int pred)
return sign_extend(val, 5 + shift); return sign_extend(val, 5 + shift);
} }
#define MAX_INDEX (64 - 1)
#define check_scantable_index(ctx, x) \ #define check_scantable_index(ctx, x) \
do { \ do { \
if ((x) > 63) { \ if ((x) > MAX_INDEX) { \
av_log(ctx->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", \ av_log(ctx->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", \
ctx->mb_x, ctx->mb_y); \ ctx->mb_x, ctx->mb_y); \
return AVERROR_INVALIDDATA; \ return AVERROR_INVALIDDATA; \
...@@ -170,7 +171,8 @@ static inline int mpeg1_decode_block_intra(MpegEncContext *s, ...@@ -170,7 +171,8 @@ static inline int mpeg1_decode_block_intra(MpegEncContext *s,
break; break;
} else if (level != 0) { } else if (level != 0) {
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
level = (level * qscale * quant_matrix[j]) >> 4; level = (level * qscale * quant_matrix[j]) >> 4;
level = (level - 1) | 1; level = (level - 1) | 1;
...@@ -192,7 +194,8 @@ static inline int mpeg1_decode_block_intra(MpegEncContext *s, ...@@ -192,7 +194,8 @@ static inline int mpeg1_decode_block_intra(MpegEncContext *s,
LAST_SKIP_BITS(re, &s->gb, 8); LAST_SKIP_BITS(re, &s->gb, 8);
} }
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
if (level < 0) { if (level < 0) {
level = -level; level = -level;
...@@ -209,6 +212,9 @@ static inline int mpeg1_decode_block_intra(MpegEncContext *s, ...@@ -209,6 +212,9 @@ static inline int mpeg1_decode_block_intra(MpegEncContext *s,
} }
CLOSE_READER(re, &s->gb); CLOSE_READER(re, &s->gb);
} }
check_scantable_index(s, i);
s->block_last_index[n] = i; s->block_last_index[n] = i;
return 0; return 0;
} }
...@@ -250,7 +256,8 @@ static inline int mpeg1_decode_block_inter(MpegEncContext *s, ...@@ -250,7 +256,8 @@ static inline int mpeg1_decode_block_inter(MpegEncContext *s,
if (level != 0) { if (level != 0) {
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
level = ((level * 2 + 1) * qscale * quant_matrix[j]) >> 5; level = ((level * 2 + 1) * qscale * quant_matrix[j]) >> 5;
level = (level - 1) | 1; level = (level - 1) | 1;
...@@ -272,7 +279,8 @@ static inline int mpeg1_decode_block_inter(MpegEncContext *s, ...@@ -272,7 +279,8 @@ static inline int mpeg1_decode_block_inter(MpegEncContext *s,
SKIP_BITS(re, &s->gb, 8); SKIP_BITS(re, &s->gb, 8);
} }
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
if (level < 0) { if (level < 0) {
level = -level; level = -level;
...@@ -294,6 +302,9 @@ end: ...@@ -294,6 +302,9 @@ end:
LAST_SKIP_BITS(re, &s->gb, 2); LAST_SKIP_BITS(re, &s->gb, 2);
CLOSE_READER(re, &s->gb); CLOSE_READER(re, &s->gb);
} }
check_scantable_index(s, i);
s->block_last_index[n] = i; s->block_last_index[n] = i;
return 0; return 0;
} }
...@@ -330,7 +341,8 @@ static inline int mpeg1_fast_decode_block_inter(MpegEncContext *s, ...@@ -330,7 +341,8 @@ static inline int mpeg1_fast_decode_block_inter(MpegEncContext *s,
if (level != 0) { if (level != 0) {
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
level = ((level * 2 + 1) * qscale) >> 1; level = ((level * 2 + 1) * qscale) >> 1;
level = (level - 1) | 1; level = (level - 1) | 1;
...@@ -352,7 +364,8 @@ static inline int mpeg1_fast_decode_block_inter(MpegEncContext *s, ...@@ -352,7 +364,8 @@ static inline int mpeg1_fast_decode_block_inter(MpegEncContext *s,
SKIP_BITS(re, &s->gb, 8); SKIP_BITS(re, &s->gb, 8);
} }
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
if (level < 0) { if (level < 0) {
level = -level; level = -level;
...@@ -374,6 +387,9 @@ end: ...@@ -374,6 +387,9 @@ end:
LAST_SKIP_BITS(re, &s->gb, 2); LAST_SKIP_BITS(re, &s->gb, 2);
CLOSE_READER(re, &s->gb); CLOSE_READER(re, &s->gb);
} }
check_scantable_index(s, i);
s->block_last_index[n] = i; s->block_last_index[n] = i;
return 0; return 0;
} }
...@@ -419,7 +435,8 @@ static inline int mpeg2_decode_block_non_intra(MpegEncContext *s, ...@@ -419,7 +435,8 @@ static inline int mpeg2_decode_block_non_intra(MpegEncContext *s,
if (level != 0) { if (level != 0) {
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
level = ((level * 2 + 1) * qscale * quant_matrix[j]) >> 5; level = ((level * 2 + 1) * qscale * quant_matrix[j]) >> 5;
level = (level ^ SHOW_SBITS(re, &s->gb, 1)) - level = (level ^ SHOW_SBITS(re, &s->gb, 1)) -
...@@ -434,7 +451,8 @@ static inline int mpeg2_decode_block_non_intra(MpegEncContext *s, ...@@ -434,7 +451,8 @@ static inline int mpeg2_decode_block_non_intra(MpegEncContext *s,
SKIP_BITS(re, &s->gb, 12); SKIP_BITS(re, &s->gb, 12);
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
if (level < 0) { if (level < 0) {
level = ((-level * 2 + 1) * qscale * quant_matrix[j]) >> 5; level = ((-level * 2 + 1) * qscale * quant_matrix[j]) >> 5;
...@@ -456,6 +474,8 @@ end: ...@@ -456,6 +474,8 @@ end:
} }
block[63] ^= (mismatch & 1); block[63] ^= (mismatch & 1);
check_scantable_index(s, i);
s->block_last_index[n] = i; s->block_last_index[n] = i;
return 0; return 0;
} }
...@@ -489,7 +509,8 @@ static inline int mpeg2_fast_decode_block_non_intra(MpegEncContext *s, ...@@ -489,7 +509,8 @@ static inline int mpeg2_fast_decode_block_non_intra(MpegEncContext *s,
if (level != 0) { if (level != 0) {
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
level = ((level * 2 + 1) * qscale) >> 1; level = ((level * 2 + 1) * qscale) >> 1;
level = (level ^ SHOW_SBITS(re, &s->gb, 1)) - level = (level ^ SHOW_SBITS(re, &s->gb, 1)) -
...@@ -504,7 +525,8 @@ static inline int mpeg2_fast_decode_block_non_intra(MpegEncContext *s, ...@@ -504,7 +525,8 @@ static inline int mpeg2_fast_decode_block_non_intra(MpegEncContext *s,
SKIP_BITS(re, &s->gb, 12); SKIP_BITS(re, &s->gb, 12);
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
if (level < 0) { if (level < 0) {
level = ((-level * 2 + 1) * qscale) >> 1; level = ((-level * 2 + 1) * qscale) >> 1;
...@@ -522,6 +544,9 @@ static inline int mpeg2_fast_decode_block_non_intra(MpegEncContext *s, ...@@ -522,6 +544,9 @@ static inline int mpeg2_fast_decode_block_non_intra(MpegEncContext *s,
end: end:
LAST_SKIP_BITS(re, &s->gb, 2); LAST_SKIP_BITS(re, &s->gb, 2);
CLOSE_READER(re, &s->gb); CLOSE_READER(re, &s->gb);
check_scantable_index(s, i);
s->block_last_index[n] = i; s->block_last_index[n] = i;
return 0; return 0;
} }
...@@ -572,7 +597,8 @@ static inline int mpeg2_decode_block_intra(MpegEncContext *s, ...@@ -572,7 +597,8 @@ static inline int mpeg2_decode_block_intra(MpegEncContext *s,
break; break;
} else if (level != 0) { } else if (level != 0) {
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
level = (level * qscale * quant_matrix[j]) >> 4; level = (level * qscale * quant_matrix[j]) >> 4;
level = (level ^ SHOW_SBITS(re, &s->gb, 1)) - level = (level ^ SHOW_SBITS(re, &s->gb, 1)) -
...@@ -586,7 +612,8 @@ static inline int mpeg2_decode_block_intra(MpegEncContext *s, ...@@ -586,7 +612,8 @@ static inline int mpeg2_decode_block_intra(MpegEncContext *s,
level = SHOW_SBITS(re, &s->gb, 12); level = SHOW_SBITS(re, &s->gb, 12);
SKIP_BITS(re, &s->gb, 12); SKIP_BITS(re, &s->gb, 12);
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
if (level < 0) { if (level < 0) {
level = (-level * qscale * quant_matrix[j]) >> 4; level = (-level * qscale * quant_matrix[j]) >> 4;
...@@ -603,6 +630,8 @@ static inline int mpeg2_decode_block_intra(MpegEncContext *s, ...@@ -603,6 +630,8 @@ static inline int mpeg2_decode_block_intra(MpegEncContext *s,
} }
block[63] ^= mismatch & 1; block[63] ^= mismatch & 1;
check_scantable_index(s, i);
s->block_last_index[n] = i; s->block_last_index[n] = i;
return 0; return 0;
} }
...@@ -650,7 +679,8 @@ static inline int mpeg2_fast_decode_block_intra(MpegEncContext *s, ...@@ -650,7 +679,8 @@ static inline int mpeg2_fast_decode_block_intra(MpegEncContext *s,
break; break;
} else if (level != 0) { } else if (level != 0) {
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
level = (level * qscale * quant_matrix[j]) >> 4; level = (level * qscale * quant_matrix[j]) >> 4;
level = (level ^ SHOW_SBITS(re, &s->gb, 1)) - level = (level ^ SHOW_SBITS(re, &s->gb, 1)) -
...@@ -664,7 +694,8 @@ static inline int mpeg2_fast_decode_block_intra(MpegEncContext *s, ...@@ -664,7 +694,8 @@ static inline int mpeg2_fast_decode_block_intra(MpegEncContext *s,
level = SHOW_SBITS(re, &s->gb, 12); level = SHOW_SBITS(re, &s->gb, 12);
SKIP_BITS(re, &s->gb, 12); SKIP_BITS(re, &s->gb, 12);
i += run; i += run;
check_scantable_index(s, i); if (i > MAX_INDEX)
break;
j = scantable[i]; j = scantable[i];
if (level < 0) { if (level < 0) {
level = (-level * qscale * quant_matrix[j]) >> 4; level = (-level * qscale * quant_matrix[j]) >> 4;
...@@ -679,6 +710,8 @@ static inline int mpeg2_fast_decode_block_intra(MpegEncContext *s, ...@@ -679,6 +710,8 @@ static inline int mpeg2_fast_decode_block_intra(MpegEncContext *s,
CLOSE_READER(re, &s->gb); CLOSE_READER(re, &s->gb);
} }
check_scantable_index(s, i);
s->block_last_index[n] = i; s->block_last_index[n] = i;
return 0; return 0;
} }
......
Markdown is supported
0% 或 .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑！
想要评论请 注册 或