diff options
Diffstat (limited to 'libavcodec/dsicinav.c')
| -rw-r--r-- | libavcodec/dsicinav.c | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/libavcodec/dsicinav.c b/libavcodec/dsicinav.c index 1492717f66..11afadf03f 100644 --- a/libavcodec/dsicinav.c +++ b/libavcodec/dsicinav.c @@ -2,20 +2,20 @@ * Delphine Software International CIN Audio/Video Decoders * Copyright (c) 2006 Gregory Montoir (cyx@users.sourceforge.net) * - * This file is part of Libav. + * This file is part of FFmpeg. * - * Libav is free software; you can redistribute it and/or + * FFmpeg is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * - * Libav is distributed in the hope that it will be useful, + * FFmpeg is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public - * License along with Libav; if not, write to the Free Software + * License along with FFmpeg; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ @@ -95,6 +95,7 @@ static av_cold int cinvideo_decode_init(AVCodecContext *avctx) cin->avctx = avctx; avctx->pix_fmt = AV_PIX_FMT_PAL8; + avcodec_get_frame_defaults(&cin->frame); cin->frame.data[0] = NULL; cin->bitmap_size = avctx->width * avctx->height; @@ -178,24 +179,29 @@ static int cin_decode_lzss(const unsigned char *src, int src_size, unsigned char return 0; } -static void cin_decode_rle(const unsigned char *src, int src_size, unsigned char *dst, int dst_size) +static int cin_decode_rle(const unsigned char *src, int src_size, unsigned char *dst, int dst_size) { int len, code; unsigned char *dst_end = dst + dst_size; const unsigned char *src_end = src + src_size; - while (src < src_end && dst < dst_end) { + while (src + 1 < src_end && dst < dst_end) { code = *src++; if (code & 0x80) { len = code - 0x7F; memset(dst, *src++, FFMIN(len, dst_end - dst)); } else { len = code + 1; + if (len > src_end-src) { + av_log(0, AV_LOG_ERROR, "RLE overread\n"); + return AVERROR_INVALIDDATA; + } memcpy(dst, src, FFMIN(len, dst_end - dst)); src += len; } dst += len; } + return 0; } static int cinvideo_decode_frame(AVCodecContext *avctx, @@ -221,12 +227,12 @@ static int cinvideo_decode_frame(AVCodecContext *avctx, if (palette_colors_count > 256) return AVERROR_INVALIDDATA; for (i = 0; i < palette_colors_count; ++i) { - cin->palette[i] = bytestream_get_le24(&buf); + cin->palette[i] = 0xFFU << 24 | bytestream_get_le24(&buf); bitmap_frame_size -= 3; } } else { for (i = 0; i < palette_colors_count; ++i) { - cin->palette[buf[0]] = AV_RL24(buf+1); + cin->palette[buf[0]] = 0xFFU << 24 | AV_RL24(buf+1); buf += 4; bitmap_frame_size -= 4; } |