1 files changed, 30 insertions, 14 deletions

diff --git a/ffmpeg/libavcodec/c93.c b/ffmpeg/libavcodec/c93.c
index 9aaa3ee..ad3fa3b 100644
--- a/ffmpeg/libavcodec/c93.c
+++ b/ffmpeg/libavcodec/c93.c
@@ -24,7 +24,7 @@
 #include "internal.h"
 
 typedef struct {
-    AVFrame pictures[2];
+    AVFrame *pictures[2];
     int currentpic;
 } C93DecoderContext;
 
@@ -46,21 +46,27 @@ typedef enum {
 #define C93_HAS_PALETTE 0x01
 #define C93_FIRST_FRAME 0x02
 
-static av_cold int decode_init(AVCodecContext *avctx)
+static av_cold int decode_end(AVCodecContext *avctx)
 {
-    C93DecoderContext *s = avctx->priv_data;
-    avctx->pix_fmt = AV_PIX_FMT_PAL8;
-    avcodec_get_frame_defaults(&s->pictures[0]);
-    avcodec_get_frame_defaults(&s->pictures[1]);
+    C93DecoderContext * const c93 = avctx->priv_data;
+
+    av_frame_free(&c93->pictures[0]);
+    av_frame_free(&c93->pictures[1]);
+
     return 0;
 }
 
-static av_cold int decode_end(AVCodecContext *avctx)
+static av_cold int decode_init(AVCodecContext *avctx)
 {
-    C93DecoderContext * const c93 = avctx->priv_data;
+    C93DecoderContext *s = avctx->priv_data;
+    avctx->pix_fmt = AV_PIX_FMT_PAL8;
 
-    av_frame_unref(&c93->pictures[0]);
-    av_frame_unref(&c93->pictures[1]);
+    s->pictures[0] = av_frame_alloc();
+    s->pictures[1] = av_frame_alloc();
+    if (!s->pictures[0] || !s->pictures[1]) {
+        decode_end(avctx);
+        return AVERROR(ENOMEM);
+    }
 
     return 0;
 }
@@ -121,12 +127,15 @@ static int decode_frame(AVCodecContext *avctx, void *data,
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     C93DecoderContext * const c93 = avctx->priv_data;
-    AVFrame * const newpic = &c93->pictures[c93->currentpic];
-    AVFrame * const oldpic = &c93->pictures[c93->currentpic^1];
+    AVFrame * const newpic = c93->pictures[c93->currentpic];
+    AVFrame * const oldpic = c93->pictures[c93->currentpic^1];
     GetByteContext gb;
     uint8_t *out;
     int stride, ret, i, x, y, b, bt = 0;
 
+    if ((ret = ff_set_dimensions(avctx, WIDTH, HEIGHT)) < 0)
+        return ret;
+
     c93->currentpic ^= 1;
 
     if ((ret = ff_reget_buffer(avctx, newpic)) < 0)
@@ -168,7 +177,14 @@ static int decode_frame(AVCodecContext *avctx, void *data,
             case C93_4X4_FROM_PREV:
                 for (j = 0; j < 8; j += 4) {
                     for (i = 0; i < 8; i += 4) {
-                        offset = bytestream2_get_le16(&gb);
+                        int offset = bytestream2_get_le16(&gb);
+                        int from_x = offset % WIDTH;
+                        int from_y = offset / WIDTH;
+                        if (block_type == C93_4X4_FROM_CURR && from_y == y+j &&
+                            (FFABS(from_x - x-i) < 4 || FFABS(from_x - x-i) > WIDTH-4)) {
+                            avpriv_request_sample(avctx, "block overlap %d %d %d %d\n", from_x, x+i, from_y, y+j);
+                            return AVERROR_INVALIDDATA;
+                        }
                         if ((ret = copy_block(avctx, &out[j*stride+i],
                                               copy_from, offset, 4, stride)) < 0)
                             return ret;
@@ -245,6 +261,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
 
 AVCodec ff_c93_decoder = {
     .name           = "c93",
+    .long_name      = NULL_IF_CONFIG_SMALL("Interplay C93"),
     .type           = AVMEDIA_TYPE_VIDEO,
     .id             = AV_CODEC_ID_C93,
     .priv_data_size = sizeof(C93DecoderContext),
@@ -252,5 +269,4 @@ AVCodec ff_c93_decoder = {
     .close          = decode_end,
     .decode         = decode_frame,
     .capabilities   = CODEC_CAP_DR1,
-    .long_name      = NULL_IF_CONFIG_SMALL("Interplay C93"),
 };