diff options
Diffstat (limited to 'ffmpeg/libavcodec/interplayvideo.c')
| -rw-r--r-- | ffmpeg/libavcodec/interplayvideo.c | 27 |
1 files changed, 26 insertions, 1 deletions
diff --git a/ffmpeg/libavcodec/interplayvideo.c b/ffmpeg/libavcodec/interplayvideo.c index 4f710b8..542fefe 100644 --- a/ffmpeg/libavcodec/interplayvideo.c +++ b/ffmpeg/libavcodec/interplayvideo.c @@ -197,6 +197,11 @@ static int ipvideo_decode_block_opcode_0x7(IpvideoContext *s, AVFrame *frame) unsigned char P[2]; unsigned int flags; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 4) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0x7\n"); + return AVERROR_INVALIDDATA; + } + /* 2-color encoding */ P[0] = bytestream2_get_byte(&s->stream_ptr); P[1] = bytestream2_get_byte(&s->stream_ptr); @@ -236,6 +241,11 @@ static int ipvideo_decode_block_opcode_0x8(IpvideoContext *s, AVFrame *frame) unsigned char P[4]; unsigned int flags = 0; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 12) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0x8\n"); + return AVERROR_INVALIDDATA; + } + /* 2-color encoding for each 4x4 quadrant, or 2-color encoding on * either top and bottom or left and right halves */ P[0] = bytestream2_get_byte(&s->stream_ptr); @@ -308,6 +318,11 @@ static int ipvideo_decode_block_opcode_0x9(IpvideoContext *s, AVFrame *frame) int x, y; unsigned char P[4]; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 8) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0x9\n"); + return AVERROR_INVALIDDATA; + } + /* 4-color encoding */ bytestream2_get_buffer(&s->stream_ptr, P, 4); @@ -374,6 +389,11 @@ static int ipvideo_decode_block_opcode_0xA(IpvideoContext *s, AVFrame *frame) unsigned char P[8]; int flags = 0; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 16) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0xA\n"); + return AVERROR_INVALIDDATA; + } + bytestream2_get_buffer(&s->stream_ptr, P, 4); /* 4-color encoding for each 4x4 quadrant, or 4-color encoding on @@ -467,6 +487,11 @@ static int ipvideo_decode_block_opcode_0xD(IpvideoContext *s, AVFrame *frame) int y; unsigned char P[2]; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 4) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0xD\n"); + return AVERROR_INVALIDDATA; + } + /* 4-color block encoding: each 4x4 block is a different color */ for (y = 0; y < 8; y++) { if (!(y & 3)) { @@ -1016,6 +1041,7 @@ static av_cold int ipvideo_decode_end(AVCodecContext *avctx) AVCodec ff_interplay_video_decoder = { .name = "interplayvideo", + .long_name = NULL_IF_CONFIG_SMALL("Interplay MVE video"), .type = AVMEDIA_TYPE_VIDEO, .id = AV_CODEC_ID_INTERPLAY_VIDEO, .priv_data_size = sizeof(IpvideoContext), @@ -1023,5 +1049,4 @@ AVCodec ff_interplay_video_decoder = { .close = ipvideo_decode_end, .decode = ipvideo_decode_frame, .capabilities = CODEC_CAP_DR1 | CODEC_CAP_PARAM_CHANGE, - .long_name = NULL_IF_CONFIG_SMALL("Interplay MVE video"), }; |