1 files changed, 14 insertions, 9 deletions

diff --git a/ffmpeg/libavcodec/vcr1.c b/ffmpeg/libavcodec/vcr1.c
index 60bfcce..f8281ea 100644
--- a/ffmpeg/libavcodec/vcr1.c
+++ b/ffmpeg/libavcodec/vcr1.c
@@ -26,6 +26,7 @@
 
 #include "avcodec.h"
 #include "internal.h"
+#include "libavutil/avassert.h"
 #include "libavutil/internal.h"
 
 typedef struct VCR1Context {
@@ -38,24 +39,24 @@ static av_cold int vcr1_decode_init(AVCodecContext *avctx)
     avctx->pix_fmt = AV_PIX_FMT_YUV410P;
 
     if (avctx->width % 8 || avctx->height%4) {
-        avpriv_request_sample(avctx, "odd dimensions support");
-        return AVERROR_PATCHWELCOME;
+        avpriv_request_sample(avctx, "odd dimensions (%d x %d) support", avctx->width, avctx->height);
+        return AVERROR_INVALIDDATA;
     }
+
     return 0;
 }
 
 static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
                              int *got_frame, AVPacket *avpkt)
 {
-    const uint8_t *buf        = avpkt->data;
-    int buf_size              = avpkt->size;
     VCR1Context *const a      = avctx->priv_data;
     AVFrame *const p          = data;
-    const uint8_t *bytestream = buf;
+    const uint8_t *bytestream = avpkt->data;
+    const uint8_t *bytestream_end = bytestream + avpkt->size;
     int i, x, y, ret;
 
-    if(buf_size < 16 + avctx->height + avctx->width*avctx->height*5/8){
-        av_log(avctx, AV_LOG_ERROR, "Insufficient input data.\n");
+    if(avpkt->size < 32 + avctx->height + avctx->width*avctx->height*5/8){
+        av_log(avctx, AV_LOG_ERROR, "Insufficient input data. %d < %d\n", avpkt->size ,  32 + avctx->height + avctx->width*avctx->height*5/8);
         return AVERROR(EINVAL);
     }
 
@@ -77,6 +78,8 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
             uint8_t *cb = &p->data[1][(y >> 2) * p->linesize[1]];
             uint8_t *cr = &p->data[2][(y >> 2) * p->linesize[2]];
 
+            av_assert0 (bytestream_end - bytestream >= 4 + avctx->width);
+
             for (i = 0; i < 4; i++)
                 a->offset[i] = *bytestream++;
 
@@ -94,6 +97,8 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
                 bytestream += 4;
             }
         } else {
+            av_assert0 (bytestream_end - bytestream >= avctx->width / 2);
+
             offset = a->offset[y & 3] - a->delta[bytestream[2] & 0xF];
 
             for (x = 0; x < avctx->width; x += 8) {
@@ -113,16 +118,16 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
 
     *got_frame = 1;
 
-    return buf_size;
+    return bytestream - avpkt->data;
 }
 
 AVCodec ff_vcr1_decoder = {
     .name           = "vcr1",
+    .long_name      = NULL_IF_CONFIG_SMALL("ATI VCR1"),
     .type           = AVMEDIA_TYPE_VIDEO,
     .id             = AV_CODEC_ID_VCR1,
     .priv_data_size = sizeof(VCR1Context),
     .init           = vcr1_decode_init,
     .decode         = vcr1_decode_frame,
     .capabilities   = CODEC_CAP_DR1,
-    .long_name      = NULL_IF_CONFIG_SMALL("ATI VCR1"),
 };