mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/rl2: Fix undefined pointer arithmetic
Don't increment back_frame if it does not correspond to a real buffer. To do this, handle copying from the back frame separately from the "use coded value" codepath; also use memcpy for the former, as the chunks here are typically worth it. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
parent
73f104201b
commit
87f243911e
|
@ -69,13 +69,16 @@ static void rl2_rle_decode(Rl2Context *s, const uint8_t *in, int size,
|
||||||
uint8_t *line_end;
|
uint8_t *line_end;
|
||||||
|
|
||||||
/** copy start of the background frame */
|
/** copy start of the background frame */
|
||||||
|
if (s->back_frame) {
|
||||||
for (i = 0; i <= base_y; i++) {
|
for (i = 0; i <= base_y; i++) {
|
||||||
if (s->back_frame)
|
|
||||||
memcpy(out, back_frame, s->avctx->width);
|
memcpy(out, back_frame, s->avctx->width);
|
||||||
out += stride;
|
out += stride;
|
||||||
back_frame += s->avctx->width;
|
back_frame += s->avctx->width;
|
||||||
}
|
}
|
||||||
back_frame += base_x - s->avctx->width;
|
back_frame += base_x - s->avctx->width;
|
||||||
|
} else {
|
||||||
|
out += stride * (base_y + 1);
|
||||||
|
}
|
||||||
line_end = out - stride_adj;
|
line_end = out - stride_adj;
|
||||||
out += base_x - stride;
|
out += base_x - stride;
|
||||||
|
|
||||||
|
@ -89,16 +92,32 @@ static void rl2_rle_decode(Rl2Context *s, const uint8_t *in, int size,
|
||||||
len = *in++;
|
len = *in++;
|
||||||
if (!len)
|
if (!len)
|
||||||
break;
|
break;
|
||||||
|
val &= 0x7F;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (s->back_frame)
|
if (back_frame) {
|
||||||
|
if (!val) {
|
||||||
|
do {
|
||||||
|
size_t copy = FFMIN(line_end - out, len);
|
||||||
|
memcpy(out, back_frame, copy);
|
||||||
|
out += copy;
|
||||||
|
back_frame += copy;
|
||||||
|
len -= copy;
|
||||||
|
if (out == line_end) {
|
||||||
|
if (out == out_end)
|
||||||
|
return;
|
||||||
|
out += stride_adj;
|
||||||
|
line_end += stride;
|
||||||
|
}
|
||||||
|
} while (len > 0);
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
back_frame += len;
|
||||||
val |= 0x80;
|
val |= 0x80;
|
||||||
else
|
}
|
||||||
val &= ~0x80;
|
|
||||||
|
|
||||||
while (len--) {
|
while (len--) {
|
||||||
*out++ = (val == 0x80) ? *back_frame : val;
|
*out++ = val;
|
||||||
back_frame++;
|
|
||||||
if (out == line_end) {
|
if (out == line_end) {
|
||||||
if (out == out_end)
|
if (out == out_end)
|
||||||
return;
|
return;
|
||||||
|
@ -164,7 +183,9 @@ static av_cold int rl2_decode_init(AVCodecContext *avctx)
|
||||||
back_size = avctx->extradata_size - EXTRADATA1_SIZE;
|
back_size = avctx->extradata_size - EXTRADATA1_SIZE;
|
||||||
|
|
||||||
if (back_size > 0) {
|
if (back_size > 0) {
|
||||||
uint8_t *back_frame = av_mallocz(avctx->width*avctx->height);
|
/* The 254 are padding to ensure that pointer arithmetic stays within
|
||||||
|
* the buffer. */
|
||||||
|
uint8_t *back_frame = av_mallocz(avctx->width * avctx->height + 254);
|
||||||
if (!back_frame)
|
if (!back_frame)
|
||||||
return AVERROR(ENOMEM);
|
return AVERROR(ENOMEM);
|
||||||
rl2_rle_decode(s, avctx->extradata + EXTRADATA1_SIZE, back_size,
|
rl2_rle_decode(s, avctx->extradata + EXTRADATA1_SIZE, back_size,
|
||||||
|
|
Loading…
Reference in New Issue