mirror of https://git.ffmpeg.org/ffmpeg.git
Merge commit '067432c1c95882c7221e694f33d9f3bdbe46de7f'
* commit '067432c1c95882c7221e694f33d9f3bdbe46de7f': loco: check that there is data left after decoding a plane. lagarith: avoid infinite loop in lag_rac_refill() Conflicts: libavcodec/loco.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
commit
714ff44858
|
@ -107,6 +107,9 @@ static inline uint8_t lag_get_rac(lag_rac *l)
|
|||
l->range -= range_scaled * l->prob[255];
|
||||
}
|
||||
|
||||
if (!l->range)
|
||||
l->range = 0x80;
|
||||
|
||||
l->low -= range_scaled * l->prob[val];
|
||||
|
||||
return val;
|
||||
|
|
|
@ -190,7 +190,7 @@ static int decode_frame(AVCodecContext *avctx,
|
|||
p->key_frame = 1;
|
||||
|
||||
#define ADVANCE_BY_DECODED do { \
|
||||
if (decoded < 0) goto stop; \
|
||||
if (decoded < 0 || decoded >= buf_size) goto buf_too_small; \
|
||||
buf += decoded; buf_size -= decoded; \
|
||||
} while(0)
|
||||
switch(l->mode) {
|
||||
|
@ -224,7 +224,8 @@ static int decode_frame(AVCodecContext *avctx,
|
|||
decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 2, avctx->width, avctx->height,
|
||||
-p->linesize[0], buf, buf_size, 3);
|
||||
break;
|
||||
case LOCO_CRGBA: case LOCO_RGBA:
|
||||
case LOCO_CRGBA:
|
||||
case LOCO_RGBA:
|
||||
decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1), avctx->width, avctx->height,
|
||||
-p->linesize[0], buf, buf_size, 4);
|
||||
ADVANCE_BY_DECODED;
|
||||
|
@ -238,12 +239,14 @@ static int decode_frame(AVCodecContext *avctx,
|
|||
-p->linesize[0], buf, buf_size, 4);
|
||||
break;
|
||||
}
|
||||
stop:
|
||||
|
||||
*got_frame = 1;
|
||||
*(AVFrame*)data = l->pic;
|
||||
|
||||
return buf_size < 0 ? -1 : avpkt->size - buf_size;
|
||||
buf_too_small:
|
||||
av_log(avctx, AV_LOG_ERROR, "Input data too small.\n");
|
||||
return AVERROR(EINVAL);
|
||||
}
|
||||
|
||||
static av_cold int decode_init(AVCodecContext *avctx)
|
||||
|
|
Loading…
Reference in New Issue