mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2024-12-23 15:53:08 +00:00
5db09574df
Fixes: Timeout Fixes: 64479/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EIGHTBPS_fuzzer-5434435386081280 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
183 lines
5.5 KiB
C
183 lines
5.5 KiB
C
/*
|
|
* Quicktime Planar RGB (8BPS) Video Decoder
|
|
* Copyright (C) 2003 Roberto Togni
|
|
*
|
|
* This file is part of FFmpeg.
|
|
*
|
|
* FFmpeg is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* FFmpeg is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with FFmpeg; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
/**
|
|
* @file
|
|
* QT 8BPS Video Decoder by Roberto Togni
|
|
* For more information about the 8BPS format, visit:
|
|
* http://www.pcisys.net/~melanson/codecs/
|
|
*
|
|
* Supports: PAL8 (RGB 8bpp, paletted)
|
|
* : GBRP (RGB 24bpp)
|
|
* : GBRAP (RGB 32bpp, 4th plane is alpha)
|
|
*/
|
|
|
|
#include <string.h>
|
|
|
|
#include "libavutil/intreadwrite.h"
|
|
#include "libavutil/internal.h"
|
|
#include "avcodec.h"
|
|
#include "codec_internal.h"
|
|
#include "decode.h"
|
|
|
|
typedef struct EightBpsContext {
|
|
AVCodecContext *avctx;
|
|
|
|
uint8_t planes;
|
|
uint8_t planemap[4];
|
|
|
|
uint32_t pal[256];
|
|
} EightBpsContext;
|
|
|
|
static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
|
|
int *got_frame, AVPacket *avpkt)
|
|
{
|
|
const uint8_t *buf = avpkt->data;
|
|
int buf_size = avpkt->size;
|
|
EightBpsContext * const c = avctx->priv_data;
|
|
const uint8_t *encoded = buf;
|
|
uint8_t *pixptr, *pixptr_end;
|
|
unsigned int height = avctx->height; // Real image height
|
|
unsigned int dlen, p, row;
|
|
const uint8_t *lp, *dp, *ep;
|
|
uint8_t count;
|
|
const uint8_t *planemap = c->planemap;
|
|
unsigned int planes = c->planes;
|
|
int ret;
|
|
|
|
if (buf_size < planes * height * (2 + 2*((avctx->width+128)/129)))
|
|
return AVERROR_INVALIDDATA;
|
|
|
|
if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
|
|
return ret;
|
|
|
|
ep = encoded + buf_size;
|
|
|
|
/* Set data pointer after line lengths */
|
|
dp = encoded + planes * (height << 1);
|
|
|
|
for (p = 0; p < planes; p++) {
|
|
const int pi = planemap[p];
|
|
/* Lines length pointer for this plane */
|
|
lp = encoded + p * (height << 1);
|
|
|
|
/* Decode a plane */
|
|
for (row = 0; row < height; row++) {
|
|
pixptr = frame->data[pi] + row * frame->linesize[pi];
|
|
pixptr_end = pixptr + frame->linesize[pi];
|
|
if (ep - lp < row * 2 + 2)
|
|
return AVERROR_INVALIDDATA;
|
|
dlen = AV_RB16(lp + row * 2);
|
|
/* Decode a row of this plane */
|
|
while (dlen > 0) {
|
|
if (ep - dp <= 1)
|
|
return AVERROR_INVALIDDATA;
|
|
if ((count = *dp++) <= 127) {
|
|
count++;
|
|
dlen -= count + 1;
|
|
if (pixptr_end - pixptr < count)
|
|
break;
|
|
if (ep - dp < count)
|
|
return AVERROR_INVALIDDATA;
|
|
memcpy(pixptr, dp, count);
|
|
pixptr += count;
|
|
dp += count;
|
|
} else {
|
|
count = 257 - count;
|
|
if (pixptr_end - pixptr < count)
|
|
break;
|
|
memset(pixptr, dp[0], count);
|
|
pixptr += count;
|
|
dp++;
|
|
dlen -= 2;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (avctx->bits_per_coded_sample <= 8) {
|
|
#if FF_API_PALETTE_HAS_CHANGED
|
|
FF_DISABLE_DEPRECATION_WARNINGS
|
|
frame->palette_has_changed =
|
|
#endif
|
|
ff_copy_palette(c->pal, avpkt, avctx);
|
|
#if FF_API_PALETTE_HAS_CHANGED
|
|
FF_ENABLE_DEPRECATION_WARNINGS
|
|
#endif
|
|
|
|
memcpy(frame->data[1], c->pal, AVPALETTE_SIZE);
|
|
}
|
|
|
|
*got_frame = 1;
|
|
|
|
/* always report that the buffer was completely consumed */
|
|
return buf_size;
|
|
}
|
|
|
|
static av_cold int decode_init(AVCodecContext *avctx)
|
|
{
|
|
EightBpsContext * const c = avctx->priv_data;
|
|
|
|
c->avctx = avctx;
|
|
|
|
switch (avctx->bits_per_coded_sample) {
|
|
case 8:
|
|
avctx->pix_fmt = AV_PIX_FMT_PAL8;
|
|
c->planes = 1;
|
|
c->planemap[0] = 0; // 1st plane is palette indexes
|
|
break;
|
|
case 24:
|
|
avctx->pix_fmt = AV_PIX_FMT_GBRP;
|
|
c->planes = 3;
|
|
c->planemap[0] = 2; // 1st plane is red
|
|
c->planemap[1] = 0; // 2nd plane is green
|
|
c->planemap[2] = 1; // 3rd plane is blue
|
|
break;
|
|
case 32:
|
|
avctx->pix_fmt = AV_PIX_FMT_GBRAP;
|
|
c->planes = 4;
|
|
break;
|
|
default:
|
|
av_log(avctx, AV_LOG_ERROR, "Error: Unsupported color depth: %u.\n",
|
|
avctx->bits_per_coded_sample);
|
|
return AVERROR_INVALIDDATA;
|
|
}
|
|
|
|
if (avctx->pix_fmt == AV_PIX_FMT_GBRAP) {
|
|
c->planemap[0] = 2; // 1st plane is red
|
|
c->planemap[1] = 0; // 2nd plane is green
|
|
c->planemap[2] = 1; // 3rd plane is blue
|
|
c->planemap[3] = 3; // 4th plane is alpha
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
const FFCodec ff_eightbps_decoder = {
|
|
.p.name = "8bps",
|
|
CODEC_LONG_NAME("QuickTime 8BPS video"),
|
|
.p.type = AVMEDIA_TYPE_VIDEO,
|
|
.p.id = AV_CODEC_ID_8BPS,
|
|
.priv_data_size = sizeof(EightBpsContext),
|
|
.init = decode_init,
|
|
FF_CODEC_DECODE_CB(decode_frame),
|
|
.p.capabilities = AV_CODEC_CAP_DR1,
|
|
};
|