Unified · Split
| @@ -1694,7 +1694,10 @@ static int mpeg_decode_slice(MpegEncContext *s, int mb_y, · 1693 unmodified lines | ||
| 1694 | 1694 | |
| 1695 | 1695 | av_assert0(mb_y < s->mb_height); |
| 1696 | 1696 | |
| 1697 | − init_get_bits(&s->gb, *buf, buf_size * 8); | |
| 1697 | + ret = init_get_bits8(&s->gb, *buf, buf_size); | |
| 1698 | + if (ret < 0) | |
| 1699 | + return ret; | |
| 1700 | + | |
| 1698 | 1701 | if (s->codec_id != AV_CODEC_ID_MPEG1VIDEO && s->mb_height > 2800/16) |
| 1699 | 1702 | skip_bits(&s->gb, 3); |
| 1700 | 1703 | |
| @@ -2063,7 +2066,9 @@ static int mpeg1_decode_sequence(AVCodecContext *avctx, · 362 unmodified lines | ||
| 2063 | 2066 | int width, height; |
| 2064 | 2067 | int i, v, j; |
| 2065 | 2068 | |
| 2066 | − init_get_bits(&s->gb, buf, buf_size * 8); | |
| 2069 | + int ret = init_get_bits8(&s->gb, buf, buf_size); | |
| 2070 | + if (ret < 0) | |
| 2071 | + return ret; | |
| 2067 | 2072 | |
| 2068 | 2073 | width = get_bits(&s->gb, 12); |
| 2069 | 2074 | height = get_bits(&s->gb, 12); |
| @@ -2228,7 +2233,9 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx, · 158 unmodified lines | ||
| 2228 | 2233 | int cc_count = 0; |
| 2229 | 2234 | int i, ret; |
| 2230 | 2235 | |
| 2231 | − init_get_bits8(&gb, p + 2, buf_size - 2); | |
| 2236 | + ret = init_get_bits8(&gb, p + 2, buf_size - 2); | |
| 2237 | + if (ret < 0) | |
| 2238 | + return ret; | |
| 2232 | 2239 | cc_count = get_bits(&gb, 5); |
| 2233 | 2240 | if (cc_count > 0) { |
| 2234 | 2241 | int old_size = s1->a53_buf_ref ? s1->a53_buf_ref->size : 0; |
| @@ -2400,7 +2407,7 @@ static void mpeg_decode_user_data(AVCodecContext *avctx, · 165 unmodified lines | ||
| 2400 | 2407 | } |
| 2401 | 2408 | } |
| 2402 | 2409 | |
| 2403 | −static void mpeg_decode_gop(AVCodecContext *avctx, | |
| 2410 | +static int mpeg_decode_gop(AVCodecContext *avctx, | |
| 2404 | 2411 | const uint8_t *buf, int buf_size) |
| 2405 | 2412 | { |
| 2406 | 2413 | Mpeg1Context *s1 = avctx->priv_data; |
| @@ -2408,7 +2415,9 @@ static void mpeg_decode_gop(AVCodecContext *avctx, · 1 unmodified line | ||
| 2408 | 2415 | int broken_link; |
| 2409 | 2416 | int64_t tc; |
| 2410 | 2417 | |
| 2411 | − init_get_bits(&s->gb, buf, buf_size * 8); | |
| 2418 | + int ret = init_get_bits8(&s->gb, buf, buf_size); | |
| 2419 | + if (ret < 0) | |
| 2420 | + return ret; | |
| 2412 | 2421 | |
| 2413 | 2422 | tc = s1->timecode_frame_start = get_bits(&s->gb, 25); |
| 2414 | 2423 | |
| @@ -2425,6 +2434,8 @@ static void mpeg_decode_gop(AVCodecContext *avctx, · 10 unmodified lines | ||
| 2425 | 2434 | "GOP (%s) closed_gop=%d broken_link=%d\n", |
| 2426 | 2435 | tcbuf, s1->closed_gop, broken_link); |
| 2427 | 2436 | } |
| 2437 | + | |
| 2438 | + return 0; | |
| 2428 | 2439 | } |
| 2429 | 2440 | |
| 2430 | 2441 | static int decode_chunks(AVCodecContext *avctx, AVFrame *picture, |
| @@ -2594,7 +2605,9 @@ static int decode_chunks(AVCodecContext *avctx, AVFrame *picture, · 163 unmodified lines | ||
| 2594 | 2605 | case GOP_START_CODE: |
| 2595 | 2606 | if (last_code == 0) { |
| 2596 | 2607 | s2->first_field = 0; |
| 2597 | − mpeg_decode_gop(avctx, buf_ptr, input_size); | |
| 2608 | + ret = mpeg_decode_gop(avctx, buf_ptr, input_size); | |
| 2609 | + if (ret < 0) | |
| 2610 | + return ret; | |
| 2598 | 2611 | s->sync = 1; |
| 2599 | 2612 | } else { |
| 2600 | 2613 | av_log(avctx, AV_LOG_ERROR, |
| @@ -2734,7 +2747,9 @@ static int decode_chunks(AVCodecContext *avctx, AVFrame *picture, · 133 unmodified lines | ||
| 2734 | 2747 | if (ret < 0) |
| 2735 | 2748 | return ret; |
| 2736 | 2749 | } |
| 2737 | − init_get_bits(&thread_context->gb, buf_ptr, input_size * 8); | |
| 2750 | + ret = init_get_bits8(&thread_context->gb, buf_ptr, input_size); | |
| 2751 | + if (ret < 0) | |
| 2752 | + return ret; | |
| 2738 | 2753 | s->slice_count++; |
| 2739 | 2754 | } |
| 2740 | 2755 | buf_ptr += 2; // FIXME add minimum number of bytes per slice |