Unified · Split
| @@ -45,43 +45,43 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data, · 44 unmodified lines | |||
| 45 | uint32_t pixformat, pixdepth, bunit, bitorder, bpad; | 45 | uint32_t pixformat, pixdepth, bunit, bitorder, bpad; |
| 46 | uint32_t rgb[3]; | 46 | uint32_t rgb[3]; |
| 47 | uint8_t *ptr; | 47 | uint8_t *ptr; |
| 48 | GetByteContext gb; | ||
| 48 | 49 | ||
| 49 | if (buf_size < XWD_HEADER_SIZE) | 50 | if (buf_size < XWD_HEADER_SIZE) |
| 50 | return AVERROR_INVALIDDATA; | 51 | return AVERROR_INVALIDDATA; |
| 51 | 52 | ||
| 52 | header_size = bytestream_get_be32(&buf); | 53 | bytestream2_init(&gb, buf, buf_size); |
| 53 | if (buf_size < header_size) | 54 | header_size = bytestream2_get_be32u(&gb); |
| 54 | return AVERROR_INVALIDDATA; | ||
| 55 | 55 | ||
| 56 | version = bytestream_get_be32(&buf); | 56 | version = bytestream2_get_be32u(&gb); |
| 57 | if (version != XWD_VERSION) { | 57 | if (version != XWD_VERSION) { |
| 58 | av_log(avctx, AV_LOG_ERROR, "unsupported version\n"); | 58 | av_log(avctx, AV_LOG_ERROR, "unsupported version\n"); |
| 59 | return AVERROR_INVALIDDATA; | 59 | return AVERROR_INVALIDDATA; |
| 60 | } | 60 | } |
| 61 | 61 | ||
| 62 | if (header_size < XWD_HEADER_SIZE) { | 62 | if (buf_size < header_size || header_size < XWD_HEADER_SIZE) { |
| 63 | av_log(avctx, AV_LOG_ERROR, "invalid header size\n"); | 63 | av_log(avctx, AV_LOG_ERROR, "invalid header size\n"); |
| 64 | return AVERROR_INVALIDDATA; | 64 | return AVERROR_INVALIDDATA; |
| 65 | } | 65 | } |
| 66 | 66 | ||
| 67 | pixformat = bytestream_get_be32(&buf); | 67 | pixformat = bytestream2_get_be32u(&gb); |
| 68 | pixdepth = bytestream_get_be32(&buf); | 68 | pixdepth = bytestream2_get_be32u(&gb); |
| 69 | avctx->width = bytestream_get_be32(&buf); | 69 | avctx->width = bytestream2_get_be32u(&gb); |
| 70 | avctx->height = bytestream_get_be32(&buf); | 70 | avctx->height = bytestream2_get_be32u(&gb); |
| 71 | xoffset = bytestream_get_be32(&buf); | 71 | xoffset = bytestream2_get_be32u(&gb); |
| 72 | be = bytestream_get_be32(&buf); | 72 | be = bytestream2_get_be32u(&gb); |
| 73 | bunit = bytestream_get_be32(&buf); | 73 | bunit = bytestream2_get_be32u(&gb); |
| 74 | bitorder = bytestream_get_be32(&buf); | 74 | bitorder = bytestream2_get_be32u(&gb); |
| 75 | bpad = bytestream_get_be32(&buf); | 75 | bpad = bytestream2_get_be32u(&gb); |
| 76 | bpp = bytestream_get_be32(&buf); | 76 | bpp = bytestream2_get_be32u(&gb); |
| 77 | lsize = bytestream_get_be32(&buf); | 77 | lsize = bytestream2_get_be32u(&gb); |
| 78 | vclass = bytestream_get_be32(&buf); | 78 | vclass = bytestream2_get_be32u(&gb); |
| 79 | rgb[0] = bytestream_get_be32(&buf); | 79 | rgb[0] = bytestream2_get_be32u(&gb); |
| 80 | rgb[1] = bytestream_get_be32(&buf); | 80 | rgb[1] = bytestream2_get_be32u(&gb); |
| 81 | rgb[2] = bytestream_get_be32(&buf); | 81 | rgb[2] = bytestream2_get_be32u(&gb); |
| 82 | buf += 8; | 82 | bytestream2_skipu(&gb, 8); |
| 83 | ncolors = bytestream_get_be32(&buf); | 83 | ncolors = bytestream2_get_be32u(&gb); |
| 84 | buf += header_size - (XWD_HEADER_SIZE - 20); | 84 | bytestream2_skipu(&gb, header_size - (XWD_HEADER_SIZE - 20)); |
| 85 | 85 | ||
| 86 | av_log(avctx, AV_LOG_DEBUG, "pixformat %d, pixdepth %d, bunit %d, bitorder %d, bpad %d\n", | 86 | av_log(avctx, AV_LOG_DEBUG, "pixformat %d, pixdepth %d, bunit %d, bitorder %d, bpad %d\n", |
| 87 | pixformat, pixdepth, bunit, bitorder, bpad); | 87 | pixformat, pixdepth, bunit, bitorder, bpad); |
| @@ -143,7 +143,7 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data, · 55 unmodified lines | |||
| 143 | return AVERROR_INVALIDDATA; | 143 | return AVERROR_INVALIDDATA; |
| 144 | } | 144 | } |
| 145 | 145 | ||
| 146 | if (buf_size < header_size + ncolors * XWD_CMAP_SIZE + avctx->height * lsize) { | 146 | if (bytestream2_get_bytes_left(&gb) < ncolors * XWD_CMAP_SIZE + avctx->height * lsize) { |
| 147 | av_log(avctx, AV_LOG_ERROR, "input buffer too small\n"); | 147 | av_log(avctx, AV_LOG_ERROR, "input buffer too small\n"); |
| 148 | return AVERROR_INVALIDDATA; | 148 | return AVERROR_INVALIDDATA; |
| 149 | } | 149 | } |
| @@ -192,7 +192,7 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data, · 42 unmodified lines | |||
| 192 | else if (rgb[0] == 0xFF && rgb[1] == 0xFF00 && rgb[2] == 0xFF0000) | 192 | else if (rgb[0] == 0xFF && rgb[1] == 0xFF00 && rgb[2] == 0xFF0000) |
| 193 | avctx->pix_fmt = be ? PIX_FMT_ABGR : PIX_FMT_RGBA; | 193 | avctx->pix_fmt = be ? PIX_FMT_ABGR : PIX_FMT_RGBA; |
| 194 | } | 194 | } |
| 195 | buf += ncolors * XWD_CMAP_SIZE; | 195 | bytestream2_skipu(&gb, ncolors * XWD_CMAP_SIZE); |
| 196 | break; | 196 | break; |
| 197 | default: | 197 | default: |
| 198 | av_log(avctx, AV_LOG_ERROR, "invalid visual class\n"); | 198 | av_log(avctx, AV_LOG_ERROR, "invalid visual class\n"); |
| @@ -222,11 +222,13 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data, · 23 unmodified lines | |||
| 222 | 222 | ||
| 223 | for (i = 0; i < ncolors; i++) { | 223 | for (i = 0; i < ncolors; i++) { |
| 224 | 224 | ||
| 225 | buf += 4; // skip colormap entry number | 225 | bytestream2_skipu(&gb, 4); // skip colormap entry number |
| 226 | red = *buf; buf += 2; | 226 | red = bytestream2_get_byteu(&gb); |
| 227 | green = *buf; buf += 2; | 227 | bytestream2_skipu(&gb, 1); |
| 228 | blue = *buf; buf += 2; | 228 | green = bytestream2_get_byteu(&gb); |
| 229 | buf += 2; // skip bitmask flag and padding | 229 | bytestream2_skipu(&gb, 1); |
| 230 | blue = bytestream2_get_byteu(&gb); | ||
| 231 | bytestream2_skipu(&gb, 3); // skip bitmask flag and padding | ||
| 230 | 232 | ||
| 231 | dst[i] = red << 16 | green << 8 | blue; | 233 | dst[i] = red << 16 | green << 8 | blue; |
| 232 | } | 234 | } |
| @@ -234,8 +236,8 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data, · 1 unmodified line | |||
| 234 | 236 | ||
| 235 | ptr = p->data[0]; | 237 | ptr = p->data[0]; |
| 236 | for (i = 0; i < avctx->height; i++) { | 238 | for (i = 0; i < avctx->height; i++) { |
| 237 | bytestream_get_buffer(&buf, ptr, rsize); | 239 | bytestream2_get_bufferu(&gb, ptr, rsize); |
| 238 | buf += lsize - rsize; | 240 | bytestream2_skipu(&gb, lsize - rsize); |
| 239 | ptr += p->linesize[0]; | 241 | ptr += p->linesize[0]; |
| 240 | } | 242 | } |
| 241 | 243 | ||