| @@ -474,7 +474,7 @@ static int mss2_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 473 unmodified lines |
| 474 | int keyframe, has_wmv9, has_mv, is_rle, is_555, ret; | 474 | int keyframe, has_wmv9, has_mv, is_rle, is_555, ret; |
| 475 | | 475 | |
| 476 | Rectangle wmv9rects[MAX_WMV9_RECTANGLES], *r; | 476 | Rectangle wmv9rects[MAX_WMV9_RECTANGLES], *r; |
| 477 | int used_rects = 0, i, implicit_rect, av_uninit(wmv9_mask); | 477 | int used_rects = 0, i, implicit_rect = 0, av_uninit(wmv9_mask); |
| 478 | | 478 | |
| 479 | av_assert0(FF_INPUT_BUFFER_PADDING_SIZE >= | 479 | av_assert0(FF_INPUT_BUFFER_PADDING_SIZE >= |
| 480 | ARITH2_PADDING + (MIN_CACHE_BITS + 7) / 8); | 480 | ARITH2_PADDING + (MIN_CACHE_BITS + 7) / 8); |
| @@ -650,25 +650,6 @@ static int mss2_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 169 unmodified lines |
| 650 | return AVERROR_INVALIDDATA; | 650 | return AVERROR_INVALIDDATA; |
| 651 | | 651 | |
| 652 | buf_size -= bytestream2_tell(&gB); | 652 | buf_size -= bytestream2_tell(&gB); |
| 653 | } else if (is_rle) { | | |
| 654 | init_get_bits(&gb, buf, buf_size * 8); | | |
| 655 | if (ret = decode_rle(&gb, c->pal_pic, c->pal_stride, | | |
| 656 | c->rgb_pic, c->rgb_stride, c->pal, keyframe, | | |
| 657 | ctx->split_position, 0, | | |
| 658 | avctx->width, avctx->height)) | | |
| 659 | return ret; | | |
| 660 | align_get_bits(&gb); | | |
| 661 | | | |
| 662 | if (c->slice_split) | | |
| 663 | if (ret = decode_rle(&gb, c->pal_pic, c->pal_stride, | | |
| 664 | c->rgb_pic, c->rgb_stride, c->pal, keyframe, | | |
| 665 | ctx->split_position, 1, | | |
| 666 | avctx->width, avctx->height)) | | |
| 667 | return ret; | | |
| 668 | | | |
| 669 | align_get_bits(&gb); | | |
| 670 | buf += get_bits_count(&gb) >> 3; | | |
| 671 | buf_size -= get_bits_count(&gb) >> 3; | | |
| 672 | } else { | 653 | } else { |
| 673 | if (keyframe) { | 654 | if (keyframe) { |
| 674 | c->corrupted = 0; | 655 | c->corrupted = 0; |
| @@ -676,32 +657,54 @@ static int mss2_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 1 unmodified line |
| 676 | if (c->slice_split) | 657 | if (c->slice_split) |
| 677 | ff_mss12_slicecontext_reset(&ctx->sc[1]); | 658 | ff_mss12_slicecontext_reset(&ctx->sc[1]); |
| 678 | } | 659 | } |
| 679 | else if (c->corrupted) | 660 | if (is_rle) { |
| 680 | return AVERROR_INVALIDDATA; | 661 | init_get_bits(&gb, buf, buf_size * 8); |
| 681 | bytestream2_init(&gB, buf, buf_size + ARITH2_PADDING); | 662 | if (ret = decode_rle(&gb, c->pal_pic, c->pal_stride, |
| 682 | arith2_init(&acoder, &gB); | 663 | c->rgb_pic, c->rgb_stride, c->pal, keyframe, |
| 683 | c->keyframe = keyframe; | 664 | ctx->split_position, 0, |
| 684 | if (c->corrupted = ff_mss12_decode_rect(&ctx->sc[0], &acoder, 0, 0, | 665 | avctx->width, avctx->height)) |
| 685 | avctx->width, | 666 | return ret; |
| 686 | ctx->split_position)) | 667 | align_get_bits(&gb); |
| 687 | return AVERROR_INVALIDDATA; | | |
| 688 | | 668 | |
| 689 | buf += arith2_get_consumed_bytes(&acoder); | 669 | if (c->slice_split) |
| 690 | buf_size -= arith2_get_consumed_bytes(&acoder); | 670 | if (ret = decode_rle(&gb, c->pal_pic, c->pal_stride, |
| 691 | if (c->slice_split) { | 671 | c->rgb_pic, c->rgb_stride, c->pal, keyframe, |
| 692 | if (buf_size < 1) | 672 | ctx->split_position, 1, |
| | 673 | avctx->width, avctx->height)) |
| | 674 | return ret; |
| | 675 | |
| | 676 | align_get_bits(&gb); |
| | 677 | buf += get_bits_count(&gb) >> 3; |
| | 678 | buf_size -= get_bits_count(&gb) >> 3; |
| | 679 | } else if (!implicit_rect || wmv9_mask != -1) { |
| | 680 | if (c->corrupted) |
| 693 | return AVERROR_INVALIDDATA; | 681 | return AVERROR_INVALIDDATA; |
| 694 | bytestream2_init(&gB, buf, buf_size + ARITH2_PADDING); | 682 | bytestream2_init(&gB, buf, buf_size + ARITH2_PADDING); |
| 695 | arith2_init(&acoder, &gB); | 683 | arith2_init(&acoder, &gB); |
| 696 | if (c->corrupted = ff_mss12_decode_rect(&ctx->sc[1], &acoder, 0, | 684 | c->keyframe = keyframe; |
| 697 | ctx->split_position, | 685 | if (c->corrupted = ff_mss12_decode_rect(&ctx->sc[0], &acoder, 0, 0, |
| 698 | avctx->width, | 686 | avctx->width, |
| 699 | avctx->height - ctx->split_position)) | 687 | ctx->split_position)) |
| 700 | return AVERROR_INVALIDDATA; | 688 | return AVERROR_INVALIDDATA; |
| 701 | | 689 | |
| 702 | buf += arith2_get_consumed_bytes(&acoder); | 690 | buf += arith2_get_consumed_bytes(&acoder); |
| 703 | buf_size -= arith2_get_consumed_bytes(&acoder); | 691 | buf_size -= arith2_get_consumed_bytes(&acoder); |
| 704 | } | 692 | if (c->slice_split) { |
| | 693 | if (buf_size < 1) |
| | 694 | return AVERROR_INVALIDDATA; |
| | 695 | bytestream2_init(&gB, buf, buf_size + ARITH2_PADDING); |
| | 696 | arith2_init(&acoder, &gB); |
| | 697 | if (c->corrupted = ff_mss12_decode_rect(&ctx->sc[1], &acoder, 0, |
| | 698 | ctx->split_position, |
| | 699 | avctx->width, |
| | 700 | avctx->height - ctx->split_position)) |
| | 701 | return AVERROR_INVALIDDATA; |
| | 702 | |
| | 703 | buf += arith2_get_consumed_bytes(&acoder); |
| | 704 | buf_size -= arith2_get_consumed_bytes(&acoder); |
| | 705 | } |
| | 706 | } else |
| | 707 | memset(c->pal_pic, 0, c->pal_stride * avctx->height); |
| 705 | } | 708 | } |
| 706 | | 709 | |
| 707 | if (has_wmv9) { | 710 | if (has_wmv9) { |
| @@ -836,8 +839,8 @@ static av_cold int mss2_decode_init(AVCodecContext *avctx) · 128 unmodified lines |
| 836 | if (ret = ff_mss12_decode_init(c, 1, &ctx->sc[0], &ctx->sc[1])) | 839 | if (ret = ff_mss12_decode_init(c, 1, &ctx->sc[0], &ctx->sc[1])) |
| 837 | return ret; | 840 | return ret; |
| 838 | c->pal_stride = c->mask_stride; | 841 | c->pal_stride = c->mask_stride; |
| 839 | c->pal_pic = av_malloc(c->pal_stride * avctx->height); | 842 | c->pal_pic = av_mallocz(c->pal_stride * avctx->height); |
| 840 | c->last_pal_pic = av_malloc(c->pal_stride * avctx->height); | 843 | c->last_pal_pic = av_mallocz(c->pal_stride * avctx->height); |
| 841 | if (!c->pal_pic || !c->last_pal_pic) { | 844 | if (!c->pal_pic || !c->last_pal_pic) { |
| 842 | mss2_decode_end(avctx); | 845 | mss2_decode_end(avctx); |
| 843 | return AVERROR(ENOMEM); | 846 | return AVERROR(ENOMEM); |