| @@ -474,7 +474,7 @@ static int mss2_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 473 unmodified lines |
| 474 | 474 | int keyframe, has_wmv9, has_mv, is_rle, is_555, ret; |
| 475 | 475 | |
| 476 | 476 | Rectangle wmv9rects[MAX_WMV9_RECTANGLES], *r; |
| 477 | | − int used_rects = 0, i, implicit_rect, av_uninit(wmv9_mask); |
| 477 | + int used_rects = 0, i, implicit_rect = 0, av_uninit(wmv9_mask); |
| 478 | 478 | |
| 479 | 479 | av_assert0(FF_INPUT_BUFFER_PADDING_SIZE >= |
| 480 | 480 | ARITH2_PADDING + (MIN_CACHE_BITS + 7) / 8); |
| @@ -650,25 +650,6 @@ static int mss2_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 169 unmodified lines |
| 650 | 650 | return AVERROR_INVALIDDATA; |
| 651 | 651 | |
| 652 | 652 | buf_size -= bytestream2_tell(&gB); |
| 653 | | − } else if (is_rle) { |
| 654 | | − init_get_bits(&gb, buf, buf_size * 8); |
| 655 | | − if (ret = decode_rle(&gb, c->pal_pic, c->pal_stride, |
| 656 | | − c->rgb_pic, c->rgb_stride, c->pal, keyframe, |
| 657 | | − ctx->split_position, 0, |
| 658 | | − avctx->width, avctx->height)) |
| 659 | | − return ret; |
| 660 | | − align_get_bits(&gb); |
| 661 | | − |
| 662 | | − if (c->slice_split) |
| 663 | | − if (ret = decode_rle(&gb, c->pal_pic, c->pal_stride, |
| 664 | | − c->rgb_pic, c->rgb_stride, c->pal, keyframe, |
| 665 | | − ctx->split_position, 1, |
| 666 | | − avctx->width, avctx->height)) |
| 667 | | − return ret; |
| 668 | | − |
| 669 | | − align_get_bits(&gb); |
| 670 | | − buf += get_bits_count(&gb) >> 3; |
| 671 | | − buf_size -= get_bits_count(&gb) >> 3; |
| 672 | 653 | } else { |
| 673 | 654 | if (keyframe) { |
| 674 | 655 | c->corrupted = 0; |
| @@ -676,32 +657,54 @@ static int mss2_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 1 unmodified line |
| 676 | 657 | if (c->slice_split) |
| 677 | 658 | ff_mss12_slicecontext_reset(&ctx->sc[1]); |
| 678 | 659 | } |
| 679 | | − else if (c->corrupted) |
| 680 | | − return AVERROR_INVALIDDATA; |
| 681 | | − bytestream2_init(&gB, buf, buf_size + ARITH2_PADDING); |
| 682 | | − arith2_init(&acoder, &gB); |
| 683 | | − c->keyframe = keyframe; |
| 684 | | − if (c->corrupted = ff_mss12_decode_rect(&ctx->sc[0], &acoder, 0, 0, |
| 685 | | − avctx->width, |
| 686 | | − ctx->split_position)) |
| 687 | | − return AVERROR_INVALIDDATA; |
| 660 | + if (is_rle) { |
| 661 | + init_get_bits(&gb, buf, buf_size * 8); |
| 662 | + if (ret = decode_rle(&gb, c->pal_pic, c->pal_stride, |
| 663 | + c->rgb_pic, c->rgb_stride, c->pal, keyframe, |
| 664 | + ctx->split_position, 0, |
| 665 | + avctx->width, avctx->height)) |
| 666 | + return ret; |
| 667 | + align_get_bits(&gb); |
| 688 | 668 | |
| 689 | | − buf += arith2_get_consumed_bytes(&acoder); |
| 690 | | − buf_size -= arith2_get_consumed_bytes(&acoder); |
| 691 | | − if (c->slice_split) { |
| 692 | | − if (buf_size < 1) |
| 669 | + if (c->slice_split) |
| 670 | + if (ret = decode_rle(&gb, c->pal_pic, c->pal_stride, |
| 671 | + c->rgb_pic, c->rgb_stride, c->pal, keyframe, |
| 672 | + ctx->split_position, 1, |
| 673 | + avctx->width, avctx->height)) |
| 674 | + return ret; |
| 675 | + |
| 676 | + align_get_bits(&gb); |
| 677 | + buf += get_bits_count(&gb) >> 3; |
| 678 | + buf_size -= get_bits_count(&gb) >> 3; |
| 679 | + } else if (!implicit_rect || wmv9_mask != -1) { |
| 680 | + if (c->corrupted) |
| 693 | 681 | return AVERROR_INVALIDDATA; |
| 694 | 682 | bytestream2_init(&gB, buf, buf_size + ARITH2_PADDING); |
| 695 | 683 | arith2_init(&acoder, &gB); |
| 696 | | − if (c->corrupted = ff_mss12_decode_rect(&ctx->sc[1], &acoder, 0, |
| 697 | | − ctx->split_position, |
| 684 | + c->keyframe = keyframe; |
| 685 | + if (c->corrupted = ff_mss12_decode_rect(&ctx->sc[0], &acoder, 0, 0, |
| 698 | 686 | avctx->width, |
| 699 | | − avctx->height - ctx->split_position)) |
| 687 | + ctx->split_position)) |
| 700 | 688 | return AVERROR_INVALIDDATA; |
| 701 | 689 | |
| 702 | 690 | buf += arith2_get_consumed_bytes(&acoder); |
| 703 | 691 | buf_size -= arith2_get_consumed_bytes(&acoder); |
| 704 | | − } |
| 692 | + if (c->slice_split) { |
| 693 | + if (buf_size < 1) |
| 694 | + return AVERROR_INVALIDDATA; |
| 695 | + bytestream2_init(&gB, buf, buf_size + ARITH2_PADDING); |
| 696 | + arith2_init(&acoder, &gB); |
| 697 | + if (c->corrupted = ff_mss12_decode_rect(&ctx->sc[1], &acoder, 0, |
| 698 | + ctx->split_position, |
| 699 | + avctx->width, |
| 700 | + avctx->height - ctx->split_position)) |
| 701 | + return AVERROR_INVALIDDATA; |
| 702 | + |
| 703 | + buf += arith2_get_consumed_bytes(&acoder); |
| 704 | + buf_size -= arith2_get_consumed_bytes(&acoder); |
| 705 | + } |
| 706 | + } else |
| 707 | + memset(c->pal_pic, 0, c->pal_stride * avctx->height); |
| 705 | 708 | } |
| 706 | 709 | |
| 707 | 710 | if (has_wmv9) { |
| @@ -836,8 +839,8 @@ static av_cold int mss2_decode_init(AVCodecContext *avctx) · 128 unmodified lines |
| 836 | 839 | if (ret = ff_mss12_decode_init(c, 1, &ctx->sc[0], &ctx->sc[1])) |
| 837 | 840 | return ret; |
| 838 | 841 | c->pal_stride = c->mask_stride; |
| 839 | | − c->pal_pic = av_malloc(c->pal_stride * avctx->height); |
| 840 | | − c->last_pal_pic = av_malloc(c->pal_stride * avctx->height); |
| 842 | + c->pal_pic = av_mallocz(c->pal_stride * avctx->height); |
| 843 | + c->last_pal_pic = av_mallocz(c->pal_stride * avctx->height); |
| 841 | 844 | if (!c->pal_pic || !c->last_pal_pic) { |
| 842 | 845 | mss2_decode_end(avctx); |
| 843 | 846 | return AVERROR(ENOMEM); |