]> git.sesse.net Git - vlc/blob - modules/codec/spudec/parse.c
* modules/codec/spudec: fixed various (innocuous) buffer overflows and
[vlc] / modules / codec / spudec / parse.c
1 /*****************************************************************************
2  * parse.c: SPU parser
3  *****************************************************************************
4  * Copyright (C) 2000-2001, 2005, 2006 the VideoLAN team
5  * $Id$
6  *
7  * Authors: Sam Hocevar <sam@zoy.org>
8  *          Laurent Aimar <fenrir@via.ecp.fr>
9  *          Gildas Bazin <gbazin@videolan.org>
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation; either version 2 of the License, or
14  * (at your option) any later version.
15  *
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19  * GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License
22  * along with this program; if not, write to the Free Software
23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
24  *****************************************************************************/
25
26 /*****************************************************************************
27  * Preamble
28  *****************************************************************************/
29 #include <vlc/vlc.h>
30 #include <vlc/vout.h>
31 #include <vlc/decoder.h>
32
33 #include "spudec.h"
34
35 /*****************************************************************************
36  * Local prototypes.
37  *****************************************************************************/
38 static int  ParseControlSeq( decoder_t *, subpicture_t *, subpicture_data_t *);
39 static int  ParseRLE       ( decoder_t *, subpicture_t *, subpicture_data_t *);
40 static void Render         ( decoder_t *, subpicture_t *, subpicture_data_t *);
41
42 /*****************************************************************************
43  * AddNibble: read a nibble from a source packet and add it to our integer.
44  *****************************************************************************/
45 static inline unsigned int AddNibble( unsigned int i_code,
46                                       uint8_t *p_src, unsigned int *pi_index )
47 {
48     if( *pi_index & 0x1 )
49     {
50         return( i_code << 4 | ( p_src[(*pi_index)++ >> 1] & 0xf ) );
51     }
52     else
53     {
54         return( i_code << 4 | p_src[(*pi_index)++ >> 1] >> 4 );
55     }
56 }
57
58 /*****************************************************************************
59  * ParsePacket: parse an SPU packet and send it to the video output
60  *****************************************************************************
61  * This function parses the SPU packet and, if valid, sends it to the
62  * video output.
63  *****************************************************************************/
64 subpicture_t * E_(ParsePacket)( decoder_t *p_dec )
65 {
66     decoder_sys_t *p_sys = p_dec->p_sys;
67     subpicture_data_t *p_spu_data;
68     subpicture_t *p_spu;
69
70     /* Allocate the subpicture internal data. */
71     p_spu = p_dec->pf_spu_buffer_new( p_dec );
72     if( !p_spu ) return NULL;
73
74     /* Rationale for the "p_spudec->i_rle_size * 4": we are going to
75      * expand the RLE stuff so that we won't need to read nibbles later
76      * on. This will speed things up a lot. Plus, we'll only need to do
77      * this stupid interlacing stuff once. */
78     p_spu_data = malloc( sizeof(subpicture_data_t) + 4 * p_sys->i_rle_size );
79     p_spu_data->p_data = (uint8_t *)p_spu_data + sizeof(subpicture_data_t);
80     p_spu_data->b_palette = VLC_FALSE;
81     p_spu_data->b_auto_crop = VLC_FALSE;
82     p_spu_data->i_y_top_offset = 0;
83     p_spu_data->i_y_bottom_offset = 0;
84
85     p_spu_data->pi_alpha[0] = 0x00;
86     p_spu_data->pi_alpha[1] = 0x0f;
87     p_spu_data->pi_alpha[2] = 0x0f;
88     p_spu_data->pi_alpha[3] = 0x0f;
89
90     /* Get display time now. If we do it later, we may miss the PTS. */
91     p_spu_data->i_pts = p_sys->i_pts;
92
93     p_spu->i_original_picture_width =
94         p_dec->fmt_in.subs.spu.i_original_frame_width;
95     p_spu->i_original_picture_height =
96         p_dec->fmt_in.subs.spu.i_original_frame_height;
97
98     /* Getting the control part */
99     if( ParseControlSeq( p_dec, p_spu, p_spu_data ) )
100     {
101         /* There was a parse error, delete the subpicture */
102         p_dec->pf_spu_buffer_del( p_dec, p_spu );
103         return NULL;
104     }
105
106     /* We try to display it */
107     if( ParseRLE( p_dec, p_spu, p_spu_data ) )
108     {
109         /* There was a parse error, delete the subpicture */
110         p_dec->pf_spu_buffer_del( p_dec, p_spu );
111         return NULL;
112     }
113
114     msg_Dbg( p_dec, "total size: 0x%x, RLE offsets: 0x%x 0x%x",
115              p_sys->i_spu_size,
116              p_spu_data->pi_offset[0], p_spu_data->pi_offset[1] );
117
118     Render( p_dec, p_spu, p_spu_data );
119     free( p_spu_data );
120
121     return p_spu;
122 }
123
124 /*****************************************************************************
125  * ParseControlSeq: parse all SPU control sequences
126  *****************************************************************************
127  * This is the most important part in SPU decoding. We get dates, palette
128  * information, coordinates, and so on. For more information on the
129  * subtitles format, see http://sam.zoy.org/doc/dvd/subtitles/index.html
130  *****************************************************************************/
131 static int ParseControlSeq( decoder_t *p_dec, subpicture_t *p_spu,
132                             subpicture_data_t *p_spu_data )
133 {
134     decoder_sys_t *p_sys = p_dec->p_sys;
135
136     /* Our current index in the SPU packet */
137     unsigned int i_index = p_sys->i_rle_size + 4;
138
139     /* The next start-of-control-sequence index and the previous one */
140     unsigned int i_next_seq = 0, i_cur_seq = 0;
141
142     /* Command and date */
143     uint8_t i_command = SPU_CMD_END;
144     mtime_t date = 0;
145
146     unsigned int i, pi_alpha[4];
147
148     /* Initialize the structure */
149     p_spu->i_start = p_spu->i_stop = 0;
150     p_spu->b_ephemer = VLC_FALSE;
151
152     for( i_index = 4 + p_sys->i_rle_size; i_index < p_sys->i_spu_size ; )
153     {
154         /* If we just read a command sequence, read the next one;
155          * otherwise, go on with the commands of the current sequence. */
156         if( i_command == SPU_CMD_END )
157         {
158             if( i_index + 4 > p_sys->i_spu_size )
159             {
160                 msg_Err( p_dec, "overflow in SPU command sequence" );
161                 return VLC_EGENERIC;
162             }
163
164             /* Get the control sequence date */
165             date = (mtime_t)GetWBE( &p_sys->buffer[i_index] ) * 11000;
166             /* FIXME How to access i_rate
167                     * p_spudec->bit_stream.p_pes->i_rate / DEFAULT_RATE;
168             */
169
170             /* Next offset */
171             i_cur_seq = i_index;
172             i_next_seq = GetWBE( &p_sys->buffer[i_index+2] );
173
174             if( i_next_seq > p_sys->i_spu_size )
175             {
176                 msg_Err( p_dec, "overflow in SPU next command sequence" );
177                 return VLC_EGENERIC;
178             }
179
180             /* Skip what we just read */
181             i_index += 4;
182         }
183
184         i_command = p_sys->buffer[i_index];
185
186         switch( i_command )
187         {
188         case SPU_CMD_FORCE_DISPLAY: /* 00 (force displaying) */
189             p_spu->i_start = p_spu_data->i_pts + date;
190             p_spu->b_ephemer = VLC_TRUE;
191             i_index += 1;
192             break;
193
194         /* Convert the dates in seconds to PTS values */
195         case SPU_CMD_START_DISPLAY: /* 01 (start displaying) */
196             p_spu->i_start = p_spu_data->i_pts + date;
197             i_index += 1;
198             break;
199
200         case SPU_CMD_STOP_DISPLAY: /* 02 (stop displaying) */
201             p_spu->i_stop = p_spu_data->i_pts + date;
202             i_index += 1;
203             break;
204
205         case SPU_CMD_SET_PALETTE:
206
207             /* 03xxxx (palette) */
208             if( i_index + 3 > p_sys->i_spu_size )
209             {
210                 msg_Err( p_dec, "overflow in SPU command" );
211                 return VLC_EGENERIC;
212             }
213
214             if( p_dec->fmt_in.subs.spu.palette[0] == 0xBeeF )
215             {
216                 unsigned int idx[4];
217
218                 p_spu_data->b_palette = VLC_TRUE;
219
220                 idx[0] = (p_sys->buffer[i_index+1]>>4)&0x0f;
221                 idx[1] = (p_sys->buffer[i_index+1])&0x0f;
222                 idx[2] = (p_sys->buffer[i_index+2]>>4)&0x0f;
223                 idx[3] = (p_sys->buffer[i_index+2])&0x0f;
224
225                 for( i = 0; i < 4 ; i++ )
226                 {
227                     uint32_t i_color = p_dec->fmt_in.subs.spu.palette[1+idx[i]];
228
229                     /* FIXME: this job should be done sooner */
230                     p_spu_data->pi_yuv[3-i][0] = (i_color>>16) & 0xff;
231                     p_spu_data->pi_yuv[3-i][1] = (i_color>>0) & 0xff;
232                     p_spu_data->pi_yuv[3-i][2] = (i_color>>8) & 0xff;
233                 }
234             }
235
236             i_index += 3;
237             break;
238
239         case SPU_CMD_SET_ALPHACHANNEL: /* 04xxxx (alpha channel) */
240             if( i_index + 3 > p_sys->i_spu_size )
241             {
242                 msg_Err( p_dec, "overflow in SPU command" );
243                 return VLC_EGENERIC;
244             }
245
246             pi_alpha[3] = (p_sys->buffer[i_index+1]>>4)&0x0f;
247             pi_alpha[2] = (p_sys->buffer[i_index+1])&0x0f;
248             pi_alpha[1] = (p_sys->buffer[i_index+2]>>4)&0x0f;
249             pi_alpha[0] = (p_sys->buffer[i_index+2])&0x0f;
250
251             /* Ignore blank alpha palette. Sometimes spurious blank
252              * alpha palettes are present - dunno why. */
253             if( pi_alpha[0] | pi_alpha[1] | pi_alpha[2] | pi_alpha[3] )
254             {
255                 p_spu_data->pi_alpha[0] = pi_alpha[0];
256                 p_spu_data->pi_alpha[1] = pi_alpha[1];
257                 p_spu_data->pi_alpha[2] = pi_alpha[2];
258                 p_spu_data->pi_alpha[3] = pi_alpha[3];
259             }
260             else
261             {
262                 msg_Warn( p_dec, "ignoring blank alpha palette" );
263             }
264
265             i_index += 3;
266             break;
267
268         case SPU_CMD_SET_COORDINATES: /* 05xxxyyyxxxyyy (coordinates) */
269             if( i_index + 7 > p_sys->i_spu_size )
270             {
271                 msg_Err( p_dec, "overflow in SPU command" );
272                 return VLC_EGENERIC;
273             }
274
275             p_spu->i_x = (p_sys->buffer[i_index+1]<<4)|
276                          ((p_sys->buffer[i_index+2]>>4)&0x0f);
277             p_spu->i_width = (((p_sys->buffer[i_index+2]&0x0f)<<8)|
278                               p_sys->buffer[i_index+3]) - p_spu->i_x + 1;
279
280             p_spu->i_y = (p_sys->buffer[i_index+4]<<4)|
281                          ((p_sys->buffer[i_index+5]>>4)&0x0f);
282             p_spu->i_height = (((p_sys->buffer[i_index+5]&0x0f)<<8)|
283                               p_sys->buffer[i_index+6]) - p_spu->i_y + 1;
284
285             /* Auto crop fullscreen subtitles */
286             if( p_spu->i_height > 250 )
287                 p_spu_data->b_auto_crop = VLC_TRUE;
288
289             i_index += 7;
290             break;
291
292         case SPU_CMD_SET_OFFSETS: /* 06xxxxyyyy (byte offsets) */
293             if( i_index + 5 > p_sys->i_spu_size )
294             {
295                 msg_Err( p_dec, "overflow in SPU command" );
296                 return VLC_EGENERIC;
297             }
298
299             p_spu_data->pi_offset[0] = GetWBE(&p_sys->buffer[i_index+1]) - 4;
300             p_spu_data->pi_offset[1] = GetWBE(&p_sys->buffer[i_index+3]) - 4;
301             i_index += 5;
302             break;
303
304         case SPU_CMD_END: /* ff (end) */
305             i_index += 1;
306             break;
307
308         default: /* xx (unknown command) */
309             msg_Warn( p_dec, "unknown SPU command 0x%.2x", i_command );
310             if( i_index + 1 < i_next_seq )
311             {
312                  /* There is at least one other command sequence */
313                  if( p_sys->buffer[i_next_seq - 1] == SPU_CMD_END )
314                  {
315                      /* This is consistent. Skip to that command sequence. */
316                      i_index = i_next_seq;
317                  }
318                  else
319                  {
320                      /* There were other commands. */
321                      msg_Warn( p_dec, "cannot recover, dropping subtitle" );
322                      return VLC_EGENERIC;
323                  }
324             }
325             else
326             {
327                 /* We were in the last command sequence. Stop parsing by
328                  * pretending we met an SPU_CMD_END command. */
329                 i_command = SPU_CMD_END;
330                 i_index++;
331             }
332         }
333
334         /* We need to check for quit commands here */
335         if( p_dec->b_die )
336         {
337             return VLC_EGENERIC;
338         }
339
340         if( i_command == SPU_CMD_END && i_index != i_next_seq )
341         {
342             break;
343         }
344     }
345
346     /* Check that the next sequence index matches the current one */
347     if( i_next_seq != i_cur_seq )
348     {
349         msg_Err( p_dec, "index mismatch (0x%.4x != 0x%.4x)",
350                  i_next_seq, i_cur_seq );
351         return VLC_EGENERIC;
352     }
353
354     if( i_index > p_sys->i_spu_size )
355     {
356         msg_Err( p_dec, "uh-oh, we went too far (0x%.4x > 0x%.4x)",
357                  i_index, p_sys->i_spu_size );
358         return VLC_EGENERIC;
359     }
360
361     if( !p_spu->i_start )
362     {
363         msg_Err( p_dec, "no `start display' command" );
364     }
365
366     if( p_spu->i_stop <= p_spu->i_start && !p_spu->b_ephemer )
367     {
368         /* This subtitle will live for 5 seconds or until the next subtitle */
369         p_spu->i_stop = p_spu->i_start + (mtime_t)500 * 11000;
370         p_spu->b_ephemer = VLC_TRUE;
371     }
372
373     /* Get rid of padding bytes */
374     if( p_sys->i_spu_size > i_index + 1 )
375     {
376         /* Zero or one padding byte are quite usual
377          * More than one padding byte - this is very strange, but
378          * we can ignore them. */
379         msg_Warn( p_dec, "%i padding bytes, we usually get 0 or 1 of them",
380                   p_sys->i_spu_size - i_index );
381     }
382
383     /* Successfully parsed ! */
384     return VLC_SUCCESS;
385 }
386
387 /*****************************************************************************
388  * ParseRLE: parse the RLE part of the subtitle
389  *****************************************************************************
390  * This part parses the subtitle graphical data and stores it in a more
391  * convenient structure for later decoding. For more information on the
392  * subtitles format, see http://sam.zoy.org/doc/dvd/subtitles/index.html
393  *****************************************************************************/
394 static int ParseRLE( decoder_t *p_dec, subpicture_t * p_spu,
395                      subpicture_data_t *p_spu_data )
396 {
397     decoder_sys_t *p_sys = p_dec->p_sys;
398     uint8_t       *p_src = &p_sys->buffer[4];
399
400     unsigned int i_code;
401
402     unsigned int i_width = p_spu->i_width;
403     unsigned int i_height = p_spu->i_height;
404     unsigned int i_x, i_y;
405
406     uint16_t *p_dest = (uint16_t *)p_spu_data->p_data;
407
408     /* The subtitles are interlaced, we need two offsets */
409     unsigned int  i_id = 0;                   /* Start on the even SPU layer */
410     unsigned int  pi_table[ 2 ];
411     unsigned int *pi_offset;
412
413     /* Cropping */
414     vlc_bool_t b_empty_top = VLC_TRUE;
415     unsigned int i_skipped_top = 0, i_skipped_bottom = 0;
416     unsigned int i_transparent_code = 0;
417  
418     /* Colormap statistics */
419     int i_border = -1;
420     int stats[4]; stats[0] = stats[1] = stats[2] = stats[3] = 0;
421
422     pi_table[ 0 ] = p_spu_data->pi_offset[ 0 ] << 1;
423     pi_table[ 1 ] = p_spu_data->pi_offset[ 1 ] << 1;
424
425     for( i_y = 0 ; i_y < i_height ; i_y++ )
426     {
427         pi_offset = pi_table + i_id;
428
429         for( i_x = 0 ; i_x < i_width ; i_x += i_code >> 2 )
430         {
431             i_code = AddNibble( 0, p_src, pi_offset );
432
433             if( i_code < 0x04 )
434             {
435                 i_code = AddNibble( i_code, p_src, pi_offset );
436
437                 if( i_code < 0x10 )
438                 {
439                     i_code = AddNibble( i_code, p_src, pi_offset );
440
441                     if( i_code < 0x040 )
442                     {
443                         i_code = AddNibble( i_code, p_src, pi_offset );
444
445                         if( i_code < 0x0100 )
446                         {
447                             /* If the 14 first bits are set to 0, then it's a
448                              * new line. We emulate it. */
449                             if( i_code < 0x0004 )
450                             {
451                                 i_code |= ( i_width - i_x ) << 2;
452                             }
453                             else
454                             {
455                                 /* We have a boo boo ! */
456                                 msg_Err( p_dec, "unknown RLE code "
457                                          "0x%.4x", i_code );
458                                 return VLC_EGENERIC;
459                             }
460                         }
461                     }
462                 }
463             }
464
465             if( ( (i_code >> 2) + i_x + i_y * i_width ) > i_height * i_width )
466             {
467                 msg_Err( p_dec, "out of bounds, %i at (%i,%i) is out of %ix%i",
468                          i_code >> 2, i_x, i_y, i_width, i_height );
469                 return VLC_EGENERIC;
470             }
471
472             /* Try to find the border color */
473             if( p_spu_data->pi_alpha[ i_code & 0x3 ] != 0x00 )
474             {
475                 i_border = i_code & 0x3;
476                 stats[i_border] += i_code >> 2;
477             }
478
479             /* Auto crop subtitles (a lot more optimized) */
480             if( p_spu_data->b_auto_crop )
481             {
482                 if( !i_y )
483                 {
484                     /* We assume that if the first line is transparent, then
485                      * it is using the palette index for the
486                      * (background) transparent color */
487                     if( (i_code >> 2) == i_width &&
488                         p_spu_data->pi_alpha[ i_code & 0x3 ] == 0x00 )
489                     {
490                         i_transparent_code = i_code;
491                     }
492                     else
493                     {
494                         p_spu_data->b_auto_crop = VLC_FALSE;
495                     }
496                 }
497
498                 if( i_code == i_transparent_code )
499                 {
500                     if( b_empty_top )
501                     {
502                         /* This is a blank top line, we skip it */
503                       i_skipped_top++;
504                     }
505                     else
506                     {
507                         /* We can't be sure the current lines will be skipped,
508                          * so we store the code just in case. */
509                       *p_dest++ = i_code;
510                       i_skipped_bottom++;
511                     }
512                 }
513                 else
514                 {
515                     /* We got a valid code, store it */
516                     *p_dest++ = i_code;
517
518                     /* Valid code means no blank line */
519                     b_empty_top = VLC_FALSE;
520                     i_skipped_bottom = 0;
521                 }
522             }
523             else
524             {
525                 *p_dest++ = i_code;
526             }
527         }
528
529         /* Check that we didn't go too far */
530         if( i_x > i_width )
531         {
532             msg_Err( p_dec, "i_x overflowed, %i > %i", i_x, i_width );
533             return VLC_EGENERIC;
534         }
535
536         /* Byte-align the stream */
537         if( *pi_offset & 0x1 )
538         {
539             (*pi_offset)++;
540         }
541
542         /* Swap fields */
543         i_id = ~i_id & 0x1;
544     }
545
546     /* We shouldn't get any padding bytes */
547     if( i_y < i_height )
548     {
549         msg_Err( p_dec, "padding bytes found in RLE sequence" );
550         msg_Err( p_dec, "send mail to <sam@zoy.org> if you "
551                         "want to help debugging this" );
552
553         /* Skip them just in case */
554         while( i_y < i_height )
555         {
556             *p_dest++ = i_width << 2;
557             i_y++;
558         }
559
560         return VLC_EGENERIC;
561     }
562
563     msg_Dbg( p_dec, "valid subtitle, size: %ix%i, position: %i,%i",
564              p_spu->i_width, p_spu->i_height, p_spu->i_x, p_spu->i_y );
565
566     /* Crop if necessary */
567     if( i_skipped_top || i_skipped_bottom )
568     {
569         int i_y = p_spu->i_y + i_skipped_top;
570         int i_height = p_spu->i_height - (i_skipped_top + i_skipped_bottom);
571
572         p_spu_data->i_y_top_offset = i_skipped_top;
573         p_spu_data->i_y_bottom_offset = i_skipped_bottom;
574         msg_Dbg( p_dec, "cropped to: %ix%i, position: %i,%i",
575                  p_spu->i_width, i_height, p_spu->i_x, i_y );
576     }
577  
578     /* Handle color if no palette was found */
579     if( !p_spu_data->b_palette )
580     {
581         int i, i_inner = -1, i_shade = -1;
582
583         /* Set the border color */
584         p_spu_data->pi_yuv[i_border][0] = 0x00;
585         p_spu_data->pi_yuv[i_border][1] = 0x80;
586         p_spu_data->pi_yuv[i_border][2] = 0x80;
587         stats[i_border] = 0;
588
589         /* Find the inner colors */
590         for( i = 0 ; i < 4 && i_inner == -1 ; i++ )
591         {
592             if( stats[i] )
593             {
594                 i_inner = i;
595             }
596         }
597
598         for(       ; i < 4 && i_shade == -1 ; i++ )
599         {
600             if( stats[i] )
601             {
602                 if( stats[i] > stats[i_inner] )
603                 {
604                     i_shade = i_inner;
605                     i_inner = i;
606                 }
607                 else
608                 {
609                     i_shade = i;
610                 }
611             }
612         }
613
614         /* Set the inner color */
615         if( i_inner != -1 )
616         {
617             p_spu_data->pi_yuv[i_inner][0] = 0xff;
618             p_spu_data->pi_yuv[i_inner][1] = 0x80;
619             p_spu_data->pi_yuv[i_inner][2] = 0x80;
620         }
621
622         /* Set the anti-aliasing color */
623         if( i_shade != -1 )
624         {
625             p_spu_data->pi_yuv[i_shade][0] = 0x80;
626             p_spu_data->pi_yuv[i_shade][1] = 0x80;
627             p_spu_data->pi_yuv[i_shade][2] = 0x80;
628         }
629
630         msg_Dbg( p_dec, "using custom palette (border %i, inner %i, shade %i)",
631                  i_border, i_inner, i_shade );
632     }
633
634     return VLC_SUCCESS;
635 }
636
637 static void Render( decoder_t *p_dec, subpicture_t *p_spu,
638                     subpicture_data_t *p_spu_data )
639 {
640     uint8_t *p_p;
641     int i_x, i_y, i_len, i_color, i_pitch;
642     uint16_t *p_source = (uint16_t *)p_spu_data->p_data;
643     video_format_t fmt;
644
645     /* Create a new subpicture region */
646     memset( &fmt, 0, sizeof(video_format_t) );
647     fmt.i_chroma = VLC_FOURCC('Y','U','V','P');
648     fmt.i_aspect = 0; /* 0 means use aspect ratio of background video */
649     fmt.i_width = fmt.i_visible_width = p_spu->i_width;
650     fmt.i_height = fmt.i_visible_height = p_spu->i_height -
651         p_spu_data->i_y_top_offset - p_spu_data->i_y_bottom_offset;
652     fmt.i_x_offset = fmt.i_y_offset = 0;
653     p_spu->p_region = p_spu->pf_create_region( VLC_OBJECT(p_dec), &fmt );
654     if( !p_spu->p_region )
655     {
656         msg_Err( p_dec, "cannot allocate SPU region" );
657         return;
658     }
659
660     p_spu->p_region->i_x = 0;
661     p_spu->p_region->i_y = p_spu_data->i_y_top_offset;
662     p_p = p_spu->p_region->picture.p->p_pixels;
663     i_pitch = p_spu->p_region->picture.p->i_pitch;
664
665     /* Build palette */
666     fmt.p_palette->i_entries = 4;
667     for( i_x = 0; i_x < fmt.p_palette->i_entries; i_x++ )
668     {
669         fmt.p_palette->palette[i_x][0] = p_spu_data->pi_yuv[i_x][0];
670         fmt.p_palette->palette[i_x][1] = p_spu_data->pi_yuv[i_x][1];
671         fmt.p_palette->palette[i_x][2] = p_spu_data->pi_yuv[i_x][2];
672         fmt.p_palette->palette[i_x][3] =
673             p_spu_data->pi_alpha[i_x] == 0xf ? 0xff :
674             p_spu_data->pi_alpha[i_x] << 4;
675     }
676
677     /* Draw until we reach the bottom of the subtitle */
678     for( i_y = 0; i_y < (int)fmt.i_height * i_pitch; i_y += i_pitch )
679     {
680         /* Draw until we reach the end of the line */
681         for( i_x = 0 ; i_x < (int)fmt.i_width; i_x += i_len )
682         {
683             /* Get the RLE part, then draw the line */
684             i_color = *p_source & 0x3;
685             i_len = *p_source++ >> 2;
686             memset( p_p + i_x + i_y, i_color, i_len );
687         }
688     }
689 }