- const uint8_t *buf = avpkt->data;
- int buf_size = avpkt->size;
- EightBpsContext * const c = avctx->priv_data;
- const unsigned char *encoded = buf;
- unsigned char *pixptr, *pixptr_end;
- unsigned int height = avctx->height; // Real image height
- unsigned int dlen, p, row;
- const unsigned char *lp, *dp;
- unsigned char count;
- unsigned int px_inc;
- unsigned int planes = c->planes;
- unsigned char *planemap = c->planemap;
-
- if(c->pic.data[0])
- avctx->release_buffer(avctx, &c->pic);
-
- c->pic.reference = 0;
- c->pic.buffer_hints = FF_BUFFER_HINTS_VALID;
- if(avctx->get_buffer(avctx, &c->pic) < 0){
- av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
- return -1;
- }
-
- /* Set data pointer after line lengths */
- dp = encoded + planes * (height << 1);
-
- /* Ignore alpha plane, don't know what to do with it */
- if (planes == 4)
- planes--;
-
- px_inc = planes + (avctx->pix_fmt == PIX_FMT_RGB32);
-
- for (p = 0; p < planes; p++) {
- /* Lines length pointer for this plane */
- lp = encoded + p * (height << 1);
-
- /* Decode a plane */
- for(row = 0; row < height; row++) {
- pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p];
- pixptr_end = pixptr + c->pic.linesize[0];
- dlen = av_be2ne16(*(const unsigned short *)(lp+row*2));
- /* Decode a row of this plane */
- while(dlen > 0) {
- if(dp + 1 >= buf+buf_size) return -1;
- if ((count = *dp++) <= 127) {
- count++;
- dlen -= count + 1;
- if (pixptr + count * px_inc > pixptr_end)
- break;
- if(dp + count > buf+buf_size) return -1;
- while(count--) {
- *pixptr = *dp++;
- pixptr += px_inc;
- }
- } else {
- count = 257 - count;
- if (pixptr + count * px_inc > pixptr_end)
- break;
- while(count--) {
- *pixptr = *dp;
- pixptr += px_inc;
- }
- dp++;
- dlen -= 2;
- }
- }
+ AVFrame *frame = data;
+ const uint8_t *buf = avpkt->data;
+ int buf_size = avpkt->size;
+ EightBpsContext * const c = avctx->priv_data;
+ const unsigned char *encoded = buf;
+ unsigned char *pixptr, *pixptr_end;
+ unsigned int height = avctx->height; // Real image height
+ unsigned int dlen, p, row;
+ const unsigned char *lp, *dp, *ep;
+ unsigned char count;
+ unsigned int px_inc;
+ unsigned int planes = c->planes;
+ unsigned char *planemap = c->planemap;
+ int ret;
+
+ if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
+ av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+ return ret;
+ }
+
+ ep = encoded + buf_size;
+
+ /* Set data pointer after line lengths */
+ dp = encoded + planes * (height << 1);
+
+ /* Ignore alpha plane, don't know what to do with it */
+ if (planes == 4)
+ planes--;
+
+ px_inc = planes + (avctx->pix_fmt == AV_PIX_FMT_RGB32);
+
+ for (p = 0; p < planes; p++) {
+ /* Lines length pointer for this plane */
+ lp = encoded + p * (height << 1);
+
+ /* Decode a plane */
+ for (row = 0; row < height; row++) {
+ pixptr = frame->data[0] + row * frame->linesize[0] + planemap[p];
+ pixptr_end = pixptr + frame->linesize[0];
+ if (ep - lp < row * 2 + 2)
+ return AVERROR_INVALIDDATA;
+ dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2));
+ /* Decode a row of this plane */
+ while (dlen > 0) {
+ if (ep - dp <= 1)
+ return AVERROR_INVALIDDATA;
+ if ((count = *dp++) <= 127) {
+ count++;
+ dlen -= count + 1;
+ if (pixptr_end - pixptr < count * px_inc)
+ break;
+ if (ep - dp < count)
+ return AVERROR_INVALIDDATA;
+ while (count--) {
+ *pixptr = *dp++;
+ pixptr += px_inc;
+ }
+ } else {
+ count = 257 - count;
+ if (pixptr_end - pixptr < count * px_inc)
+ break;
+ while (count--) {
+ *pixptr = *dp;
+ pixptr += px_inc;
+ }
+ dp++;
+ dlen -= 2;