- dp = &s->frame.data[0][frame_y * s->frame.linesize[0] + frame_x];
- pp = &s->prev_frame.data[0][frame_y * s->prev_frame.linesize[0] + frame_x];
- switch (meth) {
- case 1:
- for (i = 0; i < frame_height; i++) {
- ofs = 0;
- do {
- if (pb_size < 1)
- return;
- len = *pb++;
- pb_size--;
- if (len & 0x80) {
- len = (len & 0x7F) + 1;
- if (ofs + len > frame_width || pb_size < len)
- return;
- memcpy(&dp[ofs], pb, len);
- pb += len;
- pb_size -= len;
- ofs += len;
- } else {
- /* interframe pixel copy */
- if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
- return;
- memcpy(&dp[ofs], &pp[ofs], len + 1);
- ofs += len + 1;
- }
- } while (ofs < frame_width);
- if (ofs > frame_width) {
- av_log(s->avctx, AV_LOG_ERROR, "VMD video: offset > width (%d > %d)\n",
- ofs, frame_width);
- break;
+ dp = &frame->data[0][frame_y * frame->linesize[0] + frame_x];
+ pp = &s->prev_frame->data[0][frame_y * s->prev_frame->linesize[0] + frame_x];
+ switch (meth) {
+ case 1:
+ for (i = 0; i < frame_height; i++) {
+ ofs = 0;
+ do {
+ len = bytestream2_get_byte(&gb);
+ if (len & 0x80) {
+ len = (len & 0x7F) + 1;
+ if (ofs + len > frame_width ||
+ bytestream2_get_bytes_left(&gb) < len)
+ return AVERROR_INVALIDDATA;
+ bytestream2_get_buffer(&gb, &dp[ofs], len);
+ ofs += len;
+ } else {
+ /* interframe pixel copy */
+ if (ofs + len + 1 > frame_width || !s->prev_frame->data[0])
+ return AVERROR_INVALIDDATA;
+ memcpy(&dp[ofs], &pp[ofs], len + 1);
+ ofs += len + 1;