avcodec/jpeg2000dec: move bpno check to a earlier place

[ffmpeg] / libavcodec / 4xm.c

diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index dc0ad506d583c78cd2c83d4ce12b682c9936fb9e..3e0e6813317b6e20bf90150111559720688e136c 100644 (file)
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -344,61 +344,25 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src,
     uint16_t *start = (uint16_t *)f->last_picture->data[0];
     uint16_t *end   = start + stride * (f->avctx->height - h + 1) - (1 << log2w);
     int ret;
+    int scale   = 1;
+    unsigned dc = 0;
 
     av_assert0(code >= 0 && code <= 6 && log2w >= 0);
 
-    if (code == 0) {
-        if (bytestream2_get_bytes_left(&f->g) < 1) {
-            av_log(f->avctx, AV_LOG_ERROR, "bytestream overread\n");
-            return AVERROR_INVALIDDATA;
-        }
-        src += f->mv[bytestream2_get_byteu(&f->g)];
-        if (start > src || src > end) {
-            av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n");
-            return AVERROR_INVALIDDATA;
-        }
-        mcdc(dst, src, log2w, h, stride, 1, 0);
-    } else if (code == 1) {
+    if (code == 1) {
         log2h--;
         if ((ret = decode_p_block(f, dst, src, log2w, log2h, stride)) < 0)
             return ret;
-        if ((ret = decode_p_block(f, dst + (stride << log2h),
-                                  src + (stride << log2h),
-                                  log2w, log2h, stride)) < 0)
-            return ret;
+        return decode_p_block(f, dst + (stride << log2h),
+                              src + (stride << log2h),
+                              log2w, log2h, stride);
     } else if (code == 2) {
         log2w--;
         if ((ret = decode_p_block(f, dst , src, log2w, log2h, stride)) < 0)
             return ret;
-        if ((ret = decode_p_block(f, dst + (1 << log2w),
-                                  src + (1 << log2w),
-                                  log2w, log2h, stride)) < 0)
-            return ret;
-    } else if (code == 3 && f->version < 2) {
-        av_assert0(start <= src && src <= end);
-        mcdc(dst, src, log2w, h, stride, 1, 0);
-    } else if (code == 4) {
-        if (bytestream2_get_bytes_left(&f->g) < 1) {
-            av_log(f->avctx, AV_LOG_ERROR, "bytestream overread\n");
-            return AVERROR_INVALIDDATA;
-        }
-        src += f->mv[bytestream2_get_byteu(&f->g)];
-        if (start > src || src > end) {
-            av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n");
-            return AVERROR_INVALIDDATA;
-        }
-        if (bytestream2_get_bytes_left(&f->g2) < 2){
-            av_log(f->avctx, AV_LOG_ERROR, "wordstream overread\n");
-            return AVERROR_INVALIDDATA;
-        }
-        mcdc(dst, src, log2w, h, stride, 1, bytestream2_get_le16u(&f->g2));
-    } else if (code == 5) {
-        if (bytestream2_get_bytes_left(&f->g2) < 2) {
-            av_log(f->avctx, AV_LOG_ERROR, "wordstream overread\n");
-            return AVERROR_INVALIDDATA;
-        }
-        av_assert0(start <= src && src <= end);
-        mcdc(dst, src, log2w, h, stride, 0, bytestream2_get_le16u(&f->g2));
+        return decode_p_block(f, dst + (1 << log2w),
+                              src + (1 << log2w),
+                              log2w, log2h, stride);
     } else if (code == 6) {
         if (bytestream2_get_bytes_left(&f->g2) < 4) {
             av_log(f->avctx, AV_LOG_ERROR, "wordstream overread\n");
@@ -411,7 +375,42 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src,
             dst[0]      = bytestream2_get_le16u(&f->g2);
             dst[stride] = bytestream2_get_le16u(&f->g2);
         }
+        return 0;
+    }
+
+    if ((code&3)==0 && bytestream2_get_bytes_left(&f->g) < 1) {
+        av_log(f->avctx, AV_LOG_ERROR, "bytestream overread\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    if (code == 0) {
+        src  += f->mv[bytestream2_get_byte(&f->g)];
+    } else if (code == 3 && f->version >= 2) {
+        return 0;
+    } else if (code == 4) {
+        src  += f->mv[bytestream2_get_byte(&f->g)];
+        if (bytestream2_get_bytes_left(&f->g2) < 2){
+            av_log(f->avctx, AV_LOG_ERROR, "wordstream overread\n");
+            return AVERROR_INVALIDDATA;
+        }
+        dc    = bytestream2_get_le16(&f->g2);
+    } else if (code == 5) {
+        if (bytestream2_get_bytes_left(&f->g2) < 2){
+            av_log(f->avctx, AV_LOG_ERROR, "wordstream overread\n");
+            return AVERROR_INVALIDDATA;
+        }
+        av_assert0(start <= src && src <= end);
+        scale = 0;
+        dc    = bytestream2_get_le16(&f->g2);
     }
+
+    if (start > src || src > end) {
+        av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    mcdc(dst, src, log2w, h, stride, scale, dc);
+
     return 0;
 }
 
@@ -767,7 +766,10 @@ static int decode_i_frame(FourXContext *f, AVFrame *frame, const uint8_t *buf, i
     unsigned int prestream_size;
     const uint8_t *prestream;
 
-    if (bitstream_size > (1<<26) || length < bitstream_size + 12) {
+    if (bitstream_size > (1 << 26))
+        return AVERROR_INVALIDDATA;
+
+    if (length < bitstream_size + 12) {
         av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n");
         return AVERROR_INVALIDDATA;
     }
@@ -776,7 +778,6 @@ static int decode_i_frame(FourXContext *f, AVFrame *frame, const uint8_t *buf, i
     prestream      =             buf + bitstream_size + 12;
 
     if (prestream_size + bitstream_size + 12 != length
-        || bitstream_size > (1 << 26)
         || prestream_size > (1 << 26)) {
         av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d %d\n",
                prestream_size, bitstream_size, length);