cbs_h2645: Avoid memcpy when splitting fragment

[ffmpeg] / libavcodec / bintext.c

diff --git a/libavcodec/bintext.c b/libavcodec/bintext.c
index 90bbe67b59b69efb83f1833745ff0c09c73796bf..d85f2c2dd443504d8d51f32ec36e59b5f622c4a0 100644 (file)
--- a/libavcodec/bintext.c
+++ b/libavcodec/bintext.c
@@ -35,6 +35,8 @@
 #include "bintext.h"
 #include "internal.h"
 
+#define FONT_WIDTH 8
+
 typedef struct XbinContext {
     AVFrame *frame;
     int palette[16];
@@ -91,10 +93,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
             break;
         }
     }
-
-    s->frame = av_frame_alloc();
-    if (!s->frame)
-        return AVERROR(ENOMEM);
+    if (avctx->width < FONT_WIDTH || avctx->height < s->font_height)
+        return AVERROR_INVALIDDATA;
 
     return 0;
 }
@@ -113,8 +113,6 @@ av_unused static void hscroll(AVCodecContext *avctx)
     }
 }
 
-#define FONT_WIDTH 8
-
 /**
  * Draw character to screen
  */
@@ -143,8 +141,12 @@ static int decode_frame(AVCodecContext *avctx,
     const uint8_t *buf_end = buf+buf_size;
     int ret;
 
+    if ((avctx->width / FONT_WIDTH) * (avctx->height / s->font_height) / 256 > buf_size)
+        return AVERROR_INVALIDDATA;
+
+    s->frame = data;
     s->x = s->y = 0;
-    if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
+    if ((ret = ff_get_buffer(avctx, s->frame, 0)) < 0)
         return ret;
     s->frame->pict_type           = AV_PICTURE_TYPE_I;
     s->frame->palette_has_changed = 1;
@@ -202,21 +204,10 @@ static int decode_frame(AVCodecContext *avctx,
         }
     }
 
-    if ((ret = av_frame_ref(data, s->frame)) < 0)
-        return ret;
     *got_frame      = 1;
     return buf_size;
 }
 
-static av_cold int decode_end(AVCodecContext *avctx)
-{
-    XbinContext *s = avctx->priv_data;
-
-    av_frame_free(&s->frame);
-
-    return 0;
-}
-
 #if CONFIG_BINTEXT_DECODER
 AVCodec ff_bintext_decoder = {
     .name           = "bintext",
@@ -225,7 +216,6 @@ AVCodec ff_bintext_decoder = {
     .id             = AV_CODEC_ID_BINTEXT,
     .priv_data_size = sizeof(XbinContext),
     .init           = decode_init,
-    .close          = decode_end,
     .decode         = decode_frame,
     .capabilities   = AV_CODEC_CAP_DR1,
 };
@@ -238,7 +228,6 @@ AVCodec ff_xbin_decoder = {
     .id             = AV_CODEC_ID_XBIN,
     .priv_data_size = sizeof(XbinContext),
     .init           = decode_init,
-    .close          = decode_end,
     .decode         = decode_frame,
     .capabilities   = AV_CODEC_CAP_DR1,
 };
@@ -251,7 +240,6 @@ AVCodec ff_idf_decoder = {
     .id             = AV_CODEC_ID_IDF,
     .priv_data_size = sizeof(XbinContext),
     .init           = decode_init,
-    .close          = decode_end,
     .decode         = decode_frame,
     .capabilities   = AV_CODEC_CAP_DR1,
 };