doc/APIchanges: add hashes and version numbers for recent entries

[ffmpeg] / libavcodec / cdtoons.c

diff --git a/libavcodec/cdtoons.c b/libavcodec/cdtoons.c
index dc4fa6bf0bafcb731e5efc7e1342c8132215f4ec..14c15c4579cb156d148d28518c39a072675c91af 100644 (file)
--- a/libavcodec/cdtoons.c
+++ b/libavcodec/cdtoons.c
@@ -61,7 +61,7 @@ static int cdtoons_render_sprite(AVCodecContext *avctx, const uint8_t *data,
 {
     CDToonsContext *c = avctx->priv_data;
     const uint8_t *next_line = data;
-    const uint8_t *end = data + data_size;;
+    const uint8_t *end = data + data_size;
     uint16_t line_size;
     uint8_t *dest;
     int skip = 0, to_skip, x;
@@ -190,6 +190,9 @@ static int cdtoons_decode_frame(AVCodecContext *avctx, void *data,
     palette_set        = bytestream_get_byte(&buf);
     buf               += 5;
 
+    if (sprite_offset > buf_size)
+        return AVERROR_INVALIDDATA;
+
     /* read new sprites introduced in this frame */
     buf = avpkt->data + sprite_offset;
     while (sprite_count--) {
@@ -269,7 +272,7 @@ static int cdtoons_decode_frame(AVCodecContext *avctx, void *data,
                 diff_size  = bytestream_get_be32(&buf);
                 width      = bytestream_get_be16(&buf);
                 height     = bytestream_get_be16(&buf);
-                if (diff_size < 4 || diff_size - 4 > eod - buf) {
+                if (diff_size < 8 || diff_size - 4 > eod - buf) {
                     av_log(avctx, AV_LOG_WARNING, "Ran (seriously) out of data for Diff frame data.\n");
                     return AVERROR_INVALIDDATA;
                 }
@@ -439,7 +442,7 @@ static av_cold int cdtoons_decode_end(AVCodecContext *avctx)
     return 0;
 }
 
-AVCodec ff_cdtoons_decoder = {
+const AVCodec ff_cdtoons_decoder = {
     .name           = "cdtoons",
     .long_name      = NULL_IF_CONFIG_SMALL("CDToons video"),
     .type           = AVMEDIA_TYPE_VIDEO,
@@ -450,4 +453,5 @@ AVCodec ff_cdtoons_decoder = {
     .decode         = cdtoons_decode_frame,
     .capabilities   = AV_CODEC_CAP_DR1,
     .flush          = cdtoons_flush,
+    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE,
 };