Merge commit '59e8ec0aa8ab174701d01a3bfe96fedd0b7fcead'

[ffmpeg] / libavcodec / dds.c

diff --git a/libavcodec/dds.c b/libavcodec/dds.c
index a604d5690f92997eb4219f20299daaddba2cb9f2..d473fd14cfd946eef6f1212468376b9136aad0d5 100644 (file)
--- a/libavcodec/dds.c
+++ b/libavcodec/dds.c
@@ -141,6 +141,12 @@ static int parse_pixel_format(AVCodecContext *avctx)
     normal_map      = flags & DDPF_NORMALMAP;
     fourcc = bytestream2_get_le32(gbc);
 
+    if (ctx->compressed && ctx->paletted) {
+        av_log(avctx, AV_LOG_WARNING,
+               "Disabling invalid palette flag for compressed dds.\n");
+        ctx->paletted = 0;
+    }
+
     bpp = bytestream2_get_le32(gbc); // rgbbitcount
     r   = bytestream2_get_le32(gbc); // rbitmask
     g   = bytestream2_get_le32(gbc); // gbitmask
@@ -599,14 +605,14 @@ static int dds_decode(AVCodecContext *avctx, void *data,
     bytestream2_init(gbc, avpkt->data, avpkt->size);
 
     if (bytestream2_get_bytes_left(gbc) < 128) {
-        av_log(avctx, AV_LOG_ERROR, "Frame is too small (%d).",
+        av_log(avctx, AV_LOG_ERROR, "Frame is too small (%d).\n",
                bytestream2_get_bytes_left(gbc));
         return AVERROR_INVALIDDATA;
     }
 
     if (bytestream2_get_le32(gbc) != MKTAG('D', 'D', 'S', ' ') ||
         bytestream2_get_le32(gbc) != 124) { // header size
-        av_log(avctx, AV_LOG_ERROR, "Invalid DDS header.");
+        av_log(avctx, AV_LOG_ERROR, "Invalid DDS header.\n");
         return AVERROR_INVALIDDATA;
     }
 
@@ -642,9 +648,18 @@ static int dds_decode(AVCodecContext *avctx, void *data,
         return ret;
 
     if (ctx->compressed) {
+        int size = (avctx->coded_height / TEXTURE_BLOCK_H) *
+                   (avctx->coded_width / TEXTURE_BLOCK_W) * ctx->tex_ratio;
         ctx->slice_count = av_clip(avctx->thread_count, 1,
                                    avctx->coded_height / TEXTURE_BLOCK_H);
 
+        if (bytestream2_get_bytes_left(gbc) < size) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Compressed Buffer is too small (%d < %d).\n",
+                   bytestream2_get_bytes_left(gbc), size);
+            return AVERROR_INVALIDDATA;
+        }
+
         /* Use the decompress function on the texture, one block per thread. */
         ctx->tex_data = gbc->buffer;
         avctx->execute2(avctx, decompress_texture_thread, frame, NULL, ctx->slice_count);
@@ -666,6 +681,12 @@ static int dds_decode(AVCodecContext *avctx, void *data,
             frame->palette_has_changed = 1;
         }
 
+        if (bytestream2_get_bytes_left(gbc) < frame->height * linesize) {
+            av_log(avctx, AV_LOG_ERROR, "Buffer is too small (%d < %d).\n",
+                   bytestream2_get_bytes_left(gbc), frame->height * linesize);
+            return AVERROR_INVALIDDATA;
+        }
+
         av_image_copy_plane(frame->data[0], frame->linesize[0],
                             gbc->buffer, linesize,
                             linesize, frame->height);