unsigned char *dst_end = dst + dst_size;
const unsigned char *src_end = src + src_size;
- memcpy(huff_code_table, src, 15); src += 15; src_size -= 15;
+ memcpy(huff_code_table, src, 15); src += 15;
while (src < src_end) {
huff_code = *src++;
return dst_cur - dst;
}
-static void cin_decode_lzss(const unsigned char *src, int src_size, unsigned char *dst, int dst_size)
+static int cin_decode_lzss(const unsigned char *src, int src_size, unsigned char *dst, int dst_size)
{
uint16_t cmd;
int i, sz, offset, code;
- unsigned char *dst_end = dst + dst_size;
+ unsigned char *dst_end = dst + dst_size, *dst_start = dst;
const unsigned char *src_end = src + src_size;
while (src < src_end && dst < dst_end) {
} else {
cmd = AV_RL16(src); src += 2;
offset = cmd >> 4;
+ if ((int) (dst - dst_start) < offset + 1)
+ return AVERROR_INVALIDDATA;
sz = (cmd & 0xF) + 2;
/* don't use memcpy/memmove here as the decoding routine (ab)uses */
/* buffer overlappings to repeat bytes in the destination */
}
}
}
+
+ return 0;
}
static void cin_decode_rle(const unsigned char *src, int src_size, unsigned char *dst, int dst_size)
const uint8_t *buf = avpkt->data;
int buf_size = avpkt->size;
CinVideoContext *cin = avctx->priv_data;
- int i, y, palette_type, palette_colors_count, bitmap_frame_type, bitmap_frame_size;
-
- cin->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
- if (avctx->reget_buffer(avctx, &cin->frame)) {
- av_log(cin->avctx, AV_LOG_ERROR, "delphinecinvideo: reget_buffer() failed to allocate a frame\n");
- return -1;
- }
+ int i, y, palette_type, palette_colors_count, bitmap_frame_type, bitmap_frame_size, res = 0;
palette_type = buf[0];
palette_colors_count = AV_RL16(buf+1);
bitmap_frame_size -= 4;
}
}
- memcpy(cin->frame.data[1], cin->palette, sizeof(cin->palette));
- cin->frame.palette_has_changed = 1;
/* note: the decoding routines below assumes that surface.width = surface.pitch */
switch (bitmap_frame_type) {
cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size);
break;
case 38:
- cin_decode_lzss(buf, bitmap_frame_size,
- cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size);
+ res = cin_decode_lzss(buf, bitmap_frame_size,
+ cin->bitmap_table[CIN_CUR_BMP],
+ cin->bitmap_size);
+ if (res < 0)
+ return res;
break;
case 39:
- cin_decode_lzss(buf, bitmap_frame_size,
- cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size);
+ res = cin_decode_lzss(buf, bitmap_frame_size,
+ cin->bitmap_table[CIN_CUR_BMP],
+ cin->bitmap_size);
+ if (res < 0)
+ return res;
cin_apply_delta_data(cin->bitmap_table[CIN_PRE_BMP],
cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size);
break;
}
+ cin->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
+ if (avctx->reget_buffer(avctx, &cin->frame)) {
+ av_log(cin->avctx, AV_LOG_ERROR, "delphinecinvideo: reget_buffer() failed to allocate a frame\n");
+ return -1;
+ }
+
+ memcpy(cin->frame.data[1], cin->palette, sizeof(cin->palette));
+ cin->frame.palette_has_changed = 1;
for (y = 0; y < cin->avctx->height; ++y)
memcpy(cin->frame.data[0] + (cin->avctx->height - 1 - y) * cin->frame.linesize[0],
cin->bitmap_table[CIN_CUR_BMP] + y * cin->avctx->width,
AVCodec ff_dsicinvideo_decoder = {
.name = "dsicinvideo",
.type = AVMEDIA_TYPE_VIDEO,
- .id = CODEC_ID_DSICINVIDEO,
+ .id = AV_CODEC_ID_DSICINVIDEO,
.priv_data_size = sizeof(CinVideoContext),
.init = cinvideo_decode_init,
.close = cinvideo_decode_end,
.decode = cinvideo_decode_frame,
.capabilities = CODEC_CAP_DR1,
- .long_name = NULL_IF_CONFIG_SMALL("Delphine Software International CIN video"),
+ .long_name = NULL_IF_CONFIG_SMALL("Delphine Software International CIN video"),
};
AVCodec ff_dsicinaudio_decoder = {
.name = "dsicinaudio",
.type = AVMEDIA_TYPE_AUDIO,
- .id = CODEC_ID_DSICINAUDIO,
+ .id = AV_CODEC_ID_DSICINAUDIO,
.priv_data_size = sizeof(CinAudioContext),
.init = cinaudio_decode_init,
.decode = cinaudio_decode_frame,
.capabilities = CODEC_CAP_DR1,
- .long_name = NULL_IF_CONFIG_SMALL("Delphine Software International CIN audio"),
+ .long_name = NULL_IF_CONFIG_SMALL("Delphine Software International CIN audio"),
};