]> git.sesse.net Git - ffmpeg/blobdiff - libavcodec/gifdec.c
alsdec: check sample pointer range in revert_channel_correlation
[ffmpeg] / libavcodec / gifdec.c
index b1207ae19d115af343f05c23bde1cd4238436235..d91f159dc1640d00f0d508d11e8d129aae9c6ce7 100644 (file)
@@ -46,8 +46,7 @@ typedef struct GifState {
     int gce_delay;
 
     /* LZW compatible decoder */
-    const uint8_t *bytestream;
-    const uint8_t *bytestream_end;
+    GetByteContext gb;
     LZWState *lzw;
 
     /* aux buffers */
@@ -66,19 +65,19 @@ static int gif_read_image(GifState *s, AVFrame *frame)
     int is_interleaved, has_local_palette, y, pass, y1, linesize, n, i;
     uint8_t *ptr, *spal, *palette, *ptr1;
 
-    left = bytestream_get_le16(&s->bytestream);
-    top = bytestream_get_le16(&s->bytestream);
-    width = bytestream_get_le16(&s->bytestream);
-    height = bytestream_get_le16(&s->bytestream);
-    flags = bytestream_get_byte(&s->bytestream);
+    left   = bytestream2_get_le16(&s->gb);
+    top    = bytestream2_get_le16(&s->gb);
+    width  = bytestream2_get_le16(&s->gb);
+    height = bytestream2_get_le16(&s->gb);
+    flags  = bytestream2_get_byte(&s->gb);
     is_interleaved = flags & 0x40;
     has_local_palette = flags & 0x80;
     bits_per_pixel = (flags & 0x07) + 1;
 
-    av_dlog(s->avctx, "gif: image x=%d y=%d w=%d h=%d\n", left, top, width, height);
+    ff_dlog(s->avctx, "gif: image x=%d y=%d w=%d h=%d\n", left, top, width, height);
 
     if (has_local_palette) {
-        bytestream_get_buffer(&s->bytestream, s->local_palette, 3 * (1 << bits_per_pixel));
+        bytestream2_get_buffer(&s->gb, s->local_palette, 3 * (1 << bits_per_pixel));
         palette = s->local_palette;
     } else {
         palette = s->global_palette;
@@ -107,9 +106,9 @@ static int gif_read_image(GifState *s, AVFrame *frame)
         s->image_palette[s->transparent_color_index] = 0;
 
     /* now get the image data */
-    code_size = bytestream_get_byte(&s->bytestream);
-    ff_lzw_decode_init(s->lzw, code_size, s->bytestream,
-                       s->bytestream_end - s->bytestream, FF_LZW_GIF);
+    code_size = bytestream2_get_byte(&s->gb);
+    ff_lzw_decode_init(s->lzw, code_size, s->gb.buffer,
+                       bytestream2_get_bytes_left(&s->gb), FF_LZW_GIF);
 
     /* read all the image */
     linesize = frame->linesize[0];
@@ -126,33 +125,29 @@ static int gif_read_image(GifState *s, AVFrame *frame)
             case 1:
                 y1 += 8;
                 ptr += linesize * 8;
-                if (y1 >= height) {
-                    y1 = pass ? 2 : 4;
-                    ptr = ptr1 + linesize * y1;
-                    pass++;
-                }
                 break;
             case 2:
                 y1 += 4;
                 ptr += linesize * 4;
-                if (y1 >= height) {
-                    y1 = 1;
-                    ptr = ptr1 + linesize;
-                    pass++;
-                }
                 break;
             case 3:
                 y1 += 2;
                 ptr += linesize * 2;
                 break;
             }
+            while (y1 >= height) {
+                y1  = 4 >> pass;
+                ptr = ptr1 + linesize * y1;
+                pass++;
+            }
         } else {
             ptr += linesize;
         }
     }
     /* read the garbage data until end marker is found */
     ff_lzw_decode_tail(s->lzw);
-    s->bytestream = ff_lzw_cur_ptr(s->lzw);
+
+    bytestream2_skip(&s->gb, ff_lzw_size_read(s->lzw));
     return 0;
 }
 
@@ -161,30 +156,30 @@ static int gif_read_extension(GifState *s)
     int ext_code, ext_len, i, gce_flags, gce_transparent_index;
 
     /* extension */
-    ext_code = bytestream_get_byte(&s->bytestream);
-    ext_len = bytestream_get_byte(&s->bytestream);
+    ext_code = bytestream2_get_byte(&s->gb);
+    ext_len  = bytestream2_get_byte(&s->gb);
 
-    av_dlog(s->avctx, "gif: ext_code=0x%x len=%d\n", ext_code, ext_len);
+    ff_dlog(s->avctx, "gif: ext_code=0x%x len=%d\n", ext_code, ext_len);
 
     switch(ext_code) {
     case 0xf9:
         if (ext_len != 4)
             goto discard_ext;
         s->transparent_color_index = -1;
-        gce_flags = bytestream_get_byte(&s->bytestream);
-        s->gce_delay = bytestream_get_le16(&s->bytestream);
-        gce_transparent_index = bytestream_get_byte(&s->bytestream);
+        gce_flags    = bytestream2_get_byte(&s->gb);
+        s->gce_delay = bytestream2_get_le16(&s->gb);
+        gce_transparent_index = bytestream2_get_byte(&s->gb);
         if (gce_flags & 0x01)
             s->transparent_color_index = gce_transparent_index;
         else
             s->transparent_color_index = -1;
         s->gce_disposal = (gce_flags >> 2) & 0x7;
 
-        av_dlog(s->avctx, "gif: gce_flags=%x delay=%d tcolor=%d disposal=%d\n",
+        ff_dlog(s->avctx, "gif: gce_flags=%x delay=%d tcolor=%d disposal=%d\n",
                gce_flags, s->gce_delay,
                s->transparent_color_index, s->gce_disposal);
 
-        ext_len = bytestream_get_byte(&s->bytestream);
+        ext_len = bytestream2_get_byte(&s->gb);
         break;
     }
 
@@ -192,10 +187,10 @@ static int gif_read_extension(GifState *s)
  discard_ext:
     while (ext_len != 0) {
         for (i = 0; i < ext_len; i++)
-            bytestream_get_byte(&s->bytestream);
-        ext_len = bytestream_get_byte(&s->bytestream);
+            bytestream2_get_byte(&s->gb);
+        ext_len = bytestream2_get_byte(&s->gb);
 
-        av_dlog(s->avctx, "gif: ext_len1=%d\n", ext_len);
+        ff_dlog(s->avctx, "gif: ext_len1=%d\n", ext_len);
     }
     return 0;
 }
@@ -206,52 +201,52 @@ static int gif_read_header1(GifState *s)
     int v, n;
     int has_global_palette;
 
-    if (s->bytestream_end < s->bytestream + 13)
+    if (bytestream2_get_bytes_left(&s->gb) < 13)
         return AVERROR_INVALIDDATA;
 
     /* read gif signature */
-    bytestream_get_buffer(&s->bytestream, sig, 6);
+    bytestream2_get_buffer(&s->gb, sig, 6);
     if (memcmp(sig, gif87a_sig, 6) != 0 &&
         memcmp(sig, gif89a_sig, 6) != 0)
         return AVERROR_INVALIDDATA;
 
     /* read screen header */
     s->transparent_color_index = -1;
-    s->screen_width = bytestream_get_le16(&s->bytestream);
-    s->screen_height = bytestream_get_le16(&s->bytestream);
+    s->screen_width  = bytestream2_get_le16(&s->gb);
+    s->screen_height = bytestream2_get_le16(&s->gb);
     if(   (unsigned)s->screen_width  > 32767
        || (unsigned)s->screen_height > 32767){
         av_log(NULL, AV_LOG_ERROR, "picture size too large\n");
         return AVERROR_INVALIDDATA;
     }
 
-    v = bytestream_get_byte(&s->bytestream);
+    v = bytestream2_get_byte(&s->gb);
     s->color_resolution = ((v & 0x70) >> 4) + 1;
     has_global_palette = (v & 0x80);
     s->bits_per_pixel = (v & 0x07) + 1;
-    s->background_color_index = bytestream_get_byte(&s->bytestream);
-    bytestream_get_byte(&s->bytestream);                /* ignored */
+    s->background_color_index = bytestream2_get_byte(&s->gb);
+    bytestream2_get_byte(&s->gb);                /* ignored */
 
-    av_dlog(s->avctx, "gif: screen_w=%d screen_h=%d bpp=%d global_palette=%d\n",
+    ff_dlog(s->avctx, "gif: screen_w=%d screen_h=%d bpp=%d global_palette=%d\n",
            s->screen_width, s->screen_height, s->bits_per_pixel,
            has_global_palette);
 
     if (has_global_palette) {
         n = 1 << s->bits_per_pixel;
-        if (s->bytestream_end < s->bytestream + n * 3)
+        if (bytestream2_get_bytes_left(&s->gb) < n * 3)
             return AVERROR_INVALIDDATA;
-        bytestream_get_buffer(&s->bytestream, s->global_palette, n * 3);
+        bytestream2_get_buffer(&s->gb, s->global_palette, n * 3);
     }
     return 0;
 }
 
 static int gif_parse_next_image(GifState *s, AVFrame *frame)
 {
-    while (s->bytestream < s->bytestream_end) {
-        int code = bytestream_get_byte(&s->bytestream);
+    while (bytestream2_get_bytes_left(&s->gb) > 0) {
+        int code = bytestream2_get_byte(&s->gb);
         int ret;
 
-        av_dlog(s->avctx, "gif: code=%02x '%c'\n", code, code);
+        ff_dlog(s->avctx, "gif: code=%02x '%c'\n", code, code);
 
         switch (code) {
         case ',':
@@ -289,8 +284,7 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     AVFrame *picture = data;
     int ret;
 
-    s->bytestream = buf;
-    s->bytestream_end = buf + buf_size;
+    bytestream2_init(&s->gb, buf, buf_size);
     if ((ret = gif_read_header1(s)) < 0)
         return ret;
 
@@ -309,7 +303,7 @@ static int gif_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
         return ret;
 
     *got_frame = 1;
-    return s->bytestream - buf;
+    return bytestream2_tell(&s->gb);
 }
 
 static av_cold int gif_decode_close(AVCodecContext *avctx)