size_t running_size = 0;
for (i = 0; i < ctx->chunk_count; i++) {
ctx->chunks[i].compressed_offset = running_size;
+ if (ctx->chunks[i].compressed_size > UINT32_MAX - running_size)
+ return AVERROR_INVALIDDATA;
running_size += ctx->chunks[i].compressed_size;
}
}
HapChunk *chunk = &ctx->chunks[i];
/* Check the compressed buffer is valid */
- if (chunk->compressed_offset + chunk->compressed_size > bytestream2_get_bytes_left(gbc))
+ if (chunk->compressed_offset + (uint64_t)chunk->compressed_size > bytestream2_get_bytes_left(gbc))
return AVERROR_INVALIDDATA;
/* Chunks are unpacked sequentially, ctx->tex_size is the uncompressed
HapContext *ctx = avctx->priv_data;
ThreadFrame tframe;
int ret, i, t;
- int tex_size;
int section_size;
enum HapSectionType section_type;
int start_texture_section = 0;
if (ret < 0)
return ret;
+ if (ctx->tex_size != (avctx->coded_width / TEXTURE_BLOCK_W)
+ *(avctx->coded_height / TEXTURE_BLOCK_H)
+ *tex_rat[t]) {
+ av_log(avctx, AV_LOG_ERROR, "uncompressed size mismatches\n");
+ return AVERROR_INVALIDDATA;
+ }
+
start_texture_section += ctx->texture_section_size + 4;
if (avctx->codec->update_thread_context)
/* Unpack the DXT texture */
if (hap_can_use_tex_in_place(ctx)) {
+ int tex_size;
/* Only DXTC texture compression in a contiguous block */
ctx->tex_data = ctx->gbc.buffer;
tex_size = FFMIN(ctx->texture_section_size, bytestream2_get_bytes_left(&ctx->gbc));
+ if (tex_size < (avctx->coded_width / TEXTURE_BLOCK_W)
+ *(avctx->coded_height / TEXTURE_BLOCK_H)
+ *tex_rat[t]) {
+ av_log(avctx, AV_LOG_ERROR, "Insufficient data\n");
+ return AVERROR_INVALIDDATA;
+ }
} else {
/* Perform the second-stage decompression */
ret = av_reallocp(&ctx->tex_buf, ctx->tex_size);
}
ctx->tex_data = ctx->tex_buf;
- tex_size = ctx->tex_size;
- }
-
- if (tex_size < (avctx->coded_width / TEXTURE_BLOCK_W)
- *(avctx->coded_height / TEXTURE_BLOCK_H)
- *tex_rat[t]) {
- av_log(avctx, AV_LOG_ERROR, "Insufficient data\n");
- return AVERROR_INVALIDDATA;
}
/* Use the decompress function on the texture, one block per thread */
return 0;
}
-AVCodec ff_hap_decoder = {
+const AVCodec ff_hap_decoder = {
.name = "hap",
.long_name = NULL_IF_CONFIG_SMALL("Vidvox Hap"),
.type = AVMEDIA_TYPE_VIDEO,
AV_CODEC_CAP_DR1,
.caps_internal = FF_CODEC_CAP_INIT_THREADSAFE |
FF_CODEC_CAP_INIT_CLEANUP,
+ .codec_tags = (const uint32_t []){
+ MKTAG('H','a','p','1'),
+ MKTAG('H','a','p','5'),
+ MKTAG('H','a','p','Y'),
+ MKTAG('H','a','p','A'),
+ MKTAG('H','a','p','M'),
+ FF_CODEC_TAGS_END,
+ },
};