dv: Initialize encoder tables during encoder init.

[ffmpeg] / libavcodec / indeo3.c

diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
index 2c7e96b738b1eab7f8652151a8e2a2e8a57f5399..ed3535adc7b0141f180d3a0f9df8af40ea0bf47c 100644 (file)
--- a/libavcodec/indeo3.c
+++ b/libavcodec/indeo3.c
@@ -89,6 +89,7 @@ typedef struct Indeo3DecodeContext {
     const uint8_t   *next_cell_data;
     const uint8_t   *last_byte;
     const int8_t    *mc_vectors;
+    unsigned        num_vectors;    ///< number of motion vectors in mc_vectors
 
     int16_t         width, height;
     uint32_t        frame_num;      ///< current frame number (zero-based)
@@ -723,6 +724,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
         SPLIT_CELL(ref_cell->height, curr_cell.height);
         ref_cell->ypos   += curr_cell.height;
         ref_cell->height -= curr_cell.height;
+        if (ref_cell->height <= 0 || curr_cell.height <= 0)
+            return AVERROR_INVALIDDATA;
     } else if (code == V_SPLIT) {
         if (curr_cell.width > strip_width) {
             /* split strip */
@@ -731,6 +734,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
             SPLIT_CELL(ref_cell->width, curr_cell.width);
         ref_cell->xpos  += curr_cell.width;
         ref_cell->width -= curr_cell.width;
+        if (ref_cell->width <= 0 || curr_cell.width <= 0)
+            return AVERROR_INVALIDDATA;
     }
 
     while (1) { /* loop until return */
@@ -756,16 +761,24 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
                     av_log(avctx, AV_LOG_ERROR, "SkipCell procedure not implemented yet!\n");
 
                 CHECK_CELL
+                if (!curr_cell.mv_ptr)
+                    return AVERROR_INVALIDDATA;
                 copy_cell(ctx, plane, &curr_cell);
                 return 0;
             }
             break;
         case INTER_DATA:
             if (!curr_cell.tree) { /* MC tree INTER code */
+                unsigned mv_idx;
                 /* get motion vector index and setup the pointer to the mv set */
                 if (!ctx->need_resync)
                     ctx->next_cell_data = &ctx->gb.buffer[(get_bits_count(&ctx->gb) + 7) >> 3];
-                curr_cell.mv_ptr = &ctx->mc_vectors[*(ctx->next_cell_data++) << 1];
+                mv_idx = *(ctx->next_cell_data++) << 1;
+                if (mv_idx >= ctx->num_vectors) {
+                    av_log(avctx, AV_LOG_ERROR, "motion vector index out of range\n");
+                    return AVERROR_INVALIDDATA;
+                }
+                curr_cell.mv_ptr = &ctx->mc_vectors[mv_idx];
                 curr_cell.tree   = 1; /* enter the VQ tree */
                 UPDATE_BITPOS(8);
             } else { /* VQ tree DATA code */
@@ -795,15 +808,24 @@ static int decode_plane(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
                         int32_t strip_width)
 {
     Cell            curr_cell;
-    int             num_vectors;
+    unsigned        num_vectors;
 
     /* each plane data starts with mc_vector_count field, */
     /* an optional array of motion vectors followed by the vq data */
     num_vectors = bytestream_get_le32(&data);
+    if (num_vectors > 256) {
+        av_log(ctx->avctx, AV_LOG_ERROR,
+               "Read invalid number of motion vectors %d\n", num_vectors);
+        return AVERROR_INVALIDDATA;
+    }
+    if (num_vectors * 2 >= data_size)
+        return AVERROR_INVALIDDATA;
+
+    ctx->num_vectors = num_vectors;
     ctx->mc_vectors  = num_vectors ? data : 0;
 
     /* init the bitreader */
-    init_get_bits(&ctx->gb, &data[num_vectors * 2], data_size << 3);
+    init_get_bits(&ctx->gb, &data[num_vectors * 2], (data_size - num_vectors * 2) << 3);
     ctx->skip_bits   = 0;
     ctx->need_resync = 0;
 
@@ -869,13 +891,16 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
         return AVERROR_INVALIDDATA;
 
     if (width != ctx->width || height != ctx->height) {
+        int res;
+
         av_dlog(avctx, "Frame dimensions changed!\n");
 
         ctx->width  = width;
         ctx->height = height;
 
         free_frame_buffers(ctx);
-        allocate_frame_buffers(ctx, avctx);
+        if ((res = allocate_frame_buffers(ctx, avctx)) < 0)
+             return res;
         avcodec_set_dimensions(avctx, width, height);
     }
 
@@ -972,7 +997,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
 
     build_requant_tab();
 
-    dsputil_init(&ctx->dsp, avctx);
+    ff_dsputil_init(&ctx->dsp, avctx);
 
     allocate_frame_buffers(ctx, avctx);