avcodec/takdec: Fix overflow with large sample rates

[ffmpeg] / libavcodec / interplayvideo.c

diff --git a/libavcodec/interplayvideo.c b/libavcodec/interplayvideo.c
index deaa09cba60ff4e9319bb121c794b1ab8717be20..b0a4953cb01740bb5083fe5bf63d46cf6db9fe86 100644 (file)
--- a/libavcodec/interplayvideo.c
+++ b/libavcodec/interplayvideo.c
@@ -1181,14 +1181,6 @@ static av_cold int ipvideo_decode_init(AVCodecContext *avctx)
     s->cur_decode_frame->format  = avctx->pix_fmt;
     s->prev_decode_frame->format = avctx->pix_fmt;
 
-    ret = ff_get_buffer(avctx, s->cur_decode_frame, 0);
-    if (ret < 0)
-        goto error;
-
-    ret = ff_get_buffer(avctx, s->prev_decode_frame, 0);
-    if (ret < 0)
-        goto error;
-
     return 0;
 error:
     av_frame_free(&s->last_frame);
@@ -1239,83 +1231,83 @@ static int ipvideo_decode_frame(AVCodecContext *avctx,
     s->decoding_map_size = AV_RL16(buf + 4);
     s->skip_map_size     = AV_RL16(buf + 6);
 
-    switch(frame_format) {
-        case 0x06:
-            if (s->decoding_map_size) {
-                av_log(avctx, AV_LOG_ERROR, "Decoding map for format 0x06\n");
-                return AVERROR_INVALIDDATA;
-            }
+    switch (frame_format) {
+    case 0x06:
+        if (s->decoding_map_size) {
+            av_log(avctx, AV_LOG_ERROR, "Decoding map for format 0x06\n");
+            return AVERROR_INVALIDDATA;
+        }
 
-            if (s->skip_map_size) {
-                av_log(avctx, AV_LOG_ERROR, "Skip map for format 0x06\n");
-                return AVERROR_INVALIDDATA;
-            }
+        if (s->skip_map_size) {
+            av_log(avctx, AV_LOG_ERROR, "Skip map for format 0x06\n");
+            return AVERROR_INVALIDDATA;
+        }
 
-            if (s->is_16bpp) {
-                av_log(avctx, AV_LOG_ERROR, "Video format 0x06 does not support 16bpp movies\n");
-                return AVERROR_INVALIDDATA;
-            }
+        if (s->is_16bpp) {
+            av_log(avctx, AV_LOG_ERROR, "Video format 0x06 does not support 16bpp movies\n");
+            return AVERROR_INVALIDDATA;
+        }
 
-            /* Decoding map for 0x06 frame format is at the top of pixeldata */
-            s->decoding_map_size = ((s->avctx->width / 8) * (s->avctx->height / 8)) * 2;
-            s->decoding_map = buf + 8 + 14; /* 14 bits of op data */
-            video_data_size -= s->decoding_map_size + 14;
-            if (video_data_size <= 0)
-                return AVERROR_INVALIDDATA;
+        /* Decoding map for 0x06 frame format is at the top of pixeldata */
+        s->decoding_map_size = ((s->avctx->width / 8) * (s->avctx->height / 8)) * 2;
+        s->decoding_map = buf + 8 + 14; /* 14 bits of op data */
+        video_data_size -= s->decoding_map_size + 14;
+        if (video_data_size <= 0 || s->decoding_map_size == 0)
+            return AVERROR_INVALIDDATA;
 
-            if (buf_size < 8 + s->decoding_map_size + 14 + video_data_size)
-                return AVERROR_INVALIDDATA;
+        if (buf_size < 8 + s->decoding_map_size + 14 + video_data_size)
+            return AVERROR_INVALIDDATA;
 
-            bytestream2_init(&s->stream_ptr, buf + 8 + s->decoding_map_size + 14, video_data_size);
+        bytestream2_init(&s->stream_ptr, buf + 8 + s->decoding_map_size + 14, video_data_size);
 
-            break;
+        break;
 
-        case 0x10:
-            if (! s->decoding_map_size) {
-                av_log(avctx, AV_LOG_ERROR, "Empty decoding map for format 0x10\n");
-                return AVERROR_INVALIDDATA;
-            }
+    case 0x10:
+        if (! s->decoding_map_size) {
+            av_log(avctx, AV_LOG_ERROR, "Empty decoding map for format 0x10\n");
+            return AVERROR_INVALIDDATA;
+        }
 
-            if (! s->skip_map_size) {
-                av_log(avctx, AV_LOG_ERROR, "Empty skip map for format 0x10\n");
-                return AVERROR_INVALIDDATA;
-            }
+        if (! s->skip_map_size) {
+            av_log(avctx, AV_LOG_ERROR, "Empty skip map for format 0x10\n");
+            return AVERROR_INVALIDDATA;
+        }
 
-            if (s->is_16bpp) {
-                av_log(avctx, AV_LOG_ERROR, "Video format 0x10 does not support 16bpp movies\n");
-                return AVERROR_INVALIDDATA;
-            }
+        if (s->is_16bpp) {
+            av_log(avctx, AV_LOG_ERROR, "Video format 0x10 does not support 16bpp movies\n");
+            return AVERROR_INVALIDDATA;
+        }
 
-            if (buf_size < 8 + video_data_size + s->decoding_map_size + s->skip_map_size)
-                return AVERROR_INVALIDDATA;
+        if (buf_size < 8 + video_data_size + s->decoding_map_size + s->skip_map_size)
+            return AVERROR_INVALIDDATA;
 
-            bytestream2_init(&s->stream_ptr, buf + 8, video_data_size);
-            s->decoding_map = buf + 8 + video_data_size;
-            s->skip_map = buf + 8 + video_data_size + s->decoding_map_size;
+        bytestream2_init(&s->stream_ptr, buf + 8, video_data_size);
+        s->decoding_map = buf + 8 + video_data_size;
+        s->skip_map = buf + 8 + video_data_size + s->decoding_map_size;
 
-            break;
+        break;
 
-        case 0x11:
-            if (! s->decoding_map_size) {
-                av_log(avctx, AV_LOG_ERROR, "Empty decoding map for format 0x11\n");
-                return AVERROR_INVALIDDATA;
-            }
+    case 0x11:
+        if (! s->decoding_map_size) {
+            av_log(avctx, AV_LOG_ERROR, "Empty decoding map for format 0x11\n");
+            return AVERROR_INVALIDDATA;
+        }
 
-            if (s->skip_map_size) {
-                av_log(avctx, AV_LOG_ERROR, "Skip map for format 0x11\n");
-                return AVERROR_INVALIDDATA;
-            }
+        if (s->skip_map_size) {
+            av_log(avctx, AV_LOG_ERROR, "Skip map for format 0x11\n");
+            return AVERROR_INVALIDDATA;
+        }
 
-            if (buf_size < 8 + video_data_size + s->decoding_map_size)
-                return AVERROR_INVALIDDATA;
+        if (buf_size < 8 + video_data_size + s->decoding_map_size)
+            return AVERROR_INVALIDDATA;
 
-            bytestream2_init(&s->stream_ptr, buf + 8, video_data_size);
-            s->decoding_map = buf + 8 + video_data_size;
+        bytestream2_init(&s->stream_ptr, buf + 8, video_data_size);
+        s->decoding_map = buf + 8 + video_data_size;
 
-            break;
+        break;
 
-        default:
-            av_log(avctx, AV_LOG_ERROR, "Frame type 0x%02X unsupported\n", frame_format);
+    default:
+        av_log(avctx, AV_LOG_ERROR, "Frame type 0x%02X unsupported\n", frame_format);
     }
 
     /* ensure we can't overread the packet */
@@ -1338,16 +1330,16 @@ static int ipvideo_decode_frame(AVCodecContext *avctx,
         }
     }
 
-    switch(frame_format) {
-        case 0x06:
-            ipvideo_decode_format_06_opcodes(s, frame);
-            break;
-        case 0x10:
-            ipvideo_decode_format_10_opcodes(s, frame);
-            break;
-        case 0x11:
-            ipvideo_decode_format_11_opcodes(s, frame);
-            break;
+    switch (frame_format) {
+    case 0x06:
+        ipvideo_decode_format_06_opcodes(s, frame);
+        break;
+    case 0x10:
+        ipvideo_decode_format_10_opcodes(s, frame);
+        break;
+    case 0x11:
+        ipvideo_decode_format_11_opcodes(s, frame);
+        break;
     }
 
     *got_frame = send_buffer;