Merge remote-tracking branch 'qatar/master'

[ffmpeg] / libavcodec / ivi_common.c

diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c
index 6b2ddc8cc7518368644f72d3765d56cc93f522f7..3f5e630762deec67ed42423dcb45086649d49ee1 100644 (file)
--- a/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@ -128,7 +128,7 @@ int ff_ivi_dec_huff_desc(GetBitContext *gb, int desc_coded, int which_tab,
                 new_huff.xbits[i] = get_bits(gb, 4);
 
             /* Have we got the same custom table? Rebuild if not. */
-            if (ff_ivi_huff_desc_cmp(&new_huff, &huff_tab->cust_desc)) {
+            if (ff_ivi_huff_desc_cmp(&new_huff, &huff_tab->cust_desc) || !huff_tab->cust_tab.table) {
                 ff_ivi_huff_desc_copy(&huff_tab->cust_desc, &new_huff);
 
                 if (huff_tab->cust_tab.table)
@@ -333,7 +333,7 @@ int ff_ivi_dec_tile_data_size(GetBitContext *gb)
 int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
 {
     int         mbn, blk, num_blocks, num_coeffs, blk_size, scan_pos, run, val,
-                pos, is_intra, mc_type, mv_x, mv_y, col_mask;
+                pos, is_intra, mc_type = 0, mv_x, mv_y, col_mask;
     uint8_t     col_flags[8];
     int32_t     prev_dc, trvec[64];
     uint32_t    cbp, sym, lo, hi, quant, buf_offs, q;
@@ -373,9 +373,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
         if (!is_intra) {
             mv_x = mb->mv_x;
             mv_y = mb->mv_y;
-            if (!band->is_halfpel) {
-                mc_type = 0; /* we have only fullpel vectors */
-            } else {
+            if (band->is_halfpel) {
                 mc_type = ((mv_y & 1) << 1) | (mv_x & 1);
                 mv_x >>= 1;
                 mv_y >>= 1; /* convert halfpel vectors into fullpel ones */
@@ -417,7 +415,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
 
                     /* de-zigzag and dequantize */
                     scan_pos += run;
-                    if (scan_pos >= num_coeffs)
+                    if (scan_pos >= (unsigned)num_coeffs)
                         break;
                     pos = band->scan[scan_pos];
 
@@ -440,7 +438,10 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
                     trvec[0]      = prev_dc;
                     col_flags[0] |= !!prev_dc;
                 }
-
+                if(band->transform_size > band->blk_size){
+                    av_log(0, AV_LOG_ERROR, "Too large transform\n");
+                    return AVERROR_INVALIDDATA;
+                }
                 /* apply inverse transform */
                 band->inv_transform(trvec, band->buf + buf_offs,
                                     band->pitch, col_flags);
@@ -483,6 +484,12 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
     void (*mc_no_delta_func)(int16_t *buf, const int16_t *ref_buf, uint32_t pitch,
                              int mc_type);
 
+    if( tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size) ){
+        av_log(avctx, AV_LOG_ERROR, "allocated tile size %d mismatches parameters %d in ff_ivi_process_empty_tile()\n",
+               tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
+        return;
+    }
+
     offs       = tile->ypos * band->pitch + tile->xpos;
     mb         = tile->mbs;
     ref_mb     = tile->ref_mbs;