Merge remote-tracking branch 'qatar/master'

[ffmpeg] / libavcodec / ivi_common.c

diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c
index c593ee942ff1e2c194fb6fef58cc1e8bef0ee4fc..3f5e630762deec67ed42423dcb45086649d49ee1 100644 (file)
--- a/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@ -128,7 +128,7 @@ int ff_ivi_dec_huff_desc(GetBitContext *gb, int desc_coded, int which_tab,
                 new_huff.xbits[i] = get_bits(gb, 4);
 
             /* Have we got the same custom table? Rebuild if not. */
-            if (ff_ivi_huff_desc_cmp(&new_huff, &huff_tab->cust_desc)) {
+            if (ff_ivi_huff_desc_cmp(&new_huff, &huff_tab->cust_desc) || !huff_tab->cust_tab.table) {
                 ff_ivi_huff_desc_copy(&huff_tab->cust_desc, &new_huff);
 
                 if (huff_tab->cust_tab.table)
@@ -164,7 +164,7 @@ void ff_ivi_huff_desc_copy(IVIHuffDesc *dst, const IVIHuffDesc *src)
     memcpy(dst->xbits, src->xbits, src->num_rows);
 }
 
-int av_cold ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg)
+av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg)
 {
     int         p, b;
     uint32_t    b_width, b_height, align_fac, width_aligned, height_aligned, buf_size;
@@ -209,6 +209,7 @@ int av_cold ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg)
             band->pitch    = width_aligned;
             band->bufs[0]  = av_malloc(buf_size);
             band->bufs[1]  = av_malloc(buf_size);
+            band->bufsize  = buf_size/2;
             if (!band->bufs[0] || !band->bufs[1])
                 return AVERROR(ENOMEM);
 
@@ -226,7 +227,7 @@ int av_cold ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg)
     return 0;
 }
 
-void av_cold ff_ivi_free_buffers(IVIPlaneDesc *planes)
+av_cold void ff_ivi_free_buffers(IVIPlaneDesc *planes)
 {
     int p, b, t;
 
@@ -246,7 +247,7 @@ void av_cold ff_ivi_free_buffers(IVIPlaneDesc *planes)
     }
 }
 
-int av_cold ff_ivi_init_tiles(IVIPlaneDesc *planes, int tile_width, int tile_height)
+av_cold int ff_ivi_init_tiles(IVIPlaneDesc *planes, int tile_width, int tile_height)
 {
     int         p, b, x, y, x_tiles, y_tiles, t_width, t_height;
     IVIBandDesc *band;
@@ -332,7 +333,7 @@ int ff_ivi_dec_tile_data_size(GetBitContext *gb)
 int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
 {
     int         mbn, blk, num_blocks, num_coeffs, blk_size, scan_pos, run, val,
-                pos, is_intra, mc_type, mv_x, mv_y, col_mask;
+                pos, is_intra, mc_type = 0, mv_x, mv_y, col_mask;
     uint8_t     col_flags[8];
     int32_t     prev_dc, trvec[64];
     uint32_t    cbp, sym, lo, hi, quant, buf_offs, q;
@@ -372,9 +373,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
         if (!is_intra) {
             mv_x = mb->mv_x;
             mv_y = mb->mv_y;
-            if (!band->is_halfpel) {
-                mc_type = 0; /* we have only fullpel vectors */
-            } else {
+            if (band->is_halfpel) {
                 mc_type = ((mv_y & 1) << 1) | (mv_x & 1);
                 mv_x >>= 1;
                 mv_y >>= 1; /* convert halfpel vectors into fullpel ones */
@@ -416,7 +415,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
 
                     /* de-zigzag and dequantize */
                     scan_pos += run;
-                    if (scan_pos >= num_coeffs)
+                    if (scan_pos >= (unsigned)num_coeffs)
                         break;
                     pos = band->scan[scan_pos];
 
@@ -439,7 +438,10 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
                     trvec[0]      = prev_dc;
                     col_flags[0] |= !!prev_dc;
                 }
-
+                if(band->transform_size > band->blk_size){
+                    av_log(0, AV_LOG_ERROR, "Too large transform\n");
+                    return AVERROR_INVALIDDATA;
+                }
                 /* apply inverse transform */
                 band->inv_transform(trvec, band->buf + buf_offs,
                                     band->pitch, col_flags);
@@ -482,6 +484,12 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
     void (*mc_no_delta_func)(int16_t *buf, const int16_t *ref_buf, uint32_t pitch,
                              int mc_type);
 
+    if( tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size) ){
+        av_log(avctx, AV_LOG_ERROR, "allocated tile size %d mismatches parameters %d in ff_ivi_process_empty_tile()\n",
+               tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
+        return;
+    }
+
     offs       = tile->ypos * band->pitch + tile->xpos;
     mb         = tile->mbs;
     ref_mb     = tile->ref_mbs;