Add a bounds check on AVProbeData input.

[ffmpeg] / libavcodec / kmvc.c

diff --git a/libavcodec/kmvc.c b/libavcodec/kmvc.c
index 28dc0148358058e0ab980ddc4fbcd0460f0161c8..c56b62ca2f9f7cf08769be6b485bc7a8b37efbbc 100644 (file)
--- a/libavcodec/kmvc.c
+++ b/libavcodec/kmvc.c
@@ -28,8 +28,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "common.h"
 #include "avcodec.h"
+#include "bytestream.h"
 
 #define KMVC_KEYFRAME 0x80
 #define KMVC_PALETTE  0x40
@@ -228,7 +228,7 @@ static void kmvc_decode_inter_8x8(KmvcContext * ctx, uint8_t * src, int w, int h
 static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, uint8_t * buf,
                         int buf_size)
 {
-    KmvcContext *const ctx = (KmvcContext *) avctx->priv_data;
+    KmvcContext *const ctx = avctx->priv_data;
     uint8_t *out, *src;
     int i;
     int header;
@@ -250,7 +250,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, uint
     if (buf[0] == 127) {
         buf += 3;
         for (i = 0; i < 127; i++) {
-            ctx->pal[i + (header & 0x81)] = (buf[0] << 16) | (buf[1] << 8) | buf[2];
+            ctx->pal[i + (header & 0x81)] = AV_RB24(buf);
             buf += 4;
         }
         buf -= 127 * 4 + 3;
@@ -275,8 +275,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, uint
         ctx->pic.palette_has_changed = 1;
         // palette starts from index 1 and has 127 entries
         for (i = 1; i <= ctx->palsize; i++) {
-            ctx->pal[i] = (buf[0] << 16) | (buf[1] << 8) | buf[2];
-            buf += 3;
+            ctx->pal[i] = bytestream_get_be24(&buf);
         }
     }
 
@@ -342,11 +341,10 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, uint
  */
 static int decode_init(AVCodecContext * avctx)
 {
-    KmvcContext *const c = (KmvcContext *) avctx->priv_data;
+    KmvcContext *const c = avctx->priv_data;
     int i;
 
     c->avctx = avctx;
-    avctx->has_b_frames = 0;
 
     c->pic.data[0] = NULL;
 
@@ -395,7 +393,7 @@ static int decode_init(AVCodecContext * avctx)
  */
 static int decode_end(AVCodecContext * avctx)
 {
-    KmvcContext *const c = (KmvcContext *) avctx->priv_data;
+    KmvcContext *const c = avctx->priv_data;
 
     av_freep(&c->frm0);
     av_freep(&c->frm1);