lavf/movenc: Fail when codec tag is invalid for format

[ffmpeg] / libavcodec / lagarith.c

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index 0f4aa89486e092b8838e11a823210988992b711e..3d3b4d41f434214b1d8935427f20d80ee6c2f8ef 100644 (file)
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -141,6 +141,7 @@ static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)
     unsigned prob, cumulative_target;
     unsigned cumul_prob = 0;
     unsigned scaled_cumul_prob = 0;
+    int nnz = 0;
 
     rac->prob[0] = 0;
     rac->prob[257] = UINT_MAX;
@@ -164,6 +165,8 @@ static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)
                 prob = 256 - i;
             for (j = 0; j < prob; j++)
                 rac->prob[++i] = 0;
+        }else {
+            nnz++;
         }
     }
 
@@ -172,6 +175,10 @@ static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)
         return -1;
     }
 
+    if (nnz == 1 && (show_bits_long(gb, 32) & 0xFFFFFF)) {
+        return AVERROR_INVALIDDATA;
+    }
+
     /* Scale probabilities so cumulative probability is an even power of 2. */
     scale_factor = av_log2(cumul_prob);
 
@@ -534,7 +541,7 @@ static int lag_decode_frame(AVCodecContext *avctx,
     LagarithContext *l = avctx->priv_data;
     ThreadFrame frame = { .f = data };
     AVFrame *const p  = data;
-    uint8_t frametype = 0;
+    uint8_t frametype;
     uint32_t offset_gu = 0, offset_bv = 0, offset_ry = 9;
     uint32_t offs[4];
     uint8_t *srcs[4], *dst;
@@ -565,8 +572,14 @@ static int lag_decode_frame(AVCodecContext *avctx,
 
         dst = p->data[0];
         if (frametype == FRAME_SOLID_RGBA) {
+            int qwidth = avctx->width>>2;
+            uint64_t c = ((uint64_t)offset_gu << 32) | offset_gu;
         for (j = 0; j < avctx->height; j++) {
-            for (i = 0; i < avctx->width; i++)
+            for (i = 0; i < qwidth; i++) {
+                AV_WN64(dst + i * 16    , c);
+                AV_WN64(dst + i * 16 + 8, c);
+            }
+            for (i = 4*qwidth; i < avctx->width; i++)
                 AV_WN32(dst + i * 4, offset_gu);
             dst += p->linesize[0];
         }