*/
/**
- * @file mjpegbdec.c
+ * @file libavcodec/mjpegbdec.c
* Apple MJPEG-B decoder.
*/
#include "mjpeg.h"
#include "mjpegdec.h"
+static uint32_t read_offs(AVCodecContext *avctx, GetBitContext *gb, uint32_t size, const char *err_msg){
+ uint32_t offs= get_bits_long(gb, 32);
+ if(offs >= size){
+ av_log(avctx, AV_LOG_WARNING, err_msg, offs, size);
+ return 0;
+ }
+ return offs;
+}
static int mjpegb_decode_frame(AVCodecContext *avctx,
void *data, int *data_size,
- const uint8_t *buf, int buf_size)
+ AVPacket *avpkt)
{
+ const uint8_t *buf = avpkt->data;
+ int buf_size = avpkt->size;
MJpegDecodeContext *s = avctx->priv_data;
const uint8_t *buf_end, *buf_ptr;
AVFrame *picture = data;
field_size = get_bits_long(&hgb, 32); /* field size */
av_log(avctx, AV_LOG_DEBUG, "field size: 0x%x\n", field_size);
skip_bits(&hgb, 32); /* padded field size */
- second_field_offs = get_bits_long(&hgb, 32);
+ second_field_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "second_field_offs is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "second field offs: 0x%x\n", second_field_offs);
- dqt_offs = get_bits_long(&hgb, 32);
+ dqt_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dqt is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "dqt offs: 0x%x\n", dqt_offs);
if (dqt_offs)
{
ff_mjpeg_decode_dqt(s);
}
- dht_offs = get_bits_long(&hgb, 32);
+ dht_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dht is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "dht offs: 0x%x\n", dht_offs);
if (dht_offs)
{
ff_mjpeg_decode_dht(s);
}
- sof_offs = get_bits_long(&hgb, 32);
+ sof_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "sof offs: 0x%x\n", sof_offs);
if (sof_offs)
{
return -1;
}
- sos_offs = get_bits_long(&hgb, 32);
+ sos_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sos is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "sos offs: 0x%x\n", sos_offs);
- sod_offs = get_bits_long(&hgb, 32);
+ sod_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs);
if (sos_offs)
{