h264_mvpred: constify all uses of H264Context

[ffmpeg] / libavcodec / pcx.c

diff --git a/libavcodec/pcx.c b/libavcodec/pcx.c
index 53f8c1992aeafec295fb514afd0bbd12ec6dd2a1..61c971e073f2e400dba95482c9862f2e344de284 100644 (file)
--- a/libavcodec/pcx.c
+++ b/libavcodec/pcx.c
@@ -31,7 +31,9 @@
 /**
  * @return advanced src pointer
  */
-static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst,
+static const uint8_t *pcx_rle_decode(const uint8_t *src,
+                                     const uint8_t *end,
+                                     uint8_t *dst,
                                      unsigned int bytes_per_scanline,
                                      int compressed)
 {
@@ -39,10 +41,10 @@ static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst,
     unsigned char run, value;
 
     if (compressed) {
-        while (i < bytes_per_scanline) {
+        while (i < bytes_per_scanline && src < end) {
             run   = 1;
             value = *src++;
-            if (value >= 0xc0) {
+            if (value >= 0xc0 && src < end) {
                 run   = value & 0x3f;
                 value = *src++;
             }
@@ -78,6 +80,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x,
                  bytes_per_scanline;
     uint8_t *ptr;
+    const uint8_t *buf_end = buf + buf_size;
     uint8_t const *bufstart = buf;
     uint8_t *scanline;
     int ret = -1;
@@ -106,7 +109,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     nplanes            = buf[65];
     bytes_per_scanline = nplanes * bytes_per_line;
 
-    if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8) {
+    if (bytes_per_scanline < (w * bits_per_pixel * nplanes + 7) / 8 ||
+        (!compressed && bytes_per_scanline > buf_size / h)) {
         av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n");
         return AVERROR_INVALIDDATA;
     }
@@ -131,10 +135,9 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
 
     buf += 128;
 
-    if ((ret = av_image_check_size(w, h, 0, avctx)) < 0)
+    if ((ret = ff_set_dimensions(avctx, w, h)) < 0)
         return ret;
-    if (w != avctx->width || h != avctx->height)
-        avcodec_set_dimensions(avctx, w, h);
+
     if ((ret = ff_get_buffer(avctx, p, 0)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
         return ret;
@@ -151,7 +154,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
 
     if (nplanes == 3 && bits_per_pixel == 8) {
         for (y = 0; y < h; y++) {
-            buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+            buf = pcx_rle_decode(buf, buf_end,
+                                 scanline, bytes_per_scanline, compressed);
 
             for (x = 0; x < w; x++) {
                 ptr[3 * x]     = scanline[x];
@@ -164,8 +168,16 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     } else if (nplanes == 1 && bits_per_pixel == 8) {
         const uint8_t *palstart = bufstart + buf_size - 769;
 
+        if (buf_size < 769) {
+            av_log(avctx, AV_LOG_ERROR, "File is too short\n");
+            ret = avctx->err_recognition & AV_EF_EXPLODE ?
+                  AVERROR_INVALIDDATA : buf_size;
+            goto end;
+        }
+
         for (y = 0; y < h; y++, ptr += stride) {
-            buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+            buf = pcx_rle_decode(buf, buf_end,
+                                 scanline, bytes_per_scanline, compressed);
             memcpy(ptr, scanline, w);
         }
 
@@ -175,6 +187,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
         }
         if (*buf++ != 12) {
             av_log(avctx, AV_LOG_ERROR, "expected palette after image data\n");
+            ret = avctx->err_recognition & AV_EF_EXPLODE ?
+                  AVERROR_INVALIDDATA : buf_size;
             goto end;
         }
     } else if (nplanes == 1) {   /* all packed formats, max. 16 colors */
@@ -183,7 +197,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
         for (y = 0; y < h; y++) {
             init_get_bits(&s, scanline, bytes_per_scanline << 3);
 
-            buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+            buf = pcx_rle_decode(buf, buf_end,
+                                 scanline, bytes_per_scanline, compressed);
 
             for (x = 0; x < w; x++)
                 ptr[x] = get_bits(&s, bits_per_pixel);
@@ -193,7 +208,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
         int i;
 
         for (y = 0; y < h; y++) {
-            buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+            buf = pcx_rle_decode(buf, buf_end,
+                                 scanline, bytes_per_scanline, compressed);
 
             for (x = 0; x < w; x++) {
                 int m = 0x80 >> (x & 7), v = 0;
@@ -224,9 +240,9 @@ end:
 
 AVCodec ff_pcx_decoder = {
     .name         = "pcx",
+    .long_name    = NULL_IF_CONFIG_SMALL("PC Paintbrush PCX image"),
     .type         = AVMEDIA_TYPE_VIDEO,
     .id           = AV_CODEC_ID_PCX,
     .decode       = pcx_decode_frame,
     .capabilities = CODEC_CAP_DR1,
-    .long_name    = NULL_IF_CONFIG_SMALL("PC Paintbrush PCX image"),
 };