/**
* @return advanced src pointer
*/
-static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst,
+static const uint8_t *pcx_rle_decode(const uint8_t *src,
+ const uint8_t *end,
+ uint8_t *dst,
unsigned int bytes_per_scanline,
int compressed)
{
unsigned char run, value;
if (compressed) {
- while (i < bytes_per_scanline) {
+ while (i < bytes_per_scanline && src < end) {
run = 1;
value = *src++;
- if (value >= 0xc0) {
+ if (value >= 0xc0 && src < end) {
run = value & 0x3f;
value = *src++;
}
unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x,
bytes_per_scanline;
uint8_t *ptr;
+ const uint8_t *buf_end = buf + buf_size;
uint8_t const *bufstart = buf;
uint8_t *scanline;
int ret = -1;
nplanes = buf[65];
bytes_per_scanline = nplanes * bytes_per_line;
- if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8) {
+ if (bytes_per_scanline < (w * bits_per_pixel * nplanes + 7) / 8 ||
+ (!compressed && bytes_per_scanline > buf_size / h)) {
av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n");
return AVERROR_INVALIDDATA;
}
buf += 128;
- if ((ret = av_image_check_size(w, h, 0, avctx)) < 0)
+ if ((ret = ff_set_dimensions(avctx, w, h)) < 0)
return ret;
- if (w != avctx->width || h != avctx->height)
- avcodec_set_dimensions(avctx, w, h);
+
if ((ret = ff_get_buffer(avctx, p, 0)) < 0) {
av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
return ret;
if (nplanes == 3 && bits_per_pixel == 8) {
for (y = 0; y < h; y++) {
- buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+ buf = pcx_rle_decode(buf, buf_end,
+ scanline, bytes_per_scanline, compressed);
for (x = 0; x < w; x++) {
ptr[3 * x] = scanline[x];
} else if (nplanes == 1 && bits_per_pixel == 8) {
const uint8_t *palstart = bufstart + buf_size - 769;
+ if (buf_size < 769) {
+ av_log(avctx, AV_LOG_ERROR, "File is too short\n");
+ ret = avctx->err_recognition & AV_EF_EXPLODE ?
+ AVERROR_INVALIDDATA : buf_size;
+ goto end;
+ }
+
for (y = 0; y < h; y++, ptr += stride) {
- buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+ buf = pcx_rle_decode(buf, buf_end,
+ scanline, bytes_per_scanline, compressed);
memcpy(ptr, scanline, w);
}
}
if (*buf++ != 12) {
av_log(avctx, AV_LOG_ERROR, "expected palette after image data\n");
+ ret = avctx->err_recognition & AV_EF_EXPLODE ?
+ AVERROR_INVALIDDATA : buf_size;
goto end;
}
} else if (nplanes == 1) { /* all packed formats, max. 16 colors */
for (y = 0; y < h; y++) {
init_get_bits(&s, scanline, bytes_per_scanline << 3);
- buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+ buf = pcx_rle_decode(buf, buf_end,
+ scanline, bytes_per_scanline, compressed);
for (x = 0; x < w; x++)
ptr[x] = get_bits(&s, bits_per_pixel);
int i;
for (y = 0; y < h; y++) {
- buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
+ buf = pcx_rle_decode(buf, buf_end,
+ scanline, bytes_per_scanline, compressed);
for (x = 0; x < w; x++) {
int m = 0x80 >> (x & 7), v = 0;
AVCodec ff_pcx_decoder = {
.name = "pcx",
+ .long_name = NULL_IF_CONFIG_SMALL("PC Paintbrush PCX image"),
.type = AVMEDIA_TYPE_VIDEO,
.id = AV_CODEC_ID_PCX,
.decode = pcx_decode_frame,
.capabilities = CODEC_CAP_DR1,
- .long_name = NULL_IF_CONFIG_SMALL("PC Paintbrush PCX image"),
};