unsigned stride;
unsigned size;
- uint32_t lut[0x10000];
+ uint32_t lut[0x2000];
uint8_t *initial_line;
uint8_t *decbuffer;
} ProSumerContext;
if (bytestream2_get_bytes_left(gb) <= 0) {
if (!a)
return 0;
- cnt = 4;
} else {
- pos = bytestream2_tell(gb) ^ 2;
- bytestream2_seek(gb, pos, SEEK_SET);
+ pos = bytestream2_tell(gb);
+ bytestream2_seek(gb, pos ^ 2, SEEK_SET);
AV_WN16(&a, bytestream2_peek_le16(gb));
- pos = pos ^ 2;
- bytestream2_seek(gb, pos, SEEK_SET);
- bytestream2_skip(gb, 2);
- cnt = 4;
+ bytestream2_seek(gb, pos + 2, SEEK_SET);
}
+ cnt = 4;
}
c--;
}
idx = a >> 20;
b = lut[2 * idx];
+ if (!b)
+ return AVERROR_INVALIDDATA;
continue;
}
idx = 2;
}
return 0;
}
- pos = bytestream2_tell(gb) ^ 2;
- bytestream2_seek(gb, pos, SEEK_SET);
+ pos = bytestream2_tell(gb);
+ bytestream2_seek(gb, pos ^ 2, SEEK_SET);
AV_WN16(&a, bytestream2_peek_le16(gb));
- pos = pos ^ 2;
- bytestream2_seek(gb, pos, SEEK_SET);
- bytestream2_skip(gb, 2);
+ bytestream2_seek(gb, pos + 2, SEEK_SET);
cnt = 4;
idx--;
}
if (avpkt->size <= 32)
return AVERROR_INVALIDDATA;
- memset(s->decbuffer, 0, s->size);
bytestream2_init(&s->gb, avpkt->data, avpkt->size);
bytestream2_init_writer(&s->pb, s->decbuffer, s->size);
+ ret = decompress(&s->gb, AV_RL32(avpkt->data + 28) >> 1, &s->pb, s->lut);
+ if (ret < 0)
+ return ret;
+ if (bytestream2_get_bytes_left_p(&s->pb) > s->size * (int64_t)avctx->discard_damaged_percentage / 100)
+ return AVERROR_INVALIDDATA;
+
+ av_assert0(s->size >= bytestream2_get_bytes_left_p(&s->pb));
+ memset(s->decbuffer + bytestream2_tell_p(&s->pb), 0, bytestream2_get_bytes_left_p(&s->pb));
- decompress(&s->gb, AV_RL32(avpkt->data + 28) >> 1, &s->pb, s->lut);
vertical_predict((uint32_t *)s->decbuffer, 0, (uint32_t *)s->initial_line, s->stride, 1);
vertical_predict((uint32_t *)s->decbuffer, s->stride, (uint32_t *)s->decbuffer, s->stride, avctx->height - 1);