use previous qscale for intra_dc_threshold check

[ffmpeg] / libavcodec / qdrw.c

diff --git a/libavcodec/qdrw.c b/libavcodec/qdrw.c
index 0adb5f49a1ccb443a4b73719c0aa9678118564dd..84636591742482eed8205d4bc3c872499a45b5e5 100644 (file)
--- a/libavcodec/qdrw.c
+++ b/libavcodec/qdrw.c
@@ -14,15 +14,15 @@
  *
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  *
  */
- 
+
 /**
  * @file qdrw.c
  * Apple QuickDraw codec.
  */
- 
+
 #include "avcodec.h"
 #include "mpegvideo.h"
 
@@ -32,7 +32,7 @@ typedef struct QdrawContext{
     uint8_t palette[256*3];
 } QdrawContext;
 
-static int decode_frame(AVCodecContext *avctx, 
+static int decode_frame(AVCodecContext *avctx,
                         void *data, int *data_size,
                         uint8_t *buf, int buf_size)
 {
@@ -41,11 +41,6 @@ static int decode_frame(AVCodecContext *avctx,
     uint8_t* outdata;
     int colors;
     int i;
-    
-    /* special case for last picture */
-    if (buf_size == 0) {
-        return 0;
-    }
 
     if(p->data[0])
         avctx->release_buffer(avctx, p);
@@ -59,21 +54,26 @@ static int decode_frame(AVCodecContext *avctx,
     p->key_frame= 1;
 
     outdata = a->pic.data[0];
-    
+
     buf += 0x68; /* jump to palette */
     colors = BE_32(buf);
     buf += 4;
-    
+
     if(colors < 0 || colors > 256) {
         av_log(avctx, AV_LOG_ERROR, "Error color count - %i(0x%X)\n", colors, colors);
         return -1;
     }
-    
+
     for (i = 0; i <= colors; i++) {
-        int idx;
+        unsigned int idx;
         idx = BE_16(buf); /* color index */
         buf += 2;
-        
+
+        if (idx > 255) {
+            av_log(avctx, AV_LOG_ERROR, "Palette index out of range: %u\n", idx);
+            buf += 6;
+            continue;
+        }
         a->palette[idx * 3 + 0] = *buf++;
         buf++;
         a->palette[idx * 3 + 1] = *buf++;
@@ -82,16 +82,13 @@ static int decode_frame(AVCodecContext *avctx,
         buf++;
     }
 
-    if (colors)
-        a->pic.palette_has_changed = 1;
-
     buf += 18; /* skip unneeded data */
     for (i = 0; i < avctx->height; i++) {
         int size, left, code, pix;
         uint8_t *next;
         uint8_t *out;
         int tsize = 0;
-        
+
         /* decode line */
         out = outdata;
         size = BE_16(buf); /* size of packed line */
@@ -103,6 +100,8 @@ static int decode_frame(AVCodecContext *avctx,
             if (code & 0x80 ) { /* run */
                 int i;
                 pix = *buf++;
+                if ((out + (257 - code) * 3) > (outdata +  a->pic.linesize[0]))
+                    break;
                 for (i = 0; i < 257 - code; i++) {
                     *out++ = a->palette[pix * 3 + 0];
                     *out++ = a->palette[pix * 3 + 1];
@@ -112,6 +111,8 @@ static int decode_frame(AVCodecContext *avctx,
                 left -= 2;
             } else { /* copy */
                 int i, pix;
+                if ((out + code * 3) > (outdata +  a->pic.linesize[0]))
+                    break;
                 for (i = 0; i <= code; i++) {
                     pix = *buf++;
                     *out++ = a->palette[pix * 3 + 0];
@@ -128,13 +129,17 @@ static int decode_frame(AVCodecContext *avctx,
 
     *data_size = sizeof(AVFrame);
     *(AVFrame*)data = a->pic;
-    
+
     return buf_size;
 }
 
 static int decode_init(AVCodecContext *avctx){
 //    QdrawContext * const a = avctx->priv_data;
 
+    if (avcodec_check_dimensions(avctx, avctx->height, avctx->width) < 0) {
+        return 1;
+    }
+
     avctx->pix_fmt= PIX_FMT_RGB24;
 
     return 0;