* Sun Rasterfile (.sun/.ras/im{1,8,24}/.sunras) image decoder
* Copyright (c) 2007, 2008 Ivo van Poorten
*
- * This file is part of FFmpeg.
+ * This file is part of Libav.
*
- * FFmpeg is free software; you can redistribute it and/or
+ * Libav is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
- * FFmpeg is distributed in the hope that it will be useful,
+ * Libav is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
- * License along with FFmpeg; if not, write to the Free Software
+ * License along with Libav; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
int *data_size, AVPacket *avpkt) {
const uint8_t *buf = avpkt->data;
+ const uint8_t *buf_end = avpkt->data + avpkt->size;
SUNRASTContext * const s = avctx->priv_data;
AVFrame *picture = data;
AVFrame * const p = &s->picture;
uint8_t *ptr;
const uint8_t *bufstart = buf;
+ if (avpkt->size < 32)
+ return AVERROR_INVALIDDATA;
+
if (AV_RB32(buf) != 0x59a66a95) {
av_log(avctx, AV_LOG_ERROR, "this is not sunras encoded data\n");
return -1;
type = AV_RB32(buf+20);
maptype = AV_RB32(buf+24);
maplength = AV_RB32(buf+28);
+ buf += 32;
if (type == RT_FORMAT_TIFF || type == RT_FORMAT_IFF) {
av_log(avctx, AV_LOG_ERROR, "unsupported (compression) type\n");
return -1;
}
- if (type > RT_FORMAT_IFF) {
+ if (type < RT_OLD || type > RT_FORMAT_IFF) {
av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n");
return -1;
}
+ if (av_image_check_size(w, h, 0, avctx)) {
+ av_log(avctx, AV_LOG_ERROR, "invalid image size\n");
+ return -1;
+ }
if (maptype & ~1) {
av_log(avctx, AV_LOG_ERROR, "invalid colormap type\n");
return -1;
}
- buf += 32;
switch (depth) {
case 1:
if (p->data[0])
avctx->release_buffer(avctx, p);
- if (av_image_check_size(w, h, 0, avctx))
- return -1;
if (w != avctx->width || h != avctx->height)
avcodec_set_dimensions(avctx, w, h);
if (avctx->get_buffer(avctx, p) < 0) {
return -1;
}
- p->pict_type = FF_I_TYPE;
+ p->pict_type = AV_PICTURE_TYPE_I;
+
+ if (buf_end - buf < maplength)
+ return AVERROR_INVALIDDATA;
if (depth != 8 && maplength) {
av_log(avctx, AV_LOG_WARNING, "useless colormap found or file is corrupted, trying to recover\n");
uint8_t *end = ptr + h*stride;
x = 0;
- while (ptr != end) {
+ while (ptr != end && buf < buf_end) {
run = 1;
+ if (buf_end - buf < 1)
+ return AVERROR_INVALIDDATA;
+
if ((value = *buf++) == 0x80) {
run = *buf++ + 1;
if (run != 1)
}
} else {
for (y=0; y<h; y++) {
+ if (buf_end - buf < len)
+ break;
memcpy(ptr, buf, len);
ptr += stride;
buf += alen;
}
AVCodec ff_sunrast_decoder = {
- "sunrast",
- AVMEDIA_TYPE_VIDEO,
- CODEC_ID_SUNRAST,
- sizeof(SUNRASTContext),
- sunrast_init,
- NULL,
- sunrast_end,
- sunrast_decode_frame,
- CODEC_CAP_DR1,
- NULL,
+ .name = "sunrast",
+ .type = AVMEDIA_TYPE_VIDEO,
+ .id = CODEC_ID_SUNRAST,
+ .priv_data_size = sizeof(SUNRASTContext),
+ .init = sunrast_init,
+ .close = sunrast_end,
+ .decode = sunrast_decode_frame,
+ .capabilities = CODEC_CAP_DR1,
.long_name = NULL_IF_CONFIG_SMALL("Sun Rasterfile image"),
};