Replace Subversion revisions in comments by Git hashes.

[ffmpeg] / libavcodec / sunrast.c

diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c
index f5f659604c027dbd437b81727b082a5a5cd01425..455619e39e6c990852c116d5d80177dda9dffc7b 100644 (file)
--- a/libavcodec/sunrast.c
+++ b/libavcodec/sunrast.c
@@ -2,24 +2,25 @@
  * Sun Rasterfile (.sun/.ras/im{1,8,24}/.sunras) image decoder
  * Copyright (c) 2007, 2008 Ivo van Poorten
  *
- * This file is part of FFmpeg.
+ * This file is part of Libav.
  *
- * FFmpeg is free software; you can redistribute it and/or
+ * Libav is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * FFmpeg is distributed in the hope that it will be useful,
+ * Libav is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with FFmpeg; if not, write to the Free Software
+ * License along with Libav; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
 #include "libavutil/intreadwrite.h"
+#include "libavutil/imgutils.h"
 #include "avcodec.h"
 
 #define RT_OLD          0
@@ -45,6 +46,7 @@ static av_cold int sunrast_init(AVCodecContext *avctx) {
 static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
                                 int *data_size, AVPacket *avpkt) {
     const uint8_t *buf = avpkt->data;
+    const uint8_t *buf_end = avpkt->data + avpkt->size;
     SUNRASTContext * const s = avctx->priv_data;
     AVFrame *picture = data;
     AVFrame * const p = &s->picture;
@@ -52,6 +54,9 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
     uint8_t *ptr;
     const uint8_t *bufstart = buf;
 
+    if (avpkt->size < 32)
+        return AVERROR_INVALIDDATA;
+
     if (AV_RB32(buf) != 0x59a66a95) {
         av_log(avctx, AV_LOG_ERROR, "this is not sunras encoded data\n");
         return -1;
@@ -63,21 +68,25 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
     type      = AV_RB32(buf+20);
     maptype   = AV_RB32(buf+24);
     maplength = AV_RB32(buf+28);
+    buf      += 32;
 
-    if (type > RT_BYTE_ENCODED && type <= RT_FORMAT_IFF) {
+    if (type == RT_FORMAT_TIFF || type == RT_FORMAT_IFF) {
         av_log(avctx, AV_LOG_ERROR, "unsupported (compression) type\n");
         return -1;
     }
-    if (type > RT_FORMAT_IFF) {
+    if (type < RT_OLD || type > RT_FORMAT_IFF) {
         av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n");
         return -1;
     }
+    if (av_image_check_size(w, h, 0, avctx)) {
+        av_log(avctx, AV_LOG_ERROR, "invalid image size\n");
+        return -1;
+    }
     if (maptype & ~1) {
         av_log(avctx, AV_LOG_ERROR, "invalid colormap type\n");
         return -1;
     }
 
-    buf += 32;
 
     switch (depth) {
         case 1:
@@ -87,7 +96,7 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
             avctx->pix_fmt = PIX_FMT_PAL8;
             break;
         case 24:
-            avctx->pix_fmt = PIX_FMT_BGR24;
+            avctx->pix_fmt = (type == RT_FORMAT_RGB) ? PIX_FMT_RGB24 : PIX_FMT_BGR24;
             break;
         default:
             av_log(avctx, AV_LOG_ERROR, "invalid depth\n");
@@ -97,8 +106,6 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
     if (p->data[0])
         avctx->release_buffer(avctx, p);
 
-    if (avcodec_check_dimensions(avctx, w, h))
-        return -1;
     if (w != avctx->width || h != avctx->height)
         avcodec_set_dimensions(avctx, w, h);
     if (avctx->get_buffer(avctx, p) < 0) {
@@ -106,7 +113,10 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
         return -1;
     }
 
-    p->pict_type = FF_I_TYPE;
+    p->pict_type = AV_PICTURE_TYPE_I;
+
+    if (buf_end - buf < maplength)
+        return AVERROR_INVALIDDATA;
 
     if (depth != 8 && maplength) {
         av_log(avctx, AV_LOG_WARNING, "useless colormap found or file is corrupted, trying to recover\n");
@@ -142,8 +152,11 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
         uint8_t *end = ptr + h*stride;
 
         x = 0;
-        while (ptr != end) {
+        while (ptr != end && buf < buf_end) {
             run = 1;
+            if (buf_end - buf < 1)
+                return AVERROR_INVALIDDATA;
+
             if ((value = *buf++) == 0x80) {
                 run = *buf++ + 1;
                 if (run != 1)
@@ -162,6 +175,8 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
         }
     } else {
         for (y=0; y<h; y++) {
+            if (buf_end - buf < len)
+                break;
             memcpy(ptr, buf, len);
             ptr += stride;
             buf += alen;
@@ -183,16 +198,14 @@ static av_cold int sunrast_end(AVCodecContext *avctx) {
     return 0;
 }
 
-AVCodec sunrast_decoder = {
-    "sunrast",
-    CODEC_TYPE_VIDEO,
-    CODEC_ID_SUNRAST,
-    sizeof(SUNRASTContext),
-    sunrast_init,
-    NULL,
-    sunrast_end,
-    sunrast_decode_frame,
-    CODEC_CAP_DR1,
-    NULL,
+AVCodec ff_sunrast_decoder = {
+    .name           = "sunrast",
+    .type           = AVMEDIA_TYPE_VIDEO,
+    .id             = CODEC_ID_SUNRAST,
+    .priv_data_size = sizeof(SUNRASTContext),
+    .init           = sunrast_init,
+    .close          = sunrast_end,
+    .decode         = sunrast_decode_frame,
+    .capabilities   = CODEC_CAP_DR1,
     .long_name = NULL_IF_CONFIG_SMALL("Sun Rasterfile image"),
 };