libopusdec: fix out-of-bounds read

[ffmpeg] / libavcodec / sunrast.c

diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c
index 441e6891a85fb54b6ddb78f2c61ef1a3309a0ff5..6a928bb2cf50f167f7c9a0c5b2885c40480e4a35 100644 (file)
--- a/libavcodec/sunrast.c
+++ b/libavcodec/sunrast.c
@@ -19,31 +19,19 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#include "libavutil/common.h"
 #include "libavutil/intreadwrite.h"
 #include "libavutil/imgutils.h"
 #include "avcodec.h"
+#include "internal.h"
 #include "sunrast.h"
 
-typedef struct SUNRASTContext {
-    AVFrame picture;
-} SUNRASTContext;
-
-static av_cold int sunrast_init(AVCodecContext *avctx) {
-    SUNRASTContext *s = avctx->priv_data;
-
-    avcodec_get_frame_defaults(&s->picture);
-    avctx->coded_frame = &s->picture;
-
-    return 0;
-}
-
 static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
-                                int *data_size, AVPacket *avpkt) {
+                                int *got_frame, AVPacket *avpkt)
+{
     const uint8_t *buf       = avpkt->data;
     const uint8_t *buf_end   = avpkt->data + avpkt->size;
-    SUNRASTContext * const s = avctx->priv_data;
-    AVFrame *picture         = data;
-    AVFrame * const p        = &s->picture;
+    AVFrame * const p        = data;
     unsigned int w, h, depth, type, maptype, maplength, stride, x, y, len, alen;
     uint8_t *ptr;
     const uint8_t *bufstart = buf;
@@ -66,19 +54,15 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
     buf      += 32;
 
     if (type == RT_FORMAT_TIFF || type == RT_FORMAT_IFF || type == RT_EXPERIMENTAL) {
-        av_log_ask_for_sample(avctx, "unsupported (compression) type\n");
+        avpriv_request_sample(avctx, "TIFF/IFF/EXPERIMENTAL (compression) type");
         return AVERROR_PATCHWELCOME;
     }
     if (type > RT_FORMAT_IFF) {
         av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n");
         return AVERROR_INVALIDDATA;
     }
-    if (av_image_check_size(w, h, 0, avctx)) {
-        av_log(avctx, AV_LOG_ERROR, "invalid image size\n");
-        return AVERROR_INVALIDDATA;
-    }
     if (maptype == RMT_RAW) {
-        av_log_ask_for_sample(avctx, "unsupported colormap type\n");
+        avpriv_request_sample(avctx, "Unknown colormap type");
         return AVERROR_PATCHWELCOME;
     }
     if (maptype > RMT_RAW) {
@@ -89,25 +73,24 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
 
     switch (depth) {
         case 1:
-            avctx->pix_fmt = PIX_FMT_MONOWHITE;
+            avctx->pix_fmt = AV_PIX_FMT_MONOWHITE;
             break;
         case 8:
-            avctx->pix_fmt = maplength ? PIX_FMT_PAL8 : PIX_FMT_GRAY8;
+            avctx->pix_fmt = maplength ? AV_PIX_FMT_PAL8 : AV_PIX_FMT_GRAY8;
             break;
         case 24:
-            avctx->pix_fmt = (type == RT_FORMAT_RGB) ? PIX_FMT_RGB24 : PIX_FMT_BGR24;
+            avctx->pix_fmt = (type == RT_FORMAT_RGB) ? AV_PIX_FMT_RGB24 : AV_PIX_FMT_BGR24;
             break;
         default:
             av_log(avctx, AV_LOG_ERROR, "invalid depth\n");
             return AVERROR_INVALIDDATA;
     }
 
-    if (p->data[0])
-        avctx->release_buffer(avctx, p);
+    ret = ff_set_dimensions(avctx, w, h);
+    if (ret < 0)
+        return ret;
 
-    if (w != avctx->width || h != avctx->height)
-        avcodec_set_dimensions(avctx, w, h);
-    if ((ret = avctx->get_buffer(avctx, p)) < 0) {
+    if ((ret = ff_get_buffer(avctx, p, 0)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
         return ret;
     }
@@ -178,29 +161,16 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
         }
     }
 
-    *picture   = s->picture;
-    *data_size = sizeof(AVFrame);
+    *got_frame = 1;
 
     return buf - bufstart;
 }
 
-static av_cold int sunrast_end(AVCodecContext *avctx) {
-    SUNRASTContext *s = avctx->priv_data;
-
-    if(s->picture.data[0])
-        avctx->release_buffer(avctx, &s->picture);
-
-    return 0;
-}
-
 AVCodec ff_sunrast_decoder = {
     .name           = "sunrast",
+    .long_name      = NULL_IF_CONFIG_SMALL("Sun Rasterfile image"),
     .type           = AVMEDIA_TYPE_VIDEO,
     .id             = AV_CODEC_ID_SUNRAST,
-    .priv_data_size = sizeof(SUNRASTContext),
-    .init           = sunrast_init,
-    .close          = sunrast_end,
     .decode         = sunrast_decode_frame,
-    .capabilities   = CODEC_CAP_DR1,
-    .long_name      = NULL_IF_CONFIG_SMALL("Sun Rasterfile image"),
+    .capabilities   = AV_CODEC_CAP_DR1,
 };