h264: fix invalid pointer arithmetic

[ffmpeg] / libavcodec / sunrast.c

diff --git a/libavcodec/sunrast.c b/libavcodec/sunrast.c
index f03f24c158a4a0d79f7292656bdee3be8bf1cddb..a10f44964817947d1558f5e8324c8723be7accb3 100644 (file)
--- a/libavcodec/sunrast.c
+++ b/libavcodec/sunrast.c
@@ -19,35 +19,11 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#include "libavutil/common.h"
 #include "libavutil/intreadwrite.h"
 #include "libavutil/imgutils.h"
 #include "avcodec.h"
-
-#define RAS_MAGIC 0x59a66a95
-
-/* The Old and Standard format types indicate that the image data is
- * uncompressed. There is no difference between the two formats. */
-#define RT_OLD          0
-#define RT_STANDARD     1
-
-/* The Byte-Encoded format type indicates that the image data is compressed
- * using a run-length encoding scheme. */
-#define RT_BYTE_ENCODED 2
-
-/* The RGB format type indicates that the image is uncompressed with reverse
- * component order from Old and Standard (RGB vs BGR). */
-#define RT_FORMAT_RGB   3
-
-/* The TIFF and IFF format types indicate that the raster file was originally
- * converted from either of these file formats. We do not have any samples or
- * documentation of the format details. */
-#define RT_FORMAT_TIFF  4
-#define RT_FORMAT_IFF   5
-
-/* The Experimental format type is implementation-specific and is generally an
- * indication that the image file does not conform to the Sun Raster file
- * format specification. */
-#define RT_EXPERIMENTAL 0xffff
+#include "sunrast.h"
 
 typedef struct SUNRASTContext {
     AVFrame picture;
@@ -72,13 +48,14 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
     unsigned int w, h, depth, type, maptype, maplength, stride, x, y, len, alen;
     uint8_t *ptr;
     const uint8_t *bufstart = buf;
+    int ret;
 
     if (avpkt->size < 32)
         return AVERROR_INVALIDDATA;
 
     if (AV_RB32(buf) != RAS_MAGIC) {
         av_log(avctx, AV_LOG_ERROR, "this is not sunras encoded data\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
 
     w         = AV_RB32(buf + 4);
@@ -95,31 +72,35 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
     }
     if (type > RT_FORMAT_IFF) {
         av_log(avctx, AV_LOG_ERROR, "invalid (compression) type\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
     if (av_image_check_size(w, h, 0, avctx)) {
         av_log(avctx, AV_LOG_ERROR, "invalid image size\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
-    if (maptype & ~1) {
+    if (maptype == RMT_RAW) {
+        av_log_ask_for_sample(avctx, "unsupported colormap type\n");
+        return AVERROR_PATCHWELCOME;
+    }
+    if (maptype > RMT_RAW) {
         av_log(avctx, AV_LOG_ERROR, "invalid colormap type\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
 
 
     switch (depth) {
         case 1:
-            avctx->pix_fmt = PIX_FMT_MONOWHITE;
+            avctx->pix_fmt = AV_PIX_FMT_MONOWHITE;
             break;
         case 8:
-            avctx->pix_fmt = maplength ? PIX_FMT_PAL8 : PIX_FMT_GRAY8;
+            avctx->pix_fmt = maplength ? AV_PIX_FMT_PAL8 : AV_PIX_FMT_GRAY8;
             break;
         case 24:
-            avctx->pix_fmt = (type == RT_FORMAT_RGB) ? PIX_FMT_RGB24 : PIX_FMT_BGR24;
+            avctx->pix_fmt = (type == RT_FORMAT_RGB) ? AV_PIX_FMT_RGB24 : AV_PIX_FMT_BGR24;
             break;
         default:
             av_log(avctx, AV_LOG_ERROR, "invalid depth\n");
-            return -1;
+            return AVERROR_INVALIDDATA;
     }
 
     if (p->data[0])
@@ -127,9 +108,9 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
 
     if (w != avctx->width || h != avctx->height)
         avcodec_set_dimensions(avctx, w, h);
-    if (avctx->get_buffer(avctx, p) < 0) {
+    if ((ret = avctx->get_buffer(avctx, p)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
-        return -1;
+        return ret;
     }
 
     p->pict_type = AV_PICTURE_TYPE_I;
@@ -145,7 +126,7 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
 
         if (maplength % 3 || maplength > 768) {
             av_log(avctx, AV_LOG_WARNING, "invalid colormap length\n");
-            return -1;
+            return AVERROR_INVALIDDATA;
         }
 
         ptr = p->data[1];
@@ -172,7 +153,7 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
             if (buf_end - buf < 1)
                 return AVERROR_INVALIDDATA;
 
-            if ((value = *buf++) == 0x80) {
+            if ((value = *buf++) == RLE_TRIGGER) {
                 run = *buf++ + 1;
                 if (run != 1)
                     value = *buf++;
@@ -216,11 +197,11 @@ static av_cold int sunrast_end(AVCodecContext *avctx) {
 AVCodec ff_sunrast_decoder = {
     .name           = "sunrast",
     .type           = AVMEDIA_TYPE_VIDEO,
-    .id             = CODEC_ID_SUNRAST,
+    .id             = AV_CODEC_ID_SUNRAST,
     .priv_data_size = sizeof(SUNRASTContext),
     .init           = sunrast_init,
     .close          = sunrast_end,
     .decode         = sunrast_decode_frame,
     .capabilities   = CODEC_CAP_DR1,
-    .long_name = NULL_IF_CONFIG_SMALL("Sun Rasterfile image"),
+    .long_name      = NULL_IF_CONFIG_SMALL("Sun Rasterfile image"),
 };