libopusdec: fix out-of-bounds read

[ffmpeg] / libavcodec / targaenc.c

diff --git a/libavcodec/targaenc.c b/libavcodec/targaenc.c
index e13545f82ba5a1246eb8ea0513a8c22f8df5da92..f0cee38542fd9f2b705eaab94ca686bf453051c8 100644 (file)
--- a/libavcodec/targaenc.c
+++ b/libavcodec/targaenc.c
@@ -21,8 +21,10 @@
 
 #include <string.h>
 
+#include "libavutil/imgutils.h"
 #include "libavutil/internal.h"
 #include "libavutil/intreadwrite.h"
+#include "libavutil/opt.h"
 #include "libavutil/pixdesc.h"
 #include "avcodec.h"
 #include "internal.h"
@@ -30,7 +32,9 @@
 #include "targa.h"
 
 typedef struct TargaContext {
-    AVFrame picture;
+    AVClass *class;
+
+    int rle;
 } TargaContext;
 
 /**
@@ -81,14 +85,12 @@ static int targa_encode_normal(uint8_t *outbuf, const AVFrame *pic, int bpp, int
 static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
                               const AVFrame *p, int *got_packet)
 {
+    TargaContext *s = avctx->priv_data;
     int bpp, picsize, datasize = -1, ret;
     uint8_t *out;
 
-    if(avctx->width > 0xffff || avctx->height > 0xffff) {
-        av_log(avctx, AV_LOG_ERROR, "image dimensions too large\n");
-        return AVERROR(EINVAL);
-    }
-    picsize = avpicture_get_size(avctx->pix_fmt, avctx->width, avctx->height);
+    picsize = av_image_get_buffer_size(avctx->pix_fmt,
+                                       avctx->width, avctx->height, 1);
     if ((ret = ff_alloc_packet(pkt, picsize + 45)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "encoded frame too large\n");
         return ret;
@@ -127,8 +129,15 @@ static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
 
     out = pkt->data + 18;  /* skip past the header we just output */
 
+#if FF_API_CODER_TYPE
+FF_DISABLE_DEPRECATION_WARNINGS
+    if (avctx->coder_type == FF_CODER_TYPE_RAW)
+        s->rle = 0;
+FF_ENABLE_DEPRECATION_WARNINGS
+#endif
+
     /* try RLE compression */
-    if (avctx->coder_type != FF_CODER_TYPE_RAW)
+    if (s->rle)
         datasize = targa_encode_rle(out, picsize, p, bpp, avctx->width, avctx->height);
 
     /* if that worked well, mark the picture as RLE compressed */
@@ -154,26 +163,47 @@ static int targa_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
 
 static av_cold int targa_encode_init(AVCodecContext *avctx)
 {
-    TargaContext *s = avctx->priv_data;
+    if (avctx->width > 0xffff || avctx->height > 0xffff) {
+        av_log(avctx, AV_LOG_ERROR, "image dimensions too large\n");
+        return AVERROR(EINVAL);
+    }
 
-    avcodec_get_frame_defaults(&s->picture);
-    s->picture.key_frame= 1;
-    s->picture.pict_type = AV_PICTURE_TYPE_I;
-    avctx->coded_frame= &s->picture;
+#if FF_API_CODED_FRAME
+FF_DISABLE_DEPRECATION_WARNINGS
+    avctx->coded_frame->key_frame = 1;
+    avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;
+FF_ENABLE_DEPRECATION_WARNINGS
+#endif
 
     return 0;
 }
 
+#define OFFSET(x) offsetof(TargaContext, x)
+#define VE AV_OPT_FLAG_VIDEO_PARAM | AV_OPT_FLAG_ENCODING_PARAM
+static const AVOption options[] = {
+    { "rle", "Use run-length compression", OFFSET(rle), AV_OPT_TYPE_INT, { .i64 = 1 }, 0, 1, VE },
+
+    { NULL },
+};
+
+static const AVClass targa_class = {
+    .class_name = "targa",
+    .item_name  = av_default_item_name,
+    .option     = options,
+    .version    = LIBAVUTIL_VERSION_INT,
+};
+
 AVCodec ff_targa_encoder = {
     .name           = "targa",
+    .long_name      = NULL_IF_CONFIG_SMALL("Truevision Targa image"),
     .type           = AVMEDIA_TYPE_VIDEO,
     .id             = AV_CODEC_ID_TARGA,
     .priv_data_size = sizeof(TargaContext),
+    .priv_class     = &targa_class,
     .init           = targa_encode_init,
     .encode2        = targa_encode_frame,
     .pix_fmts       = (const enum AVPixelFormat[]){
         AV_PIX_FMT_BGR24, AV_PIX_FMT_BGRA, AV_PIX_FMT_RGB555LE, AV_PIX_FMT_GRAY8,
         AV_PIX_FMT_NONE
     },
-    .long_name= NULL_IF_CONFIG_SMALL("Truevision Targa image"),
 };