Check output buffer size in nellymoser decoder.

[ffmpeg] / libavcodec / tiff.c

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index f371dc60c3be244b2eb2b19f8db22aed91deec09..e2c80eff829f8e7389b090866c63be96202be974 100644 (file)
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -102,6 +102,33 @@ static int tiff_uncompress(uint8_t *dst, unsigned long *len, const uint8_t *src,
 }
 #endif
 
+static void av_always_inline horizontal_fill(unsigned int bpp, uint8_t* dst,
+                                             int usePtr, const uint8_t *src,
+                                             uint8_t c, int width, int offset)
+{
+    int i;
+
+    if (bpp == 2) {
+        for (i = 0; i < width; i++) {
+            dst[(i+offset)*4+0] = (usePtr ? src[i] : c) >> 6;
+            dst[(i+offset)*4+1] = (usePtr ? src[i] : c) >> 4 & 0x3;
+            dst[(i+offset)*4+2] = (usePtr ? src[i] : c) >> 2 & 0x3;
+            dst[(i+offset)*4+3] = (usePtr ? src[i] : c) & 0x3;
+        }
+    } else if (bpp == 4) {
+        for (i = 0; i < width; i++) {
+            dst[(i+offset)*2+0] = (usePtr ? src[i] : c) >> 4;
+            dst[(i+offset)*2+1] = (usePtr ? src[i] : c) & 0xF;
+        }
+    } else {
+        if (usePtr) {
+            memcpy(dst + offset, src, width);
+        } else {
+            memset(dst + offset, c, width);
+        }
+    }
+}
+
 static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uint8_t *src, int size, int lines){
     int c, line, pixels, code;
     const uint8_t *ssrc = src;
@@ -173,7 +200,7 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uin
         switch(s->compr){
         case TIFF_RAW:
             if (!s->fill_order) {
-                memcpy(dst, src, width);
+                horizontal_fill(s->bpp, dst, 1, src, 0, width, 0);
             } else {
                 int i;
                 for (i = 0; i < width; i++)
@@ -190,7 +217,7 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uin
                         av_log(s->avctx, AV_LOG_ERROR, "Copy went out of bounds\n");
                         return -1;
                     }
-                    memcpy(dst + pixels, src, code);
+                    horizontal_fill(s->bpp, dst, 1, src, 0, code, pixels);
                     src += code;
                     pixels += code;
                 }else if(code != -128){ // -127..-1
@@ -200,7 +227,7 @@ static int tiff_unpack_strip(TiffContext *s, uint8_t* dst, int stride, const uin
                         return -1;
                     }
                     c = *src++;
-                    memset(dst + pixels, c, code);
+                    horizontal_fill(s->bpp, dst, 0, NULL, c, code, pixels);
                     pixels += code;
                 }
             }
@@ -227,6 +254,8 @@ static int init_image(TiffContext *s)
     case 11:
         s->avctx->pix_fmt = PIX_FMT_MONOBLACK;
         break;
+    case 21:
+    case 41:
     case 81:
         s->avctx->pix_fmt = PIX_FMT_PAL8;
         break;
@@ -265,8 +294,8 @@ static int init_image(TiffContext *s)
         } else {
             /* make default grayscale pal */
             pal = (uint32_t *) s->picture.data[1];
-            for (i = 0; i < 256; i++)
-                pal[i] = i * 0x010101;
+            for (i = 0; i < 1<<s->bpp; i++)
+                pal[i] = i * 255 / ((1<<s->bpp) - 1) * 0x010101;
         }
     }
     return 0;
@@ -586,7 +615,7 @@ static int decode_frame(AVCodecContext *avctx,
         src = s->picture.data[0];
         for(j = 0; j < s->height; j++){
             for(i = 0; i < s->picture.linesize[0]; i++)
-                src[i] = 255 - src[i];
+                src[i] = (s->avctx->pix_fmt == PIX_FMT_PAL8 ? (1<<s->bpp) - 1 : 255) - src[i];
             src += s->picture.linesize[0];
         }
     }
@@ -621,15 +650,13 @@ static av_cold int tiff_end(AVCodecContext *avctx)
 }
 
 AVCodec ff_tiff_decoder = {
-    "tiff",
-    AVMEDIA_TYPE_VIDEO,
-    CODEC_ID_TIFF,
-    sizeof(TiffContext),
-    tiff_init,
-    NULL,
-    tiff_end,
-    decode_frame,
-    CODEC_CAP_DR1,
-    NULL,
+    .name           = "tiff",
+    .type           = AVMEDIA_TYPE_VIDEO,
+    .id             = CODEC_ID_TIFF,
+    .priv_data_size = sizeof(TiffContext),
+    .init           = tiff_init,
+    .close          = tiff_end,
+    .decode         = decode_frame,
+    .capabilities   = CODEC_CAP_DR1,
     .long_name = NULL_IF_CONFIG_SMALL("TIFF image"),
 };