opus: Fix typo causing overflow in silk_stabilize_lsf

[ffmpeg] / libavcodec / truemotion1.c

diff --git a/libavcodec/truemotion1.c b/libavcodec/truemotion1.c
index c1a39c2166a85e87a4998c95c1ba7a4003654fac..3eab33aa290ad29bcecf617b69d7115f57373656 100644 (file)
--- a/libavcodec/truemotion1.c
+++ b/libavcodec/truemotion1.c
@@ -323,6 +323,11 @@ static int truemotion1_decode_header(TrueMotion1Context *s)
         return AVERROR_INVALIDDATA;
     }
 
+    if (header.header_size + 1 > s->size) {
+        av_log(s->avctx, AV_LOG_ERROR, "Input packet too small.\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     /* unscramble the header bytes with a XOR operation */
     for (i = 1; i < header.header_size; i++)
         header_buffer[i - 1] = s->buf[i] ^ s->buf[i + 1];
@@ -407,6 +412,8 @@ static int truemotion1_decode_header(TrueMotion1Context *s)
         if ((ret = ff_set_dimensions(s->avctx, s->w, s->h)) < 0)
             return ret;
 
+        ff_set_sar(s->avctx, s->avctx->sample_aspect_ratio);
+
         av_fast_malloc(&s->vert_pred, &s->vert_pred_size, s->avctx->width * sizeof(unsigned int));
     }
 
@@ -515,6 +522,15 @@ hres,vres,i,i%vres (0 < i < 4)
     index = s->index_stream[index_stream_index++] * 4; \
 }
 
+#define INC_INDEX                                                   \
+do {                                                                \
+    if (index >= 1023) {                                            \
+        av_log(s->avctx, AV_LOG_ERROR, "Invalid index value.\n");   \
+        return;                                                     \
+    }                                                               \
+    index++;                                                        \
+} while (0)
+
 #define APPLY_C_PREDICTOR() \
     predictor_pair = s->c_predictor_table[index]; \
     horiz_pred += (predictor_pair >> 1); \
@@ -527,10 +543,10 @@ hres,vres,i,i%vres (0 < i < 4)
             if (predictor_pair & 1) \
                 GET_NEXT_INDEX() \
             else \
-                index++; \
+                INC_INDEX; \
         } \
     } else \
-        index++;
+        INC_INDEX;
 
 #define APPLY_C_PREDICTOR_24() \
     predictor_pair = s->c_predictor_table[index]; \
@@ -544,10 +560,10 @@ hres,vres,i,i%vres (0 < i < 4)
             if (predictor_pair & 1) \
                 GET_NEXT_INDEX() \
             else \
-                index++; \
+                INC_INDEX; \
         } \
     } else \
-        index++;
+        INC_INDEX;
 
 
 #define APPLY_Y_PREDICTOR() \
@@ -562,10 +578,10 @@ hres,vres,i,i%vres (0 < i < 4)
             if (predictor_pair & 1) \
                 GET_NEXT_INDEX() \
             else \
-                index++; \
+                INC_INDEX; \
         } \
     } else \
-        index++;
+        INC_INDEX;
 
 #define APPLY_Y_PREDICTOR_24() \
     predictor_pair = s->y_predictor_table[index]; \
@@ -579,10 +595,10 @@ hres,vres,i,i%vres (0 < i < 4)
             if (predictor_pair & 1) \
                 GET_NEXT_INDEX() \
             else \
-                index++; \
+                INC_INDEX; \
         } \
     } else \
-        index++;
+        INC_INDEX;
 
 #define OUTPUT_PIXEL_PAIR() \
     *current_pixel_pair = *vert_pred + horiz_pred; \
@@ -894,5 +910,5 @@ AVCodec ff_truemotion1_decoder = {
     .init           = truemotion1_decode_init,
     .close          = truemotion1_decode_end,
     .decode         = truemotion1_decode_frame,
-    .capabilities   = CODEC_CAP_DR1,
+    .capabilities   = AV_CODEC_CAP_DR1,
 };