AVFrame *pic;
GetBitContext gb;
+ int error;
BswapDSPContext bdsp;
uint8_t *buffer;
}
}
} else {
+ if (len < 0) {
+ ret = AVERROR_INVALIDDATA;
+ goto end;
+ }
for (i = 0; i < toks; i++) {
ctx->tokens[stream_id][i] = codes.recode[0];
if (stream_id <= TM2_MOT && ctx->tokens[stream_id][i] >= TM2_DELTAS) {
{
if (ctx->tok_ptrs[type] >= ctx->tok_lens[type]) {
av_log(ctx->avctx, AV_LOG_ERROR, "Read token from stream %i out of bounds (%i>=%i)\n", type, ctx->tok_ptrs[type], ctx->tok_lens[type]);
+ ctx->error = 1;
return 0;
}
if (type <= TM2_MOT) {
/* common operations - add deltas to 4x4 block of luma or 2x2 blocks of chroma */
static inline void tm2_apply_deltas(TM2Context *ctx, int* Y, int stride, int *deltas, int *last)
{
- int ct, d;
+ unsigned ct, d;
int i, j;
for (j = 0; j < 4; j++){
default:
av_log(ctx->avctx, AV_LOG_ERROR, "Skipping unknown block type %i\n", type);
}
+ if (ctx->error)
+ return AVERROR_INVALIDDATA;
}
}
int offset = TM2_HEADER_SIZE;
int i, t, ret;
+ l->error = 0;
+
av_fast_padded_malloc(&l->buffer, &l->buffer_size, buf_size);
if (!l->buffer) {
av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer\n");