ac3: detect dba errors and prevent writing past end of array

[ffmpeg] / libavcodec / txd.c

diff --git a/libavcodec/txd.c b/libavcodec/txd.c
index 9c60b4c03fece850fcd113b35644a1e93833050a..284b00d2dec95fe4df05c5dce51b45bc299ac9df 100644 (file)
--- a/libavcodec/txd.c
+++ b/libavcodec/txd.c
@@ -28,25 +28,26 @@ typedef struct TXDContext {
     AVFrame picture;
 } TXDContext;
 
-static int txd_init(AVCodecContext *avctx) {
+static av_cold int txd_init(AVCodecContext *avctx) {
     TXDContext *s = avctx->priv_data;
 
     avcodec_get_frame_defaults(&s->picture);
     avctx->coded_frame = &s->picture;
-    s->picture.data[0] = NULL;
 
     return 0;
 }
 
 static int txd_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
-                            uint8_t *buf, int buf_size) {
+                            const uint8_t *buf, int buf_size) {
     TXDContext * const s = avctx->priv_data;
     AVFrame *picture = data;
     AVFrame * const p = &s->picture;
     unsigned int version, w, h, d3d_format, depth, stride, mipmap_count, flags;
     unsigned int y, v;
-    uint8_t *ptr, *cur = buf;
-    uint32_t *palette = (uint32_t *)(cur + 88), *pal;
+    uint8_t *ptr;
+    const uint8_t *cur = buf;
+    const uint32_t *palette = (const uint32_t *)(cur + 88);
+    uint32_t *pal;
 
     version         = AV_RL32(cur);
     d3d_format      = AV_RL32(cur+76);
@@ -142,7 +143,7 @@ unsupported:
     return -1;
 }
 
-static int txd_end(AVCodecContext *avctx) {
+static av_cold int txd_end(AVCodecContext *avctx) {
     TXDContext *s = avctx->priv_data;
 
     if (s->picture.data[0])
@@ -161,5 +162,6 @@ AVCodec txd_decoder = {
     txd_end,
     txd_decode_frame,
     0,
-    NULL
+    NULL,
+    .long_name = NULL_IF_CONFIG_SMALL("Renderware TXD (TeXture Dictionary) image"),
 };