Merge remote-tracking branch 'qatar/master'

[ffmpeg] / libavcodec / txd.c

diff --git a/libavcodec/txd.c b/libavcodec/txd.c
index c05cc8e2481231d75eb024251ba41d39305dbf11..344187d7da176991d9c545168b95dad7a27db053 100644 (file)
--- a/libavcodec/txd.c
+++ b/libavcodec/txd.c
@@ -4,25 +4,26 @@
  *
  * See also: http://wiki.multimedia.cx/index.php?title=TXD
  *
- * This file is part of Libav.
+ * This file is part of FFmpeg.
  *
- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
 #include "libavutil/intreadwrite.h"
 #include "libavutil/imgutils.h"
+#include "bytestream.h"
 #include "avcodec.h"
 #include "bytestream.h"
 #include "s3tc.h"
@@ -46,7 +47,8 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     GetByteContext gb;
     AVFrame *picture = data;
     AVFrame * const p = &s->picture;
-    unsigned int version, w, h, d3d_format, depth, stride, mipmap_count, flags;
+    unsigned int version, w, h, d3d_format, depth, stride, flags;
+    unsigned int av_unused mipmap_count;
     unsigned int y, v;
     uint8_t *ptr;
     uint32_t *pal;
@@ -100,6 +102,8 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
             v = bytestream2_get_be32(&gb);
             pal[y] = (v >> 8) + (v << 24);
         }
+        if (bytestream2_get_bytes_left(&gb) < w * h)
+            return AVERROR_INVALIDDATA;
         bytestream2_skip(&gb, 4);
         for (y=0; y<h; y++) {
             bytestream2_get_buffer(&gb, ptr, w);
@@ -112,9 +116,13 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
             if (!(flags & 1))
                 goto unsupported;
         case FF_S3TC_DXT1:
+            if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 8)
+                return AVERROR_INVALIDDATA;
             ff_decode_dxt1(&gb, ptr, w, h, stride);
             break;
         case FF_S3TC_DXT3:
+            if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 16)
+                return AVERROR_INVALIDDATA;
             ff_decode_dxt3(&gb, ptr, w, h, stride);
             break;
         default:
@@ -124,6 +132,8 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
         switch (d3d_format) {
         case 0x15:
         case 0x16:
+            if (bytestream2_get_bytes_left(&gb) < h * w * 4)
+                return AVERROR_INVALIDDATA;
             for (y=0; y<h; y++) {
                 bytestream2_get_buffer(&gb, ptr, w * 4);
                 ptr += stride;
@@ -162,5 +172,5 @@ AVCodec ff_txd_decoder = {
     .close          = txd_end,
     .decode         = txd_decode_frame,
     .capabilities   = CODEC_CAP_DR1,
-    .long_name = NULL_IF_CONFIG_SMALL("Renderware TXD (TeXture Dictionary) image"),
+    .long_name      = NULL_IF_CONFIG_SMALL("Renderware TXD (TeXture Dictionary) image"),
 };