Prevent the qdm2 code from overreading/overflowing. Fixes Coverity ID 112 run 2

[ffmpeg] / libavcodec / vc1.c

diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c
index 77505db119710d337a07d62448e5ba158d483220..6edf746a2f829256790f7892f6b81ad9064fb455 100644 (file)
--- a/libavcodec/vc1.c
+++ b/libavcodec/vc1.c
@@ -783,8 +783,8 @@ static int decode_sequence_header(AVCodecContext *avctx, GetBitContext *gb)
     }
     else
     {
-        v->zz_8x4 = ff_vc1_simple_progressive_8x4_zz;
-        v->zz_4x8 = ff_vc1_simple_progressive_4x8_zz;
+        v->zz_8x4 = wmv2_scantableA;
+        v->zz_4x8 = wmv2_scantableB;
         v->res_sm = get_bits(gb, 2); //reserved
         if (v->res_sm)
         {
@@ -2398,11 +2398,11 @@ static int vc1_decode_i_block(VC1Context *v, DCTELEM block[64], int n, int coded
 
         if(v->s.ac_pred) {
             if(!dc_pred_dir)
-                zz_table = ff_vc1_horizontal_zz;
+                zz_table = wmv1_scantable[2];
             else
-                zz_table = ff_vc1_vertical_zz;
+                zz_table = wmv1_scantable[3];
         } else
-            zz_table = ff_vc1_normal_zz;
+            zz_table = wmv1_scantable[1];
 
         ac_val = s->ac_val[0][0] + s->block_index[n] * 16;
         ac_val2 = ac_val;
@@ -2581,11 +2581,11 @@ static int vc1_decode_i_block_adv(VC1Context *v, DCTELEM block[64], int n, int c
 
         if(v->s.ac_pred) {
             if(!dc_pred_dir)
-                zz_table = ff_vc1_horizontal_zz;
+                zz_table = wmv1_scantable[2];
             else
-                zz_table = ff_vc1_vertical_zz;
+                zz_table = wmv1_scantable[3];
         } else
-            zz_table = ff_vc1_normal_zz;
+            zz_table = wmv1_scantable[1];
 
         while (!last) {
             vc1_decode_ac_coeff(v, &last, &skip, &value, codingset);
@@ -2786,7 +2786,7 @@ static int vc1_decode_intra_block(VC1Context *v, DCTELEM block[64], int n, int c
         const int8_t *zz_table;
         int k;
 
-        zz_table = ff_vc1_simple_progressive_8x8_zz;
+        zz_table = wmv1_scantable[0];
 
         while (!last) {
             vc1_decode_ac_coeff(v, &last, &skip, &value, codingset);
@@ -2928,7 +2928,7 @@ static int vc1_decode_p_block(VC1Context *v, DCTELEM block[64], int n, int mquan
             i += skip;
             if(i > 63)
                 break;
-            idx = ff_vc1_simple_progressive_8x8_zz[i++];
+            idx = wmv1_scantable[0][i++];
             block[idx] = value * scale;
             if(!v->pquantizer)
                 block[idx] += (block[idx] < 0) ? -mquant : mquant;
@@ -3017,7 +3017,7 @@ static int vc1_decode_p_mb(VC1Context *v)
       offset_table[6] = { 0, 1, 3, 7, 15, 31 };
     int mb_has_coeffs = 1; /* last_flag */
     int dmv_x, dmv_y; /* Differential MV components */
-    int index, index1; /* LUT indices */
+    int index, index1; /* LUT indexes */
     int val, sign; /* temp values */
     int first_block = 1;
     int dst_idx, off;
@@ -3246,7 +3246,7 @@ static void vc1_decode_b_mb(VC1Context *v)
     static const int size_table[6] = { 0, 2, 3, 4, 5, 8 },
       offset_table[6] = { 0, 1, 3, 7, 15, 31 };
     int mb_has_coeffs = 0; /* last_flag */
-    int index, index1; /* LUT indices */
+    int index, index1; /* LUT indexes */
     int val, sign; /* temp values */
     int first_block = 1;
     int dst_idx, off;
@@ -3812,7 +3812,7 @@ static av_always_inline int vc1_unescape_buffer(const uint8_t *src, int size, ui
  * @todo TODO: Handle VC-1 IDUs (Transport level?)
  * @todo TODO: Decypher remaining bits in extra_data
  */
-static int vc1_decode_init(AVCodecContext *avctx)
+static av_cold int vc1_decode_init(AVCodecContext *avctx)
 {
     VC1Context *v = avctx->priv_data;
     MpegEncContext *s = &v->s;
@@ -4005,6 +4005,7 @@ static int vc1_decode_frame(AVCodecContext *avctx,
             divider = find_next_marker(buf, buf + buf_size);
             if((divider == (buf + buf_size)) || AV_RB32(divider) != VC1_CODE_FIELD){
                 av_log(avctx, AV_LOG_ERROR, "Error in WVC1 interlaced frame\n");
+                av_free(buf2);
                 return -1;
             }
 
@@ -4109,7 +4110,7 @@ assert(s->current_picture.pict_type == s->pict_type);
 /** Close a VC1/WMV3 decoder
  * @warning Initial try at using MpegEncContext stuff
  */
-static int vc1_decode_end(AVCodecContext *avctx)
+static av_cold int vc1_decode_end(AVCodecContext *avctx)
 {
     VC1Context *v = avctx->priv_data;
 
@@ -4136,7 +4137,8 @@ AVCodec vc1_decoder = {
     vc1_decode_end,
     vc1_decode_frame,
     CODEC_CAP_DELAY,
-    NULL
+    NULL,
+    .long_name = NULL_IF_CONFIG_SMALL("SMPTE VC-1"),
 };
 
 AVCodec wmv3_decoder = {
@@ -4149,5 +4151,6 @@ AVCodec wmv3_decoder = {
     vc1_decode_end,
     vc1_decode_frame,
     CODEC_CAP_DELAY,
-    NULL
+    NULL,
+    .long_name = NULL_IF_CONFIG_SMALL("Windows Media Video 9"),
 };