Add checks on input/output buffers size for some audio decoders

[ffmpeg] / libavcodec / vp3.c

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 0a5d7601355d5bc773ed464d13a06081dd3dc9a6..1bc4c39aed3534dfcca4f4d537fb1dedc65e804a 100644 (file)
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -16,7 +16,6 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- *
  */
 
 /**
@@ -35,7 +34,6 @@
 #include <string.h>
 #include <unistd.h>
 
-#include "common.h"
 #include "avcodec.h"
 #include "dsputil.h"
 #include "mpegvideo.h"
@@ -688,7 +686,7 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
     } else {
 
         /* unpack the list of partially-coded superblocks */
-        bit = get_bits(gb, 1);
+        bit = get_bits1(gb);
         /* toggle the bit because as soon as the first run length is
          * fetched the bit will be toggled again */
         bit ^= 1;
@@ -724,7 +722,7 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
 
             current_superblock = 0;
             current_run = 0;
-            bit = get_bits(gb, 1);
+            bit = get_bits1(gb);
             /* toggle the bit because as soon as the first run length is
              * fetched the bit will be toggled again */
             bit ^= 1;
@@ -755,7 +753,7 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
         if (decode_partial_blocks) {
 
             current_run = 0;
-            bit = get_bits(gb, 1);
+            bit = get_bits1(gb);
             /* toggle the bit because as soon as the first run length is
              * fetched the bit will be toggled again */
             bit ^= 1;
@@ -981,7 +979,7 @@ static int unpack_vectors(Vp3DecodeContext *s, GetBitContext *gb)
         memset(motion_y, 0, 6 * sizeof(int));
 
         /* coding mode 0 is the VLC scheme; 1 is the fixed code scheme */
-        coding_mode = get_bits(gb, 1);
+        coding_mode = get_bits1(gb);
         debug_vectors("    using %s scheme for unpacking motion vectors\n",
             (coding_mode == 0) ? "VLC" : "fixed-length");
 
@@ -2339,7 +2337,7 @@ static int read_huffman_tree(AVCodecContext *avctx, GetBitContext *gb)
 {
     Vp3DecodeContext *s = avctx->priv_data;
 
-    if (get_bits(gb, 1)) {
+    if (get_bits1(gb)) {
         int token;
         if (s->entries >= 32) { /* overflow */
             av_log(avctx, AV_LOG_ERROR, "huffman tree overflow\n");
@@ -2371,9 +2369,10 @@ static int read_huffman_tree(AVCodecContext *avctx, GetBitContext *gb)
 static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
 {
     Vp3DecodeContext *s = avctx->priv_data;
+    int visible_width, visible_height;
 
     s->theora = get_bits_long(gb, 24);
-    av_log(avctx, AV_LOG_INFO, "Theora bitstream version %X\n", s->theora);
+    av_log(avctx, AV_LOG_VERBOSE, "Theora bitstream version %X\n", s->theora);
 
     /* 3.2.0 aka alpha3 has the same frame orientation as original vp3 */
     /* but previous versions have the image flipped relative to vp3 */
@@ -2399,20 +2398,15 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
         skip_bits(gb, 32); /* total number of blocks in a frame */
         skip_bits(gb, 4); /* total number of blocks in a frame */
         skip_bits(gb, 32); /* total number of macroblocks in a frame */
-
-        skip_bits(gb, 24); /* frame width */
-        skip_bits(gb, 24); /* frame height */
-    }
-    else
-    {
-        skip_bits(gb, 24); /* frame width */
-        skip_bits(gb, 24); /* frame height */
     }
 
-  if (s->theora >= 0x030200) {
-    skip_bits(gb, 8); /* offset x */
-    skip_bits(gb, 8); /* offset y */
-  }
+    visible_width  = get_bits_long(gb, 24);
+    visible_height = get_bits_long(gb, 24);
+
+    if (s->theora >= 0x030200) {
+        skip_bits(gb, 8); /* offset x */
+        skip_bits(gb, 8); /* offset y */
+    }
 
     skip_bits(gb, 32); /* fps numerator */
     skip_bits(gb, 32); /* fps denumerator */
@@ -2438,8 +2432,11 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
 
 //    align_get_bits(gb);
 
-    avctx->width = s->width;
-    avctx->height = s->height;
+    if (   visible_width  <= s->width  && visible_width  > s->width-16
+        && visible_height <= s->height && visible_height > s->height-16)
+        avcodec_set_dimensions(avctx, visible_width, visible_height);
+    else
+        avcodec_set_dimensions(avctx, s->width, s->height);
 
     return 0;
 }
@@ -2491,10 +2488,10 @@ static int theora_decode_tables(AVCodecContext *avctx, GetBitContext *gb)
         for (plane = 0; plane <= 2; plane++) {
             int newqr= 1;
             if (inter || plane > 0)
-                newqr = get_bits(gb, 1);
+                newqr = get_bits1(gb);
             if (!newqr) {
                 int qtj, plj;
-                if(inter && get_bits(gb, 1)){
+                if(inter && get_bits1(gb)){
                     qtj = 0;
                     plj = plane;
                 }else{
@@ -2535,7 +2532,7 @@ static int theora_decode_tables(AVCodecContext *avctx, GetBitContext *gb)
     for (s->hti = 0; s->hti < 80; s->hti++) {
         s->entries = 0;
         s->huff_code_size = 1;
-        if (!get_bits(gb, 1)) {
+        if (!get_bits1(gb)) {
             s->hbits = 0;
             read_huffman_tree(avctx, gb);
             s->hbits = 1;