fix possible overflow with memmove

[ffmpeg] / libavcodec / vp3.c

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 593e7a4c845eed4ddb4ae20c89f0420feb113c08..eade1eb3cf7b949743aa2be5da76ca0a6c9afa20 100644 (file)
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -273,7 +273,7 @@ typedef struct Vp3DecodeContext {
      * which of the fragments are coded */
     int *coded_fragment_list;
     int coded_fragment_list_index;
-    int pixel_addresses_inited;
+    int pixel_addresses_initialized;
 
     VLC dc_vlc[16];
     VLC ac_vlc_1[16];
@@ -473,7 +473,7 @@ static int init_block_mapping(Vp3DecodeContext *s)
     current_width = -1;
     current_height = 0;
     superblock_row_inc = s->macroblock_width -
-        (s->y_superblock_width * 2 - s->macroblock_width);;
+        (s->y_superblock_width * 2 - s->macroblock_width);
     hilbert = hilbert_walk_mb;
     mapping_index = 0;
     current_macroblock = -1;
@@ -686,7 +686,7 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
     } else {
 
         /* unpack the list of partially-coded superblocks */
-        bit = get_bits(gb, 1);
+        bit = get_bits1(gb);
         /* toggle the bit because as soon as the first run length is
          * fetched the bit will be toggled again */
         bit ^= 1;
@@ -722,7 +722,7 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
 
             current_superblock = 0;
             current_run = 0;
-            bit = get_bits(gb, 1);
+            bit = get_bits1(gb);
             /* toggle the bit because as soon as the first run length is
              * fetched the bit will be toggled again */
             bit ^= 1;
@@ -753,7 +753,7 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
         if (decode_partial_blocks) {
 
             current_run = 0;
-            bit = get_bits(gb, 1);
+            bit = get_bits1(gb);
             /* toggle the bit because as soon as the first run length is
              * fetched the bit will be toggled again */
             bit ^= 1;
@@ -979,7 +979,7 @@ static int unpack_vectors(Vp3DecodeContext *s, GetBitContext *gb)
         memset(motion_y, 0, 6 * sizeof(int));
 
         /* coding mode 0 is the VLC scheme; 1 is the fixed code scheme */
-        coding_mode = get_bits(gb, 1);
+        coding_mode = get_bits1(gb);
         debug_vectors("    using %s scheme for unpacking motion vectors\n",
             (coding_mode == 0) ? "VLC" : "fixed-length");
 
@@ -2009,7 +2009,7 @@ static int vp3_decode_init(AVCodecContext *avctx)
     s->all_fragments = av_malloc(s->fragment_count * sizeof(Vp3Fragment));
     s->coeffs = av_malloc(s->fragment_count * sizeof(Coeff) * 65);
     s->coded_fragment_list = av_malloc(s->fragment_count * sizeof(int));
-    s->pixel_addresses_inited = 0;
+    s->pixel_addresses_initialized = 0;
 
     if (!s->theora_tables)
     {
@@ -2126,7 +2126,7 @@ static int vp3_decode_init(AVCodecContext *avctx)
  */
 static int vp3_decode_frame(AVCodecContext *avctx,
                             void *data, int *data_size,
-                            uint8_t *buf, int buf_size)
+                            const uint8_t *buf, int buf_size)
 {
     Vp3DecodeContext *s = avctx->priv_data;
     GetBitContext gb;
@@ -2203,18 +2203,18 @@ static int vp3_decode_frame(AVCodecContext *avctx,
         s->current_frame= s->golden_frame;
 
         /* time to figure out pixel addresses? */
-        if (!s->pixel_addresses_inited)
+        if (!s->pixel_addresses_initialized)
         {
             if (!s->flipped_image)
                 vp3_calculate_pixel_addresses(s);
             else
                 theora_calculate_pixel_addresses(s);
-            s->pixel_addresses_inited = 1;
+            s->pixel_addresses_initialized = 1;
         }
     } else {
         /* allocate a new current frame */
         s->current_frame.reference = 3;
-        if (!s->pixel_addresses_inited) {
+        if (!s->pixel_addresses_initialized) {
             av_log(s->avctx, AV_LOG_ERROR, "vp3: first frame not a keyframe\n");
             return -1;
         }
@@ -2313,7 +2313,9 @@ if (!s->keyframe) {
 static int vp3_decode_end(AVCodecContext *avctx)
 {
     Vp3DecodeContext *s = avctx->priv_data;
+    int i;
 
+    av_free(s->superblock_coding);
     av_free(s->all_fragments);
     av_free(s->coeffs);
     av_free(s->coded_fragment_list);
@@ -2322,6 +2324,19 @@ static int vp3_decode_end(AVCodecContext *avctx)
     av_free(s->macroblock_fragments);
     av_free(s->macroblock_coding);
 
+    for (i = 0; i < 16; i++) {
+        free_vlc(&s->dc_vlc[i]);
+        free_vlc(&s->ac_vlc_1[i]);
+        free_vlc(&s->ac_vlc_2[i]);
+        free_vlc(&s->ac_vlc_3[i]);
+        free_vlc(&s->ac_vlc_4[i]);
+    }
+
+    free_vlc(&s->superblock_run_length_vlc);
+    free_vlc(&s->fragment_run_length_vlc);
+    free_vlc(&s->mode_code_vlc);
+    free_vlc(&s->motion_vector_vlc);
+
     /* release all frames */
     if (s->golden_frame.data[0] && s->golden_frame.data[0] != s->last_frame.data[0])
         avctx->release_buffer(avctx, &s->golden_frame);
@@ -2337,7 +2352,7 @@ static int read_huffman_tree(AVCodecContext *avctx, GetBitContext *gb)
 {
     Vp3DecodeContext *s = avctx->priv_data;
 
-    if (get_bits(gb, 1)) {
+    if (get_bits1(gb)) {
         int token;
         if (s->entries >= 32) { /* overflow */
             av_log(avctx, AV_LOG_ERROR, "huffman tree overflow\n");
@@ -2372,7 +2387,7 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
     int visible_width, visible_height;
 
     s->theora = get_bits_long(gb, 24);
-    av_log(avctx, AV_LOG_INFO, "Theora bitstream version %X\n", s->theora);
+    av_log(avctx, AV_LOG_DEBUG, "Theora bitstream version %X\n", s->theora);
 
     /* 3.2.0 aka alpha3 has the same frame orientation as original vp3 */
     /* but previous versions have the image flipped relative to vp3 */
@@ -2488,10 +2503,10 @@ static int theora_decode_tables(AVCodecContext *avctx, GetBitContext *gb)
         for (plane = 0; plane <= 2; plane++) {
             int newqr= 1;
             if (inter || plane > 0)
-                newqr = get_bits(gb, 1);
+                newqr = get_bits1(gb);
             if (!newqr) {
                 int qtj, plj;
-                if(inter && get_bits(gb, 1)){
+                if(inter && get_bits1(gb)){
                     qtj = 0;
                     plj = plane;
                 }else{
@@ -2532,7 +2547,7 @@ static int theora_decode_tables(AVCodecContext *avctx, GetBitContext *gb)
     for (s->hti = 0; s->hti < 80; s->hti++) {
         s->entries = 0;
         s->huff_code_size = 1;
-        if (!get_bits(gb, 1)) {
+        if (!get_bits1(gb)) {
             s->hbits = 0;
             read_huffman_tree(avctx, gb);
             s->hbits = 1;