h264: fix invalid pointer arithmetic

[ffmpeg] / libavcodec / xsubdec.c

diff --git a/libavcodec/xsubdec.c b/libavcodec/xsubdec.c
index 3838722c1ff923c206557809a828aad08effcc47..11e1d57fed86dfea66c48a907ddf7f5f214ca6d2 100644 (file)
--- a/libavcodec/xsubdec.c
+++ b/libavcodec/xsubdec.c
@@ -2,28 +2,31 @@
  * XSUB subtitle decoder
  * Copyright (c) 2007 Reimar Döffinger
  *
- * This file is part of FFmpeg.
+ * This file is part of Libav.
  *
- * FFmpeg is free software; you can redistribute it and/or
+ * Libav is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * FFmpeg is distributed in the hope that it will be useful,
+ * Libav is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with FFmpeg; if not, write to the Free Software
+ * License along with Libav; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
+
+#include "libavutil/mathematics.h"
+#include "libavutil/imgutils.h"
 #include "avcodec.h"
 #include "get_bits.h"
 #include "bytestream.h"
 
 static av_cold int decode_init(AVCodecContext *avctx) {
-    avctx->pix_fmt = PIX_FMT_PAL8;
+    avctx->pix_fmt = AV_PIX_FMT_PAL8;
     return 0;
 }
 
@@ -50,7 +53,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     AVSubtitle *sub = data;
     const uint8_t *buf_end = buf + buf_size;
     uint8_t *bitmap;
-    int w, h, x, y, rlelen, i;
+    int w, h, x, y, i;
     int64_t packet_time = 0;
     GetBitContext gb;
 
@@ -76,14 +79,18 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     // read header
     w = bytestream_get_le16(&buf);
     h = bytestream_get_le16(&buf);
-    if (avcodec_check_dimensions(avctx, w, h) < 0)
+    if (av_image_check_size(w, h, 0, avctx) < 0)
         return -1;
     x = bytestream_get_le16(&buf);
     y = bytestream_get_le16(&buf);
     // skip bottom right position, it gives no new information
     bytestream_get_le16(&buf);
     bytestream_get_le16(&buf);
-    rlelen = bytestream_get_le16(&buf);
+    // The following value is supposed to indicate the start offset
+    // (relative to the palette) of the data for the second field,
+    // however there are files in which it has a bogus value and thus
+    // we just ignore it
+    bytestream_get_le16(&buf);
 
     // allocate sub and set values
     sub->rects =  av_mallocz(sizeof(*sub->rects));
@@ -95,7 +102,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     sub->rects[0]->pict.linesize[0] = w;
     sub->rects[0]->pict.data[0] = av_malloc(w * h);
     sub->rects[0]->nb_colors = 4;
-    sub->rects[0]->pict.data[1] = av_malloc(sub->rects[0]->nb_colors * 4);
+    sub->rects[0]->pict.data[1] = av_mallocz(AVPALETTE_SIZE);
 
     // read palette
     for (i = 0; i < sub->rects[0]->nb_colors; i++)
@@ -105,8 +112,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
         ((uint32_t*)sub->rects[0]->pict.data[1])[i] |= 0xff000000;
 
     // process RLE-compressed data
-    rlelen = FFMIN(rlelen, buf_end - buf);
-    init_get_bits(&gb, buf, rlelen * 8);
+    init_get_bits(&gb, buf, (buf_end - buf) * 8);
     bitmap = sub->rects[0]->pict.data[0];
     for (y = 0; y < h; y++) {
         // interlaced: do odd lines
@@ -130,14 +136,11 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     return buf_size;
 }
 
-AVCodec xsub_decoder = {
-    "xsub",
-    CODEC_TYPE_SUBTITLE,
-    CODEC_ID_XSUB,
-    0,
-    decode_init,
-    NULL,
-    NULL,
-    decode_frame,
+AVCodec ff_xsub_decoder = {
+    .name      = "xsub",
+    .type      = AVMEDIA_TYPE_SUBTITLE,
+    .id        = AV_CODEC_ID_XSUB,
+    .init      = decode_init,
+    .decode    = decode_frame,
     .long_name = NULL_IF_CONFIG_SMALL("XSUB"),
 };