h264: fix invalid pointer arithmetic

[ffmpeg] / libavcodec / zerocodec.c

diff --git a/libavcodec/zerocodec.c b/libavcodec/zerocodec.c
index 3bf1fd93f46e37846b52bfa374b7ef8738a84a06..c6a9ba94a2d55f7fba64d8e80c859078c29f371a 100644 (file)
--- a/libavcodec/zerocodec.c
+++ b/libavcodec/zerocodec.c
@@ -19,11 +19,12 @@
 #include <zlib.h>
 
 #include "avcodec.h"
+#include "libavutil/common.h"
 
 typedef struct {
     AVFrame  previous_frame;
     z_stream zstream;
-    int size;
+    int      size;
 } ZeroCodecContext;
 
 static int zerocodec_decode_frame(AVCodecContext *avctx, void *data,
@@ -33,90 +34,76 @@ static int zerocodec_decode_frame(AVCodecContext *avctx, void *data,
     AVFrame *pic         = avctx->coded_frame;
     AVFrame *prev_pic    = &zc->previous_frame;
     z_stream *zstream    = &zc->zstream;
-    uint8_t *prev, *dst;
+    uint8_t *prev        = prev_pic->data[0];
+    uint8_t *dst;
     int i, j, zret;
 
     pic->reference = 3;
 
-    if (avctx->get_buffer(avctx, pic) < 0) {
-        av_log(avctx, AV_LOG_ERROR, "Could not allocate buffer.\n");
-        return AVERROR(ENOMEM);
+    if (avpkt->flags & AV_PKT_FLAG_KEY) {
+        pic->key_frame = 1;
+        pic->pict_type = AV_PICTURE_TYPE_I;
+    } else {
+        if (!prev) {
+            av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n");
+            return AVERROR_INVALIDDATA;
+        }
+        pic->key_frame = 0;
+        pic->pict_type = AV_PICTURE_TYPE_P;
     }
 
     zret = inflateReset(zstream);
-
     if (zret != Z_OK) {
-        av_log(avctx, AV_LOG_ERROR, "Could not reset inflate: %d\n", zret);
-        return AVERROR(EINVAL);
+        av_log(avctx, AV_LOG_ERROR, "Could not reset inflate: %d.\n", zret);
+        return AVERROR_INVALIDDATA;
+    }
+
+    if (avctx->get_buffer(avctx, pic) < 0) {
+        av_log(avctx, AV_LOG_ERROR, "Could not allocate buffer.\n");
+        return AVERROR(ENOMEM);
     }
 
     zstream->next_in  = avpkt->data;
     zstream->avail_in = avpkt->size;
 
-    prev = prev_pic->data[0];
-    dst  = pic->data[0];
+    dst = pic->data[0];
 
     /**
      * ZeroCodec has very simple interframe compression. If a value
      * is the same as the previous frame, set it to 0.
      */
 
-    if (avpkt->flags & AV_PKT_FLAG_KEY) {
+    for (i = 0; i < avctx->height; i++) {
+        zstream->next_out  = dst;
+        zstream->avail_out = avctx->width << 1;
 
-        pic->key_frame = 1;
-        pic->pict_type = AV_PICTURE_TYPE_I;
-
-        for (i = 0; i < avctx->height; i++) {
-
-            zstream->next_out  = dst;
-            zstream->avail_out = avctx->width << 1;
-
-            zret = inflate(zstream, Z_SYNC_FLUSH);
-
-            if (zret != Z_OK && zret != Z_STREAM_END) {
-                av_log(avctx, AV_LOG_ERROR,
-                       "Inflate failed with return code: %d\n", zret);
-                return AVERROR(EINVAL);
-            }
-
-            dst += pic->linesize[0];
+        zret = inflate(zstream, Z_SYNC_FLUSH);
+        if (zret != Z_OK && zret != Z_STREAM_END) {
+            avctx->release_buffer(avctx, pic);
+            av_log(avctx, AV_LOG_ERROR,
+                   "Inflate failed with return code: %d.\n", zret);
+            return AVERROR_INVALIDDATA;
         }
-    } else {
-
-        pic->key_frame = 0;
-        pic->pict_type = AV_PICTURE_TYPE_P;
-
-        for (i = 0; i < avctx->height; i++) {
-
-            zstream->next_out  = dst;
-            zstream->avail_out = avctx->width << 1;
-
-            zret = inflate(zstream, Z_SYNC_FLUSH);
-
-            if (zret != Z_OK && zret != Z_STREAM_END) {
-                av_log(avctx, AV_LOG_ERROR,
-                       "Inflate failed with return code: %d\n", zret);
-                return AVERROR(EINVAL);
-            }
 
+        if (!(avpkt->flags & AV_PKT_FLAG_KEY))
             for (j = 0; j < avctx->width << 1; j++)
                 dst[j] += prev[j] & -!dst[j];
 
-            prev += prev_pic->linesize[0];
-            dst  += pic->linesize[0];
-        }
+        prev += prev_pic->linesize[0];
+        dst  += pic->linesize[0];
     }
 
     /* Release the previous buffer if need be */
     if (prev_pic->data[0])
         avctx->release_buffer(avctx, prev_pic);
 
-    /* Store the previouse frame for use later */
-    *prev_pic = *pic;
-
     *data_size       = sizeof(AVFrame);
     *(AVFrame *)data = *pic;
 
+    /* Store the previous frame for use later.
+     * FFSWAP ensures that e.g. pic->data is NULLed. */
+    FFSWAP(AVFrame, *pic, *prev_pic);
+
     return avpkt->size;
 }
 
@@ -142,7 +129,7 @@ static av_cold int zerocodec_decode_init(AVCodecContext *avctx)
     z_stream *zstream    = &zc->zstream;
     int zret;
 
-    avctx->pix_fmt             = PIX_FMT_UYVY422;
+    avctx->pix_fmt             = AV_PIX_FMT_UYVY422;
     avctx->bits_per_raw_sample = 8;
 
     zc->size = avpicture_get_size(avctx->pix_fmt,
@@ -153,14 +140,12 @@ static av_cold int zerocodec_decode_init(AVCodecContext *avctx)
     zstream->opaque = Z_NULL;
 
     zret = inflateInit(zstream);
-
     if (zret != Z_OK) {
-        av_log(avctx, AV_LOG_ERROR, "Could not initialize inflate: %d\n", zret);
+        av_log(avctx, AV_LOG_ERROR, "Could not initialize inflate: %d.\n", zret);
         return AVERROR(ENOMEM);
     }
 
     avctx->coded_frame = avcodec_alloc_frame();
-
     if (!avctx->coded_frame) {
         av_log(avctx, AV_LOG_ERROR, "Could not allocate frame buffer.\n");
         zerocodec_decode_close(avctx);
@@ -173,7 +158,7 @@ static av_cold int zerocodec_decode_init(AVCodecContext *avctx)
 AVCodec ff_zerocodec_decoder = {
     .type           = AVMEDIA_TYPE_VIDEO,
     .name           = "zerocodec",
-    .id             = CODEC_ID_ZEROCODEC,
+    .id             = AV_CODEC_ID_ZEROCODEC,
     .priv_data_size = sizeof(ZeroCodecContext),
     .init           = zerocodec_decode_init,
     .decode         = zerocodec_decode_frame,