Merge remote-tracking branch 'qatar/master'

[ffmpeg] / libavformat / icodec.c

diff --git a/libavformat/icodec.c b/libavformat/icodec.c
index e539b02464345755a60f90c189f2f5658461e60b..eab047821138581afca6aeefbff66fc481b12bc3 100644 (file)
--- a/libavformat/icodec.c
+++ b/libavformat/icodec.c
@@ -64,6 +64,7 @@ static int read_header(AVFormatContext *s, AVFormatParameters *ap)
 
     for (i = 0; i < ico->nb_images; i++) {
         AVStream *st;
+        int tmp;
 
         if (avio_seek(pb, 6 + i * 16, SEEK_SET) < 0)
             break;
@@ -76,11 +77,10 @@ static int read_header(AVFormatContext *s, AVFormatParameters *ap)
         st->codec->width      = avio_r8(pb);
         st->codec->height     = avio_r8(pb);
         ico->images[i].nb_pal = avio_r8(pb);
+        if (ico->images[i].nb_pal == 255)
+            ico->images[i].nb_pal = 0;
 
-        avio_skip(pb, 3);
-        st->codec->bits_per_coded_sample = avio_rl16(pb);
-        if (st->codec->bits_per_coded_sample <= 8 && !ico->images[i].nb_pal)
-            ico->images[i].nb_pal = 1 << st->codec->bits_per_coded_sample;
+        avio_skip(pb, 5);
 
         ico->images[i].size   = avio_rl32(pb);
         ico->images[i].offset = avio_rl32(pb);
@@ -95,11 +95,15 @@ static int read_header(AVFormatContext *s, AVFormatParameters *ap)
             st->codec->height   = 0;
             break;
         case 40:
+            if (ico->images[i].size < 40)
+                return AVERROR_INVALIDDATA;
             st->codec->codec_id = CODEC_ID_BMP;
-            if (!st->codec->width || !st->codec->height) {
-                st->codec->width  = avio_rl32(pb);
-                st->codec->height = avio_rl32(pb) / 2;
-            }
+            tmp = avio_rl32(pb);
+            if (tmp)
+                st->codec->width = tmp;
+            tmp = avio_rl32(pb);
+            if (tmp)
+                st->codec->height = tmp / 2;
             break;
         default:
             av_log_ask_for_sample(s, "unsupported codec\n");
@@ -115,6 +119,7 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt)
     IcoDemuxContext *ico = s->priv_data;
     IcoImage *image;
     AVIOContext *pb = s->pb;
+    AVStream *st = s->streams[0];
     int ret;
 
     if (ico->current_image >= ico->nb_images)
@@ -140,13 +145,23 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt)
         bytestream_put_le32(&buf, pkt->size);
         bytestream_put_le16(&buf, 0);
         bytestream_put_le16(&buf, 0);
-        bytestream_put_le32(&buf, 14 + 40 + image->nb_pal * 4);
+        bytestream_put_le32(&buf, 0);
 
         if ((ret = avio_read(pb, buf, image->size)) < 0)
             return ret;
 
+        st->codec->bits_per_coded_sample = AV_RL16(buf + 14);
+
+        if (AV_RL32(buf + 32))
+            image->nb_pal = AV_RL32(buf + 32);
+
+        if (st->codec->bits_per_coded_sample <= 8 && !image->nb_pal) {
+            image->nb_pal = 1 << st->codec->bits_per_coded_sample;
+            AV_WL32(buf + 32, image->nb_pal);
+        }
+
+        AV_WL32(buf - 4, 14 + 40 + image->nb_pal * 4);
         AV_WL32(buf + 8, AV_RL32(buf + 8) / 2);
-        AV_WL32(buf + 32, image->nb_pal);
     }
 
     pkt->stream_index = ico->current_image++;