X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2F4xm.c;h=b248d87569ea370dae1e7b6f6a97ba9263d6b01f;hb=3a651f599a18b023602370b67a77eb0efa309b20;hp=2b8155cc8a569065eec336f98c4c9e689ef4a5ad;hpb=de2e5777e225e75813daf2373c95e223651fd89a;p=ffmpeg diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index 2b8155cc8a5..b248d87569e 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -24,11 +24,15 @@ * 4XM codec. */ +#include + #include "libavutil/frame.h" +#include "libavutil/imgutils.h" #include "libavutil/intreadwrite.h" #include "avcodec.h" +#include "blockdsp.h" +#include "bswapdsp.h" #include "bytestream.h" -#include "dsputil.h" #include "get_bits.h" #include "internal.h" @@ -128,8 +132,10 @@ typedef struct CFrameBuffer { typedef struct FourXContext { AVCodecContext *avctx; - DSPContext dsp; - AVFrame *last_picture; + BlockDSPContext bdsp; + BswapDSPContext bbdsp; + uint16_t *frame_buffer; + uint16_t *last_frame_buffer; GetBitContext pre_gb; ///< ac/dc prefix GetBitContext gb; GetByteContext g; @@ -334,52 +340,41 @@ static inline void mcdc(uint16_t *dst, uint16_t *src, int log2w, static int decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, int log2w, int log2h, int stride) { - const int index = size2index[log2h][log2w]; - const int h = 1 << log2h; - int code = get_vlc2(&f->gb, - block_type_vlc[1 - (f->version > 1)][index].table, - BLOCK_TYPE_VLC_BITS, 1); - uint16_t *start = (uint16_t *)f->last_picture->data[0]; - uint16_t *end = start + stride * (f->avctx->height - h + 1) - (1 << log2w); - int ret; + int index, h, code, ret, scale = 1; + uint16_t *start, *end; + unsigned dc = 0; - if (code < 0 || code > 6 || log2w < 0) + if (log2h < 0 || log2w < 0) return AVERROR_INVALIDDATA; - if (code == 0) { - src += f->mv[bytestream2_get_byte(&f->g)]; - if (start > src || src > end) { - av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n"); + index = size2index[log2h][log2w]; + if (index < 0) + return AVERROR_INVALIDDATA; + + h = 1 << log2h; + code = get_vlc2(&f->gb, block_type_vlc[1 - (f->version > 1)][index].table, + BLOCK_TYPE_VLC_BITS, 1); + if (code < 0 || code > 6) + return AVERROR_INVALIDDATA; + + start = f->last_frame_buffer; + end = start + stride * (f->avctx->height - h + 1) - (1 << log2w); + + if (code == 1) { + if (--log2h < 0) return AVERROR_INVALIDDATA; - } - mcdc(dst, src, log2w, h, stride, 1, 0); - } else if (code == 1) { - log2h--; if ((ret = decode_p_block(f, dst, src, log2w, log2h, stride)) < 0) return ret; - if ((ret = decode_p_block(f, dst + (stride << log2h), - src + (stride << log2h), - log2w, log2h, stride)) < 0) - return ret; + return decode_p_block(f, dst + (stride << log2h), + src + (stride << log2h), + log2w, log2h, stride); } else if (code == 2) { log2w--; if ((ret = decode_p_block(f, dst , src, log2w, log2h, stride)) < 0) return ret; - if ((ret = decode_p_block(f, dst + (1 << log2w), - src + (1 << log2w), - log2w, log2h, stride)) < 0) - return ret; - } else if (code == 3 && f->version < 2) { - mcdc(dst, src, log2w, h, stride, 1, 0); - } else if (code == 4) { - src += f->mv[bytestream2_get_byte(&f->g)]; - if (start > src || src > end) { - av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n"); - return AVERROR_INVALIDDATA; - } - mcdc(dst, src, log2w, h, stride, 1, bytestream2_get_le16(&f->g2)); - } else if (code == 5) { - mcdc(dst, src, log2w, h, stride, 0, bytestream2_get_le16(&f->g2)); + return decode_p_block(f, dst + (1 << log2w), + src + (1 << log2w), + log2w, log2h, stride); } else if (code == 6) { if (log2w) { dst[0] = bytestream2_get_le16(&f->g2); @@ -388,34 +383,43 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, dst[0] = bytestream2_get_le16(&f->g2); dst[stride] = bytestream2_get_le16(&f->g2); } + return 0; } + + if (code == 0) { + src += f->mv[bytestream2_get_byte(&f->g)]; + } else if (code == 3 && f->version >= 2) { + return 0; + } else if (code == 4) { + src += f->mv[bytestream2_get_byte(&f->g)]; + dc = bytestream2_get_le16(&f->g2); + } else if (code == 5) { + scale = 0; + dc = bytestream2_get_le16(&f->g2); + } + + if (start > src || src > end) { + av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n"); + return AVERROR_INVALIDDATA; + } + + mcdc(dst, src, log2w, h, stride, scale, dc); + return 0; } -static int decode_p_frame(FourXContext *f, AVFrame *frame, - const uint8_t *buf, int length) +static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length) { int x, y; const int width = f->avctx->width; const int height = f->avctx->height; - uint16_t *dst = (uint16_t *)frame->data[0]; - const int stride = frame->linesize[0] >> 1; + uint16_t *dst = f->frame_buffer; uint16_t *src; unsigned int bitstream_size, bytestream_size, wordstream_size, extra, bytestream_offset, wordstream_offset; int ret; - if (!f->last_picture->data[0]) { - if ((ret = ff_get_buffer(f->avctx, f->last_picture, - AV_GET_BUFFER_FLAG_REF)) < 0) { - av_log(f->avctx, AV_LOG_ERROR, "get_buffer() failed\n"); - return ret; - } - memset(f->last_picture->data[0], 0, - f->avctx->height * FFABS(f->last_picture->linesize[0])); - } - - src = (uint16_t *)f->last_picture->data[0]; + src = f->last_frame_buffer; if (f->version > 1) { if (length < 20) @@ -445,8 +449,8 @@ static int decode_p_frame(FourXContext *f, AVFrame *frame, bitstream_size + FF_INPUT_BUFFER_PADDING_SIZE); if (!f->bitstream_buffer) return AVERROR(ENOMEM); - f->dsp.bswap_buf(f->bitstream_buffer, (const uint32_t*)(buf + extra), - bitstream_size / 4); + f->bbdsp.bswap_buf(f->bitstream_buffer, (const uint32_t *) (buf + extra), + bitstream_size / 4); memset((uint8_t*)f->bitstream_buffer + bitstream_size, 0, FF_INPUT_BUFFER_PADDING_SIZE); init_get_bits(&f->gb, f->bitstream_buffer, 8 * bitstream_size); @@ -458,14 +462,14 @@ static int decode_p_frame(FourXContext *f, AVFrame *frame, bytestream2_init(&f->g, buf + bytestream_offset, length - bytestream_offset); - init_mv(f, frame->linesize[0]); + init_mv(f, width * 2); for (y = 0; y < height; y += 8) { for (x = 0; x < width; x += 8) - if ((ret = decode_p_block(f, dst + x, src + x, 3, 3, stride)) < 0) + if ((ret = decode_p_block(f, dst + x, src + x, 3, 3, width)) < 0) return ret; - src += 8 * stride; - dst += 8 * stride; + src += 8 * width; + dst += 8 * width; } return 0; @@ -518,12 +522,12 @@ static int decode_i_block(FourXContext *f, int16_t *block) return 0; } -static inline void idct_put(FourXContext *f, AVFrame *frame, int x, int y) +static inline void idct_put(FourXContext *f, int x, int y) { int16_t (*block)[64] = f->block; - int stride = frame->linesize[0] >> 1; + int stride = f->avctx->width; int i; - uint16_t *dst = ((uint16_t*)frame->data[0]) + y * stride + x; + uint16_t *dst = f->frame_buffer + y * stride + x; for (i = 0; i < 4; i++) { block[i][0] += 0x80 * 8 * 8; @@ -569,7 +573,7 @@ static int decode_i_mb(FourXContext *f) int ret; int i; - f->dsp.clear_blocks(f->block[0]); + f->bdsp.clear_blocks(f->block[0]); for (i = 0; i < 6; i++) if ((ret = decode_i_block(f, f->block[i])) < 0) @@ -579,7 +583,8 @@ static int decode_i_mb(FourXContext *f) } static const uint8_t *read_huffman_tables(FourXContext *f, - const uint8_t * const buf) + const uint8_t * const buf, + int len) { int frequency[512] = { 0 }; uint8_t flag[512]; @@ -597,12 +602,20 @@ static const uint8_t *read_huffman_tables(FourXContext *f, for (;;) { int i; + len -= end - start + 1; + + if (end < start || len < 0) + return NULL; + for (i = start; i <= end; i++) frequency[i] = *ptr++; start = *ptr++; if (start == 0) break; + if (--len < 0) + return NULL; + end = *ptr++; } frequency[256] = 1; @@ -671,14 +684,13 @@ static int mix(int c0, int c1) return red / 3 * 1024 + green / 3 * 32 + blue / 3; } -static int decode_i2_frame(FourXContext *f, AVFrame *frame, const uint8_t *buf, int length) +static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length) { int x, y, x2, y2; const int width = f->avctx->width; const int height = f->avctx->height; const int mbs = (FFALIGN(width, 16) >> 4) * (FFALIGN(height, 16) >> 4); - uint16_t *dst = (uint16_t*)frame->data[0]; - const int stride = frame->linesize[0]>>1; + uint16_t *dst = f->frame_buffer; GetByteContext g3; if (length < mbs * 8) { @@ -706,18 +718,18 @@ static int decode_i2_frame(FourXContext *f, AVFrame *frame, const uint8_t *buf, for (y2 = 0; y2 < 16; y2++) { for (x2 = 0; x2 < 16; x2++) { int index = 2 * (x2 >> 2) + 8 * (y2 >> 2); - dst[y2 * stride + x2] = color[(bits >> index) & 3]; + dst[y2 * width + x2] = color[(bits >> index) & 3]; } } dst += 16; } - dst += 16 * stride - x; + dst += 16 * width - x; } return 0; } -static int decode_i_frame(FourXContext *f, AVFrame *frame, const uint8_t *buf, int length) +static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length) { int x, y, ret; const int width = f->avctx->width; @@ -727,6 +739,9 @@ static int decode_i_frame(FourXContext *f, AVFrame *frame, const uint8_t *buf, i unsigned int prestream_size; const uint8_t *prestream; + if (bitstream_size > (1 << 26)) + return AVERROR_INVALIDDATA; + if (length < bitstream_size + 12) { av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n"); return AVERROR_INVALIDDATA; @@ -737,14 +752,13 @@ static int decode_i_frame(FourXContext *f, AVFrame *frame, const uint8_t *buf, i prestream = buf + bitstream_size + 12; if (prestream_size + bitstream_size + 12 != length - || bitstream_size > (1 << 26) || prestream_size > (1 << 26)) { av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d %d\n", prestream_size, bitstream_size, length); return AVERROR_INVALIDDATA; } - prestream = read_huffman_tables(f, prestream); + prestream = read_huffman_tables(f, prestream, prestream_size); if (!prestream) { av_log(f->avctx, AV_LOG_ERROR, "Error reading Huffman tables.\n"); return AVERROR_INVALIDDATA; @@ -758,8 +772,8 @@ static int decode_i_frame(FourXContext *f, AVFrame *frame, const uint8_t *buf, i prestream_size + FF_INPUT_BUFFER_PADDING_SIZE); if (!f->bitstream_buffer) return AVERROR(ENOMEM); - f->dsp.bswap_buf(f->bitstream_buffer, (const uint32_t*)prestream, - prestream_size / 4); + f->bbdsp.bswap_buf(f->bitstream_buffer, (const uint32_t *) prestream, + prestream_size / 4); memset((uint8_t*)f->bitstream_buffer + prestream_size, 0, FF_INPUT_BUFFER_PADDING_SIZE); init_get_bits(&f->pre_gb, f->bitstream_buffer, 8 * prestream_size); @@ -771,7 +785,7 @@ static int decode_i_frame(FourXContext *f, AVFrame *frame, const uint8_t *buf, i if ((ret = decode_i_mb(f)) < 0) return ret; - idct_put(f, frame, x, y); + idct_put(f, x, y); } } @@ -793,8 +807,14 @@ static int decode_frame(AVCodecContext *avctx, void *data, if (buf_size < 20) return AVERROR_INVALIDDATA; + if (avctx->width % 16 || avctx->height % 16) { + av_log(avctx, AV_LOG_ERROR, + "Dimensions non-multiple of 16 are invalid.\n"); + return AVERROR_INVALIDDATA; + } + if (buf_size < AV_RL32(buf + 4) + 8) { - av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d\n", + av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %"PRIu32"\n", buf_size, AV_RL32(buf + 4)); return AVERROR_INVALIDDATA; } @@ -807,9 +827,6 @@ static int decode_frame(AVCodecContext *avctx, void *data, const int data_size = buf_size - 20; CFrameBuffer *cfrm; - if (data_size < 0) - return AVERROR_INVALIDDATA; - id = AV_RL32(buf + 12); whole_size = AV_RL32(buf + 16); @@ -862,25 +879,23 @@ static int decode_frame(AVCodecContext *avctx, void *data, frame_size = buf_size - 12; } - // alternatively we would have to use our own buffer management - avctx->flags |= CODEC_FLAG_EMU_EDGE; - if ((ret = ff_get_buffer(avctx, picture, AV_GET_BUFFER_FLAG_REF)) < 0) { + if ((ret = ff_get_buffer(avctx, picture, 0)) < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); return ret; } if (frame_4cc == AV_RL32("ifr2")) { picture->pict_type = AV_PICTURE_TYPE_I; - if ((ret = decode_i2_frame(f, picture, buf - 4, frame_size + 4)) < 0) + if ((ret = decode_i2_frame(f, buf - 4, frame_size + 4)) < 0) return ret; } else if (frame_4cc == AV_RL32("ifrm")) { picture->pict_type = AV_PICTURE_TYPE_I; - if ((ret = decode_i_frame(f, picture, buf, frame_size)) < 0) + if ((ret = decode_i_frame(f, buf, frame_size)) < 0) return ret; } else if (frame_4cc == AV_RL32("pfrm") || frame_4cc == AV_RL32("pfr2")) { picture->pict_type = AV_PICTURE_TYPE_P; - if ((ret = decode_p_frame(f, picture, buf, frame_size)) < 0) + if ((ret = decode_p_frame(f, buf, frame_size)) < 0) return ret; } else if (frame_4cc == AV_RL32("snd_")) { av_log(avctx, AV_LOG_ERROR, "ignoring snd_ chunk length:%d\n", @@ -892,9 +907,11 @@ static int decode_frame(AVCodecContext *avctx, void *data, picture->key_frame = picture->pict_type == AV_PICTURE_TYPE_I; - av_frame_unref(f->last_picture); - if ((ret = av_frame_ref(f->last_picture, picture)) < 0) - return ret; + av_image_copy_plane(picture->data[0], picture->linesize[0], + (const uint8_t*)f->frame_buffer, avctx->width * 2, + avctx->width * 2, avctx->height); + FFSWAP(uint16_t *, f->frame_buffer, f->last_frame_buffer); + *got_frame = 1; emms_c(); @@ -902,17 +919,48 @@ static int decode_frame(AVCodecContext *avctx, void *data, return buf_size; } +static av_cold int decode_end(AVCodecContext *avctx) +{ + FourXContext * const f = avctx->priv_data; + int i; + + av_freep(&f->frame_buffer); + av_freep(&f->last_frame_buffer); + av_freep(&f->bitstream_buffer); + f->bitstream_buffer_size = 0; + for (i = 0; i < CFRAME_BUFFER_COUNT; i++) { + av_freep(&f->cfrm[i].data); + f->cfrm[i].allocated_size = 0; + } + ff_free_vlc(&f->pre_vlc); + + return 0; +} + static av_cold int decode_init(AVCodecContext *avctx) { FourXContext * const f = avctx->priv_data; + int ret; if (avctx->extradata_size != 4 || !avctx->extradata) { av_log(avctx, AV_LOG_ERROR, "extradata wrong or missing\n"); - return 1; + return AVERROR_INVALIDDATA; + } + + ret = av_image_check_size(avctx->width, avctx->height, 0, avctx); + if (ret < 0) + return ret; + + f->frame_buffer = av_mallocz(avctx->width * avctx->height * 2); + f->last_frame_buffer = av_mallocz(avctx->width * avctx->height * 2); + if (!f->frame_buffer || !f->last_frame_buffer) { + decode_end(avctx); + return AVERROR(ENOMEM); } f->version = AV_RL32(avctx->extradata) >> 16; - ff_dsputil_init(&f->dsp, avctx); + ff_blockdsp_init(&f->bdsp, avctx); + ff_bswapdsp_init(&f->bbdsp); f->avctx = avctx; init_vlcs(f); @@ -921,33 +969,12 @@ static av_cold int decode_init(AVCodecContext *avctx) else avctx->pix_fmt = AV_PIX_FMT_BGR555; - f->last_picture = av_frame_alloc(); - if (!f->last_picture) - return AVERROR(ENOMEM); - - return 0; -} - - -static av_cold int decode_end(AVCodecContext *avctx) -{ - FourXContext * const f = avctx->priv_data; - int i; - - av_freep(&f->bitstream_buffer); - f->bitstream_buffer_size = 0; - for (i = 0; i < CFRAME_BUFFER_COUNT; i++) { - av_freep(&f->cfrm[i].data); - f->cfrm[i].allocated_size = 0; - } - ff_free_vlc(&f->pre_vlc); - av_frame_free(&f->last_picture); - return 0; } AVCodec ff_fourxm_decoder = { .name = "4xm", + .long_name = NULL_IF_CONFIG_SMALL("4X Movie"), .type = AVMEDIA_TYPE_VIDEO, .id = AV_CODEC_ID_4XM, .priv_data_size = sizeof(FourXContext), @@ -955,5 +982,4 @@ AVCodec ff_fourxm_decoder = { .close = decode_end, .decode = decode_frame, .capabilities = CODEC_CAP_DR1, - .long_name = NULL_IF_CONFIG_SMALL("4X Movie"), };