X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fanm.c;h=134640ee368ae37b72ffca9c0663c16f8e8b026a;hb=930391e5988abe126d29c5e9b09fab459e0b8936;hp=ab6a3994e9e1a4b062ab4e4ed31d6885c567424c;hpb=1f1ec958f6c68a5ceafea206a99c895f62d0f3ec;p=ffmpeg

diff --git a/libavcodec/anm.c b/libavcodec/anm.c
index ab6a3994e9e..134640ee368 100644
--- a/libavcodec/anm.c
+++ b/libavcodec/anm.c
@@ -31,30 +31,27 @@
 typedef struct AnmContext {
     AVFrame *frame;
     int palette[AVPALETTE_COUNT];
-    GetByteContext gb;
-    int x;  ///< x coordinate position
 } AnmContext;
 
 static av_cold int decode_init(AVCodecContext *avctx)
 {
     AnmContext *s = avctx->priv_data;
+    GetByteContext gb;
     int i;
 
+    if (avctx->extradata_size < 16 * 8 + 4 * 256)
+        return AVERROR_INVALIDDATA;
+
     avctx->pix_fmt = AV_PIX_FMT_PAL8;
 
     s->frame = av_frame_alloc();
     if (!s->frame)
         return AVERROR(ENOMEM);
 
-    bytestream2_init(&s->gb, avctx->extradata, avctx->extradata_size);
-    if (bytestream2_get_bytes_left(&s->gb) < 16 * 8 + 4 * 256) {
-        av_frame_free(&s->frame);
-        return AVERROR_INVALIDDATA;
-    }
-
-    bytestream2_skipu(&s->gb, 16 * 8);
+    bytestream2_init(&gb, avctx->extradata, avctx->extradata_size);
+    bytestream2_skipu(&gb, 16 * 8);
     for (i = 0; i < 256; i++)
-        s->palette[i] = (0xFFU << 24) | bytestream2_get_le32u(&s->gb);
+        s->palette[i] = (0xFFU << 24) | bytestream2_get_le32u(&gb);
 
     return 0;
 }
@@ -117,44 +114,47 @@ static int decode_frame(AVCodecContext *avctx,
     AnmContext *s = avctx->priv_data;
     const int buf_size = avpkt->size;
     uint8_t *dst, *dst_end;
-    int count, ret;
+    GetByteContext gb;
+    int count, ret, x = 0;
+
+    if (buf_size < 7)
+        return AVERROR_INVALIDDATA;
 
-    if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
+    if ((ret = ff_reget_buffer(avctx, s->frame, 0)) < 0)
         return ret;
     dst     = s->frame->data[0];
     dst_end = s->frame->data[0] + s->frame->linesize[0]*avctx->height;
 
-    bytestream2_init(&s->gb, avpkt->data, buf_size);
+    bytestream2_init(&gb, avpkt->data, buf_size);
 
-    if (bytestream2_get_byte(&s->gb) != 0x42) {
+    if (bytestream2_get_byte(&gb) != 0x42) {
         avpriv_request_sample(avctx, "Unknown record type");
         return AVERROR_INVALIDDATA;
     }
-    if (bytestream2_get_byte(&s->gb)) {
+    if (bytestream2_get_byte(&gb)) {
         avpriv_request_sample(avctx, "Padding bytes");
         return AVERROR_PATCHWELCOME;
     }
-    bytestream2_skip(&s->gb, 2);
+    bytestream2_skip(&gb, 2);
 
-    s->x = 0;
     do {
         /* if statements are ordered by probability */
 #define OP(gb, pixel, count) \
-    op(&dst, dst_end, (gb), (pixel), (count), &s->x, avctx->width, s->frame->linesize[0])
+    op(&dst, dst_end, (gb), (pixel), (count), &x, avctx->width, s->frame->linesize[0])
 
-        int type = bytestream2_get_byte(&s->gb);
+        int type = bytestream2_get_byte(&gb);
         count = type & 0x7F;
         type >>= 7;
         if (count) {
-            if (OP(type ? NULL : &s->gb, -1, count)) break;
+            if (OP(type ? NULL : &gb, -1, count)) break;
         } else if (!type) {
             int pixel;
-            count = bytestream2_get_byte(&s->gb);  /* count==0 gives nop */
-            pixel = bytestream2_get_byte(&s->gb);
+            count = bytestream2_get_byte(&gb);  /* count==0 gives nop */
+            pixel = bytestream2_get_byte(&gb);
             if (OP(NULL, pixel, count)) break;
         } else {
             int pixel;
-            type = bytestream2_get_le16(&s->gb);
+            type = bytestream2_get_le16(&gb);
             count = type & 0x3FFF;
             type >>= 14;
             if (!count) {
@@ -166,11 +166,11 @@ static int decode_frame(AVCodecContext *avctx,
                 }
                 continue;
             }
-            pixel = type == 3 ? bytestream2_get_byte(&s->gb) : -1;
+            pixel = type == 3 ? bytestream2_get_byte(&gb) : -1;
             if (type == 1) count += 0x4000;
-            if (OP(type == 2 ? &s->gb : NULL, pixel, count)) break;
+            if (OP(type == 2 ? &gb : NULL, pixel, count)) break;
         }
-    } while (bytestream2_get_bytes_left(&s->gb) > 0);
+    } while (bytestream2_get_bytes_left(&gb) > 0);
 
     memcpy(s->frame->data[1], s->palette, AVPALETTE_SIZE);