X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fdpx.c;h=156f1deaa49e4d33780adea6b2304c809ce98558;hb=4da6d194e5b00404f4d545adcaa8e206592ae746;hp=55ae4e72489a8f666bae3d14153bb6bc85aa48ab;hpb=d36beb3f6902b1217beda576aa18abf7eb72b03c;p=ffmpeg

diff --git a/libavcodec/dpx.c b/libavcodec/dpx.c
index 55ae4e72489..156f1deaa49 100644
--- a/libavcodec/dpx.c
+++ b/libavcodec/dpx.c
@@ -2,25 +2,25 @@
  * DPX (.dpx) image decoder
  * Copyright (c) 2009 Jimmy Christensen
  *
- * This file is part of FFmpeg.
+ * This file is part of Libav.
  *
- * FFmpeg is free software; you can redistribute it and/or
+ * Libav is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * FFmpeg is distributed in the hope that it will be useful,
+ * Libav is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with FFmpeg; if not, write to the Free Software
+ * License along with Libav; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
 #include "libavutil/intreadwrite.h"
-#include "libavcore/imgutils.h"
+#include "libavutil/imgutils.h"
 #include "bytestream.h"
 #include "avcodec.h"
 
@@ -68,6 +68,11 @@ static int decode_frame(AVCodecContext *avctx,
 
     unsigned int rgbBuffer;
 
+    if (avpkt->size <= 1634) {
+        av_log(avctx, AV_LOG_ERROR, "Packet too small for DPX header\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     magic_num = AV_RB32(buf);
     buf += 4;
 
@@ -83,6 +88,10 @@ static int decode_frame(AVCodecContext *avctx,
     }
 
     offset = read32(&buf, endian);
+    if (avpkt->size <= offset) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid data start offset\n");
+        return AVERROR_INVALIDDATA;
+    }
     // Need to end in 0x304 offset from start of file
     buf = avpkt->data + 0x304;
     w = read32(&buf, endian);
@@ -97,6 +106,10 @@ static int decode_frame(AVCodecContext *avctx,
     avctx->bits_per_raw_sample =
     bits_per_color = buf[0];
 
+    buf += 825;
+    avctx->sample_aspect_ratio.num = read32(&buf, endian);
+    avctx->sample_aspect_ratio.den = read32(&buf, endian);
+
     switch (descriptor) {
         case 51: // RGBA
             elements = 4;
@@ -122,7 +135,7 @@ static int decode_frame(AVCodecContext *avctx,
         case 10:
             avctx->pix_fmt = PIX_FMT_RGB48;
             target_packet_size = 6;
-            source_packet_size = elements * 2;
+            source_packet_size = 4;
             break;
         case 12:
         case 16:
@@ -156,6 +169,10 @@ static int decode_frame(AVCodecContext *avctx,
     ptr    = p->data[0];
     stride = p->linesize[0];
 
+    if (source_packet_size*avctx->width*avctx->height > buf_end - buf) {
+        av_log(avctx, AV_LOG_ERROR, "Overread buffer. Invalid header?\n");
+        return -1;
+    }
     switch (bits_per_color) {
         case 10:
             for (x = 0; x < avctx->height; x++) {
@@ -173,10 +190,6 @@ static int decode_frame(AVCodecContext *avctx,
         case 8:
         case 12: // Treat 12-bit as 16-bit
         case 16:
-            if (source_packet_size*avctx->width*avctx->height > buf_end - buf) {
-                av_log(avctx, AV_LOG_ERROR, "Overread buffer. Invalid header?\n");
-                return -1;
-            }
             if (source_packet_size == target_packet_size) {
                 for (x = 0; x < avctx->height; x++) {
                     memcpy(ptr, buf, target_packet_size*avctx->width);
@@ -221,15 +234,12 @@ static av_cold int decode_end(AVCodecContext *avctx)
 }
 
 AVCodec ff_dpx_decoder = {
-    "dpx",
-    AVMEDIA_TYPE_VIDEO,
-    CODEC_ID_DPX,
-    sizeof(DPXContext),
-    decode_init,
-    NULL,
-    decode_end,
-    decode_frame,
-    0,
-    NULL,
+    .name           = "dpx",
+    .type           = AVMEDIA_TYPE_VIDEO,
+    .id             = CODEC_ID_DPX,
+    .priv_data_size = sizeof(DPXContext),
+    .init           = decode_init,
+    .close          = decode_end,
+    .decode         = decode_frame,
     .long_name = NULL_IF_CONFIG_SMALL("DPX image"),
 };