X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fsgidec.c;h=6f93a3059e16235e1358382a0a751e78a427b9d5;hb=83678dbbae64ad8c501e0c732c1117e642c25dae;hp=b25b41f9889b8f46cdfdf74b249ce1ad7e33b846;hpb=f4a8a0080537484154bb74e08ec76cbcbd25484b;p=ffmpeg diff --git a/libavcodec/sgidec.c b/libavcodec/sgidec.c index b25b41f9889..6f93a3059e1 100644 --- a/libavcodec/sgidec.c +++ b/libavcodec/sgidec.c @@ -43,18 +43,19 @@ typedef struct SgiState { * @param pixelstride pixel stride of input buffer * @return size of output in bytes, -1 if buffer overflows */ -static int expand_rle_row(SgiState *s, uint8_t *out_buf, - int len, int pixelstride) +static int expand_rle_row8(SgiState *s, uint8_t *out_buf, + int len, int pixelstride) { unsigned char pixel, count; unsigned char *orig = out_buf; + uint8_t *out_end = out_buf + len; - while (1) { + while (out_buf < out_end) { if (bytestream2_get_bytes_left(&s->g) < 1) return AVERROR_INVALIDDATA; pixel = bytestream2_get_byteu(&s->g); if (!(count = (pixel & 0x7f))) { - return (out_buf - orig) / pixelstride; + break; } /* Check for buffer overflow. */ @@ -77,8 +78,49 @@ static int expand_rle_row(SgiState *s, uint8_t *out_buf, } } } + return (out_buf - orig) / pixelstride; } +static int expand_rle_row16(SgiState *s, uint16_t *out_buf, + int len, int pixelstride) +{ + unsigned short pixel; + unsigned char count; + unsigned short *orig = out_buf; + uint16_t *out_end = out_buf + len; + + while (out_buf < out_end) { + if (bytestream2_get_bytes_left(&s->g) < 2) + return AVERROR_INVALIDDATA; + pixel = bytestream2_get_be16u(&s->g); + if (!(count = (pixel & 0x7f))) + break; + + /* Check for buffer overflow. */ + if (pixelstride * (count - 1) >= len) { + av_log(s->avctx, AV_LOG_ERROR, "Invalid pixel count.\n"); + return AVERROR_INVALIDDATA; + } + + if (pixel & 0x80) { + while (count--) { + pixel = bytestream2_get_ne16(&s->g); + AV_WN16A(out_buf, pixel); + out_buf += pixelstride; + } + } else { + pixel = bytestream2_get_ne16(&s->g); + + while (count--) { + AV_WN16A(out_buf, pixel); + out_buf += pixelstride; + } + } + } + return (out_buf - orig) / pixelstride; +} + + /** * Read a run length encoded SGI image. * @param out_buf output buffer @@ -92,22 +134,26 @@ static int read_rle_sgi(uint8_t *out_buf, SgiState *s) GetByteContext g_table = s->g; unsigned int y, z; unsigned int start_offset; + int linesize, ret; /* size of RLE offset and length tables */ - if (len * 2 > bytestream2_get_bytes_left(&s->g)) { + if (len * 2 > bytestream2_get_bytes_left(&s->g)) { return AVERROR_INVALIDDATA; } for (z = 0; z < s->depth; z++) { dest_row = out_buf; for (y = 0; y < s->height; y++) { + linesize = s->width * s->depth * s->bytes_per_channel; dest_row -= s->linesize; start_offset = bytestream2_get_be32(&g_table); bytestream2_seek(&s->g, start_offset, SEEK_SET); - if (expand_rle_row(s, dest_row + z, FFABS(s->linesize) - z, - s->depth) != s->width) { + if (s->bytes_per_channel == 1) + ret = expand_rle_row8(s, dest_row + z, linesize, s->depth); + else + ret = expand_rle_row16(s, (uint16_t *)dest_row + z, linesize, s->depth); + if (ret != s->width) return AVERROR_INVALIDDATA; - } } } return 0; @@ -116,16 +162,15 @@ static int read_rle_sgi(uint8_t *out_buf, SgiState *s) /** * Read an uncompressed SGI image. * @param out_buf output buffer - * @param out_end end ofoutput buffer * @param s the current image state * @return 0 if read success, otherwise return -1. */ -static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end, - SgiState *s) +static int read_uncompressed_sgi(unsigned char *out_buf, SgiState *s) { int x, y, z; unsigned int offset = s->height * s->width * s->bytes_per_channel; GetByteContext gp[4]; + uint8_t *out_end; /* Test buffer size. */ if (offset * s->depth > bytestream2_get_bytes_left(&s->g)) @@ -182,35 +227,36 @@ static int decode_frame(AVCodecContext *avctx, s->height = bytestream2_get_be16(&s->g); s->depth = bytestream2_get_be16(&s->g); - if (s->bytes_per_channel != 1 && (s->bytes_per_channel != 2 || rle)) { + if (s->bytes_per_channel != 1 && s->bytes_per_channel != 2) { av_log(avctx, AV_LOG_ERROR, "wrong channel number\n"); - return -1; + return AVERROR(EINVAL); } /* Check for supported image dimensions. */ if (dimension != 2 && dimension != 3) { av_log(avctx, AV_LOG_ERROR, "wrong dimension number\n"); - return -1; + return AVERROR(EINVAL); } if (s->depth == SGI_GRAYSCALE) { avctx->pix_fmt = s->bytes_per_channel == 2 ? AV_PIX_FMT_GRAY16BE : AV_PIX_FMT_GRAY8; } else if (s->depth == SGI_RGB) { avctx->pix_fmt = s->bytes_per_channel == 2 ? AV_PIX_FMT_RGB48BE : AV_PIX_FMT_RGB24; - } else if (s->depth == SGI_RGBA && s->bytes_per_channel == 1) { - avctx->pix_fmt = AV_PIX_FMT_RGBA; + } else if (s->depth == SGI_RGBA) { + avctx->pix_fmt = s->bytes_per_channel == 2 ? AV_PIX_FMT_RGBA64BE : AV_PIX_FMT_RGBA; } else { av_log(avctx, AV_LOG_ERROR, "wrong picture format\n"); - return -1; + return AVERROR(EINVAL); } ret = ff_set_dimensions(avctx, s->width, s->height); if (ret < 0) return ret; - if (ff_get_buffer(avctx, p, 0) < 0) { + ret = ff_get_buffer(avctx, p, 0); + if (ret < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed.\n"); - return -1; + return ret; } p->pict_type = AV_PICTURE_TYPE_I; @@ -226,7 +272,7 @@ static int decode_frame(AVCodecContext *avctx, if (rle) { ret = read_rle_sgi(out_end, s); } else { - ret = read_uncompressed_sgi(out_buf, out_end, s); + ret = read_uncompressed_sgi(out_buf, s); } if (ret == 0) { @@ -254,5 +300,5 @@ AVCodec ff_sgi_decoder = { .priv_data_size = sizeof(SgiState), .decode = decode_frame, .init = sgi_decode_init, - .capabilities = CODEC_CAP_DR1, + .capabilities = AV_CODEC_CAP_DR1, };