X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fulti.c;h=6e7ba35f9d8e5407073db58344d7199242dc7149;hb=107f55cb01d2333541b8887194c487a6c6bc1ba1;hp=6d41cd9d06d99b5894501408be461d995f988f1c;hpb=0489af478e5f490aee2d96daa29043b590c8d280;p=ffmpeg

diff --git a/libavcodec/ulti.c b/libavcodec/ulti.c
index 6d41cd9d06d..6e7ba35f9d8 100644
--- a/libavcodec/ulti.c
+++ b/libavcodec/ulti.c
@@ -38,6 +38,7 @@ typedef struct UltimotionDecodeContext {
     int width, height, blocks;
     AVFrame frame;
     const uint8_t *ulti_codebook;
+    GetByteContext gb;
 } UltimotionDecodeContext;
 
 static av_cold int ulti_decode_init(AVCodecContext *avctx)
@@ -225,23 +226,27 @@ static int ulti_decode_frame(AVCodecContext *avctx,
     int skip;
     int tmp;
 
-    s->frame.reference = 1;
+    s->frame.reference = 3;
     s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
     if (avctx->reget_buffer(avctx, &s->frame) < 0) {
         av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
         return -1;
     }
 
+    bytestream2_init(&s->gb, buf, buf_size);
+
     while(!done) {
         int idx;
         if(blocks >= s->blocks || y >= s->height)
             break;//all blocks decoded
 
-        idx = *buf++;
+        if (bytestream2_get_bytes_left(&s->gb) < 1)
+            goto err;
+        idx = bytestream2_get_byteu(&s->gb);
         if((idx & 0xF8) == 0x70) {
             switch(idx) {
             case 0x70: //change modifier
-                modifier = *buf++;
+                modifier = bytestream2_get_byte(&s->gb);
                 if(modifier>1)
                     av_log(avctx, AV_LOG_INFO, "warning: modifier must be 0 or 1, got %i\n", modifier);
                 break;
@@ -255,7 +260,7 @@ static int ulti_decode_frame(AVCodecContext *avctx,
                 done = 1;
                 break;
             case 0x74: //skip some blocks
-                skip = *buf++;
+                skip = bytestream2_get_byte(&s->gb);
                 if ((blocks + skip) >= s->blocks)
                     break;
                 blocks += skip;
@@ -281,20 +286,22 @@ static int ulti_decode_frame(AVCodecContext *avctx,
                 chroma = 0;
             } else {
                 cf = 0;
-                if (idx)
-                    chroma = *buf++;
+                if (idx) {
+                    chroma = bytestream2_get_byte(&s->gb);
+                }
             }
             for (i = 0; i < 4; i++) { // for every subblock
                 code = (idx >> (6 - i*2)) & 3; //extract 2 bits
                 if(!code) //skip subblock
                     continue;
-                if(cf)
-                    chroma = *buf++;
+                if(cf) {
+                    chroma = bytestream2_get_byte(&s->gb);
+                }
                 tx = x + block_coords[i * 2];
                 ty = y + block_coords[(i * 2) + 1];
                 switch(code) {
                 case 1:
-                    tmp = *buf++;
+                    tmp = bytestream2_get_byte(&s->gb);
 
                     angle = angle_by_index[(tmp >> 6) & 0x3];
 
@@ -314,7 +321,7 @@ static int ulti_decode_frame(AVCodecContext *avctx,
 
                 case 2:
                     if (modifier) { // unpack four luma samples
-                        tmp = bytestream_get_be24(&buf);
+                        tmp = bytestream2_get_be24(&s->gb);
 
                         Y[0] = (tmp >> 18) & 0x3F;
                         Y[1] = (tmp >> 12) & 0x3F;
@@ -322,7 +329,7 @@ static int ulti_decode_frame(AVCodecContext *avctx,
                         Y[3] = tmp & 0x3F;
                         angle = 16;
                     } else { // retrieve luma samples from codebook
-                        tmp = bytestream_get_be16(&buf);
+                        tmp = bytestream2_get_be16(&s->gb);
 
                         angle = (tmp >> 12) & 0xF;
                         tmp &= 0xFFF;
@@ -338,25 +345,27 @@ static int ulti_decode_frame(AVCodecContext *avctx,
                     if (modifier) { // all 16 luma samples
                         uint8_t Luma[16];
 
-                        tmp = bytestream_get_be24(&buf);
+                        if (bytestream2_get_bytes_left(&s->gb) < 12)
+                            goto err;
+                        tmp = bytestream2_get_be24u(&s->gb);
                         Luma[0] = (tmp >> 18) & 0x3F;
                         Luma[1] = (tmp >> 12) & 0x3F;
                         Luma[2] = (tmp >> 6) & 0x3F;
                         Luma[3] = tmp & 0x3F;
 
-                        tmp = bytestream_get_be24(&buf);
+                        tmp = bytestream2_get_be24u(&s->gb);
                         Luma[4] = (tmp >> 18) & 0x3F;
                         Luma[5] = (tmp >> 12) & 0x3F;
                         Luma[6] = (tmp >> 6) & 0x3F;
                         Luma[7] = tmp & 0x3F;
 
-                        tmp = bytestream_get_be24(&buf);
+                        tmp = bytestream2_get_be24u(&s->gb);
                         Luma[8] = (tmp >> 18) & 0x3F;
                         Luma[9] = (tmp >> 12) & 0x3F;
                         Luma[10] = (tmp >> 6) & 0x3F;
                         Luma[11] = tmp & 0x3F;
 
-                        tmp = bytestream_get_be24(&buf);
+                        tmp = bytestream2_get_be24u(&s->gb);
                         Luma[12] = (tmp >> 18) & 0x3F;
                         Luma[13] = (tmp >> 12) & 0x3F;
                         Luma[14] = (tmp >> 6) & 0x3F;
@@ -364,21 +373,23 @@ static int ulti_decode_frame(AVCodecContext *avctx,
 
                         ulti_convert_yuv(&s->frame, tx, ty, Luma, chroma);
                     } else {
-                        tmp = *buf++;
+                        if (bytestream2_get_bytes_left(&s->gb) < 4)
+                            goto err;
+                        tmp = bytestream2_get_byteu(&s->gb);
                         if(tmp & 0x80) {
                             angle = (tmp >> 4) & 0x7;
-                            tmp = (tmp << 8) + *buf++;
+                            tmp = (tmp << 8) + bytestream2_get_byteu(&s->gb);
                             Y[0] = (tmp >> 6) & 0x3F;
                             Y[1] = tmp & 0x3F;
-                            Y[2] = (*buf++) & 0x3F;
-                            Y[3] = (*buf++) & 0x3F;
+                            Y[2] = bytestream2_get_byteu(&s->gb) & 0x3F;
+                            Y[3] = bytestream2_get_byteu(&s->gb) & 0x3F;
                             ulti_grad(&s->frame, tx, ty, Y, chroma, angle); //draw block
                         } else { // some patterns
                             int f0, f1;
-                            f0 = *buf++;
+                            f0 = bytestream2_get_byteu(&s->gb);
                             f1 = tmp;
-                            Y[0] = (*buf++) & 0x3F;
-                            Y[1] = (*buf++) & 0x3F;
+                            Y[0] = bytestream2_get_byteu(&s->gb) & 0x3F;
+                            Y[1] = bytestream2_get_byteu(&s->gb) & 0x3F;
                             ulti_pattern(&s->frame, tx, ty, f1, f0, Y[0], Y[1], chroma);
                         }
                     }
@@ -400,6 +411,11 @@ static int ulti_decode_frame(AVCodecContext *avctx,
     *(AVFrame*)data= s->frame;
 
     return buf_size;
+
+err:
+    av_log(avctx, AV_LOG_ERROR,
+           "Insufficient data\n");
+    return AVERROR_INVALIDDATA;
 }
 
 AVCodec ff_ulti_decoder = {