diff options
Diffstat (limited to 'gst-libs/ext/libav/libavcodec/pcx.c')
| -rw-r--r-- | gst-libs/ext/libav/libavcodec/pcx.c | 27 |
1 files changed, 18 insertions, 9 deletions
diff --git a/gst-libs/ext/libav/libavcodec/pcx.c b/gst-libs/ext/libav/libavcodec/pcx.c index 1bd8612..ba3703a 100644 --- a/gst-libs/ext/libav/libavcodec/pcx.c +++ b/gst-libs/ext/libav/libavcodec/pcx.c @@ -44,16 +44,19 @@ static av_cold int pcx_init(AVCodecContext *avctx) { /** * @return advanced src pointer */ -static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst, - unsigned int bytes_per_scanline, int compressed) { +static const uint8_t *pcx_rle_decode(const uint8_t *src, + const uint8_t *end, + uint8_t *dst, + unsigned int bytes_per_scanline, + int compressed) { unsigned int i = 0; unsigned char run, value; if (compressed) { - while (i<bytes_per_scanline) { + while (i < bytes_per_scanline && src < end) { run = 1; value = *src++; - if (value >= 0xc0) { + if (value >= 0xc0 && src < end) { run = value & 0x3f; value = *src++; } @@ -88,6 +91,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x, bytes_per_scanline; uint8_t *ptr; + const uint8_t *buf_end = buf + buf_size; uint8_t const *bufstart = buf; uint8_t *scanline; int ret = -1; @@ -116,7 +120,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, nplanes = buf[65]; bytes_per_scanline = nplanes * bytes_per_line; - if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8) { + if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8 || + (!compressed && bytes_per_scanline > buf_size / h)) { av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n"); return -1; } @@ -164,7 +169,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, if (nplanes == 3 && bits_per_pixel == 8) { for (y=0; y<h; y++) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x=0; x<w; x++) { ptr[3*x ] = scanline[x ]; @@ -179,7 +185,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, const uint8_t *palstart = bufstart + buf_size - 769; for (y=0; y<h; y++, ptr+=stride) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); memcpy(ptr, scanline, w); } @@ -198,7 +205,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, for (y=0; y<h; y++) { init_get_bits(&s, scanline, bytes_per_scanline<<3); - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x=0; x<w; x++) ptr[x] = get_bits(&s, bits_per_pixel); @@ -209,7 +217,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, int i; for (y=0; y<h; y++) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x=0; x<w; x++) { int m = 0x80 >> (x&7), v = 0; |