diff options
Diffstat (limited to 'libavcodec/indeo4.c')
-rw-r--r-- | libavcodec/indeo4.c | 65 |
1 files changed, 56 insertions, 9 deletions
diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c index 6a19955bce..df878c5905 100644 --- a/libavcodec/indeo4.c +++ b/libavcodec/indeo4.c @@ -2,20 +2,20 @@ * Indeo Video Interactive v4 compatible decoder * Copyright (c) 2009-2011 Maxim Poliakovski * - * This file is part of Libav. + * This file is part of FFmpeg. * - * Libav is free software; you can redistribute it and/or + * FFmpeg is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * - * Libav is distributed in the hope that it will be useful, + * FFmpeg is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public - * License along with Libav; if not, write to the Free Software + * License along with FFmpeg; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ @@ -196,6 +196,7 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx) /* decode subdivision of the planes */ pic_conf.luma_bands = decode_plane_subdivision(&ctx->gb); + pic_conf.chroma_bands = 0; if (pic_conf.luma_bands) pic_conf.chroma_bands = decode_plane_subdivision(&ctx->gb); ctx->is_scalable = pic_conf.luma_bands != 1 || pic_conf.chroma_bands != 1; @@ -340,6 +341,10 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, return AVERROR_PATCHWELCOME; } + if (transform_id < 10 && band->blk_size < 8) { + av_log(avctx, AV_LOG_ERROR, "wrong transform size!\n"); + return AVERROR_INVALIDDATA; + } #if IVI4_STREAM_ANALYSER if ((transform_id >= 0 && transform_id <= 2) || transform_id == 10) ctx->uses_haar = 1; @@ -348,13 +353,16 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, band->inv_transform = transforms[transform_id].inv_trans; band->dc_transform = transforms[transform_id].dc_trans; band->is_2d_trans = transforms[transform_id].is_2d_trans; + if (transform_id < 10) band->transform_size = 8; else band->transform_size = 4; - if (band->blk_size != band->transform_size) + if (band->blk_size != band->transform_size) { + av_log(avctx, AV_LOG_ERROR, "transform and block size mismatch (%d != %d)\n", band->transform_size, band->blk_size); return AVERROR_INVALIDDATA; + } scan_indx = get_bits(&ctx->gb, 4); if (scan_indx == 15) { @@ -362,12 +370,17 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, return AVERROR_INVALIDDATA; } if (scan_indx > 4 && scan_indx < 10) { - if (band->blk_size != 4) + if (band->blk_size != 4) { + av_log(avctx, AV_LOG_ERROR, "mismatching scan table!\n"); return AVERROR_INVALIDDATA; - } else if (band->blk_size != 8) + } + } else if (band->blk_size != 8) { + av_log(avctx, AV_LOG_ERROR, "mismatching scan table!\n"); return AVERROR_INVALIDDATA; + } band->scan = scan_index_to_tab[scan_indx]; + band->scan_size = band->blk_size; band->quant_mat = get_bits(&ctx->gb, 5); if (band->quant_mat >= FF_ARRAY_ELEMS(quant_index_to_tab)) { @@ -393,6 +406,19 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, return AVERROR_INVALIDDATA; } } + if (quant_index_to_tab[band->quant_mat] > 4 && band->blk_size == 4) { + av_log(avctx, AV_LOG_ERROR, "Invalid quant matrix for 4x4 block encountered!\n"); + band->quant_mat = 0; + return AVERROR_INVALIDDATA; + } + if (band->scan_size != band->blk_size) { + av_log(avctx, AV_LOG_ERROR, "mismatching scan table!\n"); + return AVERROR_INVALIDDATA; + } + if (band->transform_size == 8 && band->blk_size < 8) { + av_log(avctx, AV_LOG_ERROR, "mismatching transform_size!\n"); + return AVERROR_INVALIDDATA; + } /* decode block huffman codebook */ if (!get_bits1(&ctx->gb)) @@ -435,6 +461,11 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, align_get_bits(&ctx->gb); + if (!band->scan) { + av_log(avctx, AV_LOG_ERROR, "band->scan not set\n"); + return AVERROR_INVALIDDATA; + } + return 0; } @@ -453,7 +484,7 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, IVITile *tile, AVCodecContext *avctx) { int x, y, mv_x, mv_y, mv_delta, offs, mb_offset, blks_per_mb, - mv_scale, mb_type_bits; + mv_scale, mb_type_bits, s; IVIMbInfo *mb, *ref_mb; int row_offset = band->mb_size * band->pitch; @@ -468,6 +499,11 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3); mv_x = mv_y = 0; + if (((tile->width + band->mb_size-1)/band->mb_size) * ((tile->height + band->mb_size-1)/band->mb_size) != tile->num_MBs) { + av_log(avctx, AV_LOG_ERROR, "num_MBs mismatch %d %d %d %d\n", tile->width, tile->height, band->mb_size, tile->num_MBs); + return -1; + } + for (y = tile->ypos; y < tile->ypos + tile->height; y += band->mb_size) { mb_offset = offs; @@ -505,8 +541,10 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, } else { if (band->inherit_mv) { /* copy mb_type from corresponding reference mb */ - if (!ref_mb) + if (!ref_mb) { + av_log(avctx, AV_LOG_ERROR, "ref_mb unavailable\n"); return AVERROR_INVALIDDATA; + } mb->type = ref_mb->type; } else if (ctx->frame_type == FRAMETYPE_INTRA || ctx->frame_type == FRAMETYPE_INTRA1) { @@ -554,6 +592,15 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, } } + s= band->is_halfpel; + if (mb->type) + if ( x + (mb->mv_x >>s) + (y+ (mb->mv_y >>s))*band->pitch < 0 || + x + ((mb->mv_x+s)>>s) + band->mb_size - 1 + + (y+band->mb_size - 1 +((mb->mv_y+s)>>s))*band->pitch > band->bufsize -1) { + av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", x*s + mb->mv_x, y*s + mb->mv_y); + return AVERROR_INVALIDDATA; + } + mb++; if (ref_mb) ref_mb++; |