handle invalid buffer sizes

[libav.git] / libavcodec / interplayvideo.c

diff --git a/libavcodec/interplayvideo.c b/libavcodec/interplayvideo.c
index 7f54e5d..06816ba 100644 (file)
--- a/libavcodec/interplayvideo.c
+++ b/libavcodec/interplayvideo.c
@@ -65,8 +65,6 @@ typedef struct IpvideoContext {
     unsigned char *buf;
     int size;
 
-    unsigned char palette[PALETTE_COUNT * 4];
-
     unsigned char *stream_ptr;
     unsigned char *stream_end;
     unsigned char *pixel_ptr;
@@ -78,35 +76,20 @@ typedef struct IpvideoContext {
 
 #define CHECK_STREAM_PTR(n) \
   if ((s->stream_ptr + n) > s->stream_end) { \
-    printf ("Interplay video warning: stream_ptr out of bounds (%p >= %p)\n", \
+    av_log(s->avctx, AV_LOG_ERROR, "Interplay video warning: stream_ptr out of bounds (%p >= %p)\n", \
       s->stream_ptr + n, s->stream_end); \
     return -1; \
   }
 
-static void ipvideo_new_palette(IpvideoContext *s, unsigned char *palette) {
-
-    int i;
-    unsigned char r, g, b;
-    unsigned int *palette32;
-
-    palette32 = (unsigned int *)s->palette;
-    for (i = 0; i < PALETTE_COUNT; i++) {
-        r = *palette++;
-        g = *palette++;
-        b = *palette++;
-        palette32[i] = (r << 16) | (g << 8) | (b);
-    }
-}
-
 #define COPY_FROM_CURRENT() \
     motion_offset = current_offset; \
     motion_offset += y * s->stride; \
     motion_offset += x; \
     if (motion_offset < 0) { \
-        printf (" Interplay video: motion offset < 0 (%d)\n", motion_offset); \
+        av_log(s->avctx, AV_LOG_ERROR, " Interplay video: motion offset < 0 (%d)\n", motion_offset); \
         return -1; \
     } else if (motion_offset > s->upper_motion_limit_offset) { \
-        printf (" Interplay video: motion offset above limit (%d >= %d)\n", \
+        av_log(s->avctx, AV_LOG_ERROR, " Interplay video: motion offset above limit (%d >= %d)\n", \
             motion_offset, s->upper_motion_limit_offset); \
         return -1; \
     } \
@@ -118,10 +101,10 @@ static void ipvideo_new_palette(IpvideoContext *s, unsigned char *palette) {
     motion_offset += y * s->stride; \
     motion_offset += x; \
     if (motion_offset < 0) { \
-        printf (" Interplay video: motion offset < 0 (%d)\n", motion_offset); \
+        av_log(s->avctx, AV_LOG_ERROR, " Interplay video: motion offset < 0 (%d)\n", motion_offset); \
         return -1; \
     } else if (motion_offset > s->upper_motion_limit_offset) { \
-        printf (" Interplay video: motion offset above limit (%d >= %d)\n", \
+        av_log(s->avctx, AV_LOG_ERROR, " Interplay video: motion offset above limit (%d >= %d)\n", \
             motion_offset, s->upper_motion_limit_offset); \
         return -1; \
     } \
@@ -133,10 +116,10 @@ static void ipvideo_new_palette(IpvideoContext *s, unsigned char *palette) {
     motion_offset += y * s->stride; \
     motion_offset += x; \
     if (motion_offset < 0) { \
-        printf (" Interplay video: motion offset < 0 (%d)\n", motion_offset); \
+        av_log(s->avctx, AV_LOG_ERROR, " Interplay video: motion offset < 0 (%d)\n", motion_offset); \
         return -1; \
     } else if (motion_offset > s->upper_motion_limit_offset) { \
-        printf (" Interplay video: motion offset above limit (%d >= %d)\n", \
+        av_log(s->avctx, AV_LOG_ERROR, " Interplay video: motion offset above limit (%d >= %d)\n", \
             motion_offset, s->upper_motion_limit_offset); \
         return -1; \
     } \
@@ -271,7 +254,7 @@ static int ipvideo_decode_block_opcode_0x5(IpvideoContext *s)
 static int ipvideo_decode_block_opcode_0x6(IpvideoContext *s)
 {
     /* mystery opcode? skip multiple blocks? */
-    printf ("  Interplay video: Help! Mystery opcode 0x6 seen\n");
+    av_log(s->avctx, AV_LOG_ERROR, "  Interplay video: Help! Mystery opcode 0x6 seen\n");
 
     /* report success */
     return 0;
@@ -828,7 +811,7 @@ static void ipvideo_decode_opcodes(IpvideoContext *s)
         code_counts[x] = 0;
 
     /* this is PAL8, so make the palette available */
-    memcpy(s->current_frame.data[1], s->palette, PALETTE_COUNT * 4);
+    memcpy(s->current_frame.data[1], s->avctx->palctrl->palette, PALETTE_COUNT * 4);
 
     s->stride = s->current_frame.linesize[0];
     s->stream_ptr = s->buf + 14;  /* data starts 14 bytes in */
@@ -855,7 +838,7 @@ static void ipvideo_decode_opcodes(IpvideoContext *s)
             s->pixel_ptr = s->current_frame.data[0] + x;
             ret = ipvideo_decode_block[opcode](s);
             if (ret != 0) {
-                printf(" Interplay video: decode problem on frame %d, @ block (%d, %d)\n",
+                av_log(s->avctx, AV_LOG_ERROR, " Interplay video: decode problem on frame %d, @ block (%d, %d)\n",
                     frame, x - y, y / s->stride);
                 return;
             }
@@ -863,7 +846,7 @@ static void ipvideo_decode_opcodes(IpvideoContext *s)
     }
     if ((s->stream_ptr != s->stream_end) &&
         (s->stream_ptr + 1 != s->stream_end)) {
-        printf (" Interplay video: decode finished with %d bytes left over\n",
+        av_log(s->avctx, AV_LOG_ERROR, " Interplay video: decode finished with %d bytes left over\n",
             s->stream_end - s->stream_ptr);
     }
 }
@@ -874,9 +857,8 @@ static int ipvideo_decode_init(AVCodecContext *avctx)
 
     s->avctx = avctx;
 
-    if (s->avctx->extradata_size != sizeof(AVPaletteControl)) {
-        printf (" Interplay video: expected extradata_size of %d\n",
-            sizeof(AVPaletteControl));
+    if (s->avctx->palctrl == NULL) {
+        av_log(avctx, AV_LOG_ERROR, " Interplay video: palette expected.\n");
         return -1;
     }
 
@@ -916,13 +898,12 @@ static int ipvideo_decode_frame(AVCodecContext *avctx,
                                 uint8_t *buf, int buf_size)
 {
     IpvideoContext *s = avctx->priv_data;
-    AVPaletteControl *palette_control = (AVPaletteControl *)avctx->extradata;
+    AVPaletteControl *palette_control = avctx->palctrl;
 
-    if (palette_control->palette_changed) {
-        /* load the new palette and reset the palette control */
-        ipvideo_new_palette(s, palette_control->palette);
-        palette_control->palette_changed = 0;
-    }
+    /* compressed buffer needs to be large enough to at least hold an entire
+     * decoding map */
+    if (buf_size < s->decoding_map_size)
+        return buf_size;
 
     s->decoding_map = buf;
     s->buf = buf + s->decoding_map_size;
@@ -930,12 +911,17 @@ static int ipvideo_decode_frame(AVCodecContext *avctx,
 
     s->current_frame.reference = 3;
     if (avctx->get_buffer(avctx, &s->current_frame)) {
-        printf ("  Interplay Video: get_buffer() failed\n");
+        av_log(avctx, AV_LOG_ERROR, "  Interplay Video: get_buffer() failed\n");
         return -1;
     }
 
     ipvideo_decode_opcodes(s);
 
+    if (palette_control->palette_changed) {
+        palette_control->palette_changed = 0;
+        s->current_frame.palette_has_changed = 1;
+    }
+
     *data_size = sizeof(AVFrame);
     *(AVFrame*)data = s->current_frame;