|  | @@ -203,22 +203,22 @@ fail: | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | #define CHECK_COUNT() \ |  |  | #define CHECK_COUNT() \ | 
														
													
														
															
																|  |  | if (dest_index + count > dest_size) { \ |  |  | if (dest_index + count > dest_size) { \ | 
														
													
														
															
																|  |  | av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: next op would overflow dest_index\n"); \ |  |  |  | 
														
													
														
															
																|  |  | av_log(NULL, AV_LOG_ERROR, "  VQA video: current dest_index = %d, count = %d, dest_size = %d\n", \ |  |  |  | 
														
													
														
															
																|  |  |  |  |  | av_log(s->avctx, AV_LOG_ERROR, "decode_format80 problem: next op would overflow dest_index\n"); \ | 
														
													
														
															
																|  |  |  |  |  | av_log(s->avctx, AV_LOG_ERROR, "current dest_index = %d, count = %d, dest_size = %d\n", \ | 
														
													
														
															
																|  |  | dest_index, count, dest_size); \ |  |  | dest_index, count, dest_size); \ | 
														
													
														
															
																|  |  | return AVERROR_INVALIDDATA; \ |  |  | return AVERROR_INVALIDDATA; \ | 
														
													
														
															
																|  |  | } |  |  | } | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | #define CHECK_COPY(idx) \ |  |  | #define CHECK_COPY(idx) \ | 
														
													
														
															
																|  |  | if (idx < 0 || idx + count > dest_size) { \ |  |  | if (idx < 0 || idx + count > dest_size) { \ | 
														
													
														
															
																|  |  | av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: next op would overflow dest_index\n"); \ |  |  |  | 
														
													
														
															
																|  |  | av_log(NULL, AV_LOG_ERROR, "  VQA video: current src_pos = %d, count = %d, dest_size = %d\n", \ |  |  |  | 
														
													
														
															
																|  |  |  |  |  | av_log(s->avctx, AV_LOG_ERROR, "decode_format80 problem: next op would overflow dest_index\n"); \ | 
														
													
														
															
																|  |  |  |  |  | av_log(s->avctx, AV_LOG_ERROR, "current src_pos = %d, count = %d, dest_size = %d\n", \ | 
														
													
														
															
																|  |  | src_pos, count, dest_size); \ |  |  | src_pos, count, dest_size); \ | 
														
													
														
															
																|  |  | return AVERROR_INVALIDDATA; \ |  |  | return AVERROR_INVALIDDATA; \ | 
														
													
														
															
																|  |  | } |  |  | } | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | static int decode_format80(GetByteContext *gb, int src_size, |  |  |  | 
														
													
														
															
																|  |  |  |  |  | static int decode_format80(VqaContext *s, int src_size, | 
														
													
														
															
																|  |  | unsigned char *dest, int dest_size, int check_size) { |  |  | unsigned char *dest, int dest_size, int check_size) { | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | int dest_index = 0; |  |  | int dest_index = 0; | 
														
													
												
													
														
															
																|  | @@ -227,26 +227,26 @@ static int decode_format80(GetByteContext *gb, int src_size, | 
														
													
														
															
																|  |  | unsigned char color; |  |  | unsigned char color; | 
														
													
														
															
																|  |  | int i; |  |  | int i; | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | start = bytestream2_tell(gb); |  |  |  | 
														
													
														
															
																|  |  | while (bytestream2_tell(gb) - start < src_size) { |  |  |  | 
														
													
														
															
																|  |  | opcode = bytestream2_get_byte(gb); |  |  |  | 
														
													
														
															
																|  |  | av_dlog(NULL, "      opcode %02X: ", opcode); |  |  |  | 
														
													
														
															
																|  |  |  |  |  | start = bytestream2_tell(&s->gb); | 
														
													
														
															
																|  |  |  |  |  | while (bytestream2_tell(&s->gb) - start < src_size) { | 
														
													
														
															
																|  |  |  |  |  | opcode = bytestream2_get_byte(&s->gb); | 
														
													
														
															
																|  |  |  |  |  | av_dlog(s->avctx, "opcode %02X: ", opcode); | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | /* 0x80 means that frame is finished */ |  |  | /* 0x80 means that frame is finished */ | 
														
													
														
															
																|  |  | if (opcode == 0x80) |  |  | if (opcode == 0x80) | 
														
													
														
															
																|  |  | return 0; |  |  | return 0; | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | if (dest_index >= dest_size) { |  |  | if (dest_index >= dest_size) { | 
														
													
														
															
																|  |  | av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: dest_index (%d) exceeded dest_size (%d)\n", |  |  |  | 
														
													
														
															
																|  |  |  |  |  | av_log(s->avctx, AV_LOG_ERROR, "decode_format80 problem: dest_index (%d) exceeded dest_size (%d)\n", | 
														
													
														
															
																|  |  | dest_index, dest_size); |  |  | dest_index, dest_size); | 
														
													
														
															
																|  |  | return AVERROR_INVALIDDATA; |  |  | return AVERROR_INVALIDDATA; | 
														
													
														
															
																|  |  | } |  |  | } | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | if (opcode == 0xFF) { |  |  | if (opcode == 0xFF) { | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | count   = bytestream2_get_le16(gb); |  |  |  | 
														
													
														
															
																|  |  | src_pos = bytestream2_get_le16(gb); |  |  |  | 
														
													
														
															
																|  |  | av_dlog(NULL, "(1) copy %X bytes from absolute pos %X\n", count, src_pos); |  |  |  | 
														
													
														
															
																|  |  |  |  |  | count   = bytestream2_get_le16(&s->gb); | 
														
													
														
															
																|  |  |  |  |  | src_pos = bytestream2_get_le16(&s->gb); | 
														
													
														
															
																|  |  |  |  |  | av_dlog(s->avctx, "(1) copy %X bytes from absolute pos %X\n", count, src_pos); | 
														
													
														
															
																|  |  | CHECK_COUNT(); |  |  | CHECK_COUNT(); | 
														
													
														
															
																|  |  | CHECK_COPY(src_pos); |  |  | CHECK_COPY(src_pos); | 
														
													
														
															
																|  |  | for (i = 0; i < count; i++) |  |  | for (i = 0; i < count; i++) | 
														
													
												
													
														
															
																|  | @@ -255,9 +255,9 @@ static int decode_format80(GetByteContext *gb, int src_size, | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | } else if (opcode == 0xFE) { |  |  | } else if (opcode == 0xFE) { | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | count = bytestream2_get_le16(gb); |  |  |  | 
														
													
														
															
																|  |  | color = bytestream2_get_byte(gb); |  |  |  | 
														
													
														
															
																|  |  | av_dlog(NULL, "(2) set %X bytes to %02X\n", count, color); |  |  |  | 
														
													
														
															
																|  |  |  |  |  | count = bytestream2_get_le16(&s->gb); | 
														
													
														
															
																|  |  |  |  |  | color = bytestream2_get_byte(&s->gb); | 
														
													
														
															
																|  |  |  |  |  | av_dlog(s->avctx, "(2) set %X bytes to %02X\n", count, color); | 
														
													
														
															
																|  |  | CHECK_COUNT(); |  |  | CHECK_COUNT(); | 
														
													
														
															
																|  |  | memset(&dest[dest_index], color, count); |  |  | memset(&dest[dest_index], color, count); | 
														
													
														
															
																|  |  | dest_index += count; |  |  | dest_index += count; | 
														
													
												
													
														
															
																|  | @@ -265,8 +265,8 @@ static int decode_format80(GetByteContext *gb, int src_size, | 
														
													
														
															
																|  |  | } else if ((opcode & 0xC0) == 0xC0) { |  |  | } else if ((opcode & 0xC0) == 0xC0) { | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | count = (opcode & 0x3F) + 3; |  |  | count = (opcode & 0x3F) + 3; | 
														
													
														
															
																|  |  | src_pos = bytestream2_get_le16(gb); |  |  |  | 
														
													
														
															
																|  |  | av_dlog(NULL, "(3) copy %X bytes from absolute pos %X\n", count, src_pos); |  |  |  | 
														
													
														
															
																|  |  |  |  |  | src_pos = bytestream2_get_le16(&s->gb); | 
														
													
														
															
																|  |  |  |  |  | av_dlog(s->avctx, "(3) copy %X bytes from absolute pos %X\n", count, src_pos); | 
														
													
														
															
																|  |  | CHECK_COUNT(); |  |  | CHECK_COUNT(); | 
														
													
														
															
																|  |  | CHECK_COPY(src_pos); |  |  | CHECK_COPY(src_pos); | 
														
													
														
															
																|  |  | for (i = 0; i < count; i++) |  |  | for (i = 0; i < count; i++) | 
														
													
												
													
														
															
																|  | @@ -276,16 +276,16 @@ static int decode_format80(GetByteContext *gb, int src_size, | 
														
													
														
															
																|  |  | } else if (opcode > 0x80) { |  |  | } else if (opcode > 0x80) { | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | count = opcode & 0x3F; |  |  | count = opcode & 0x3F; | 
														
													
														
															
																|  |  | av_dlog(NULL, "(4) copy %X bytes from source to dest\n", count); |  |  |  | 
														
													
														
															
																|  |  |  |  |  | av_dlog(s->avctx, "(4) copy %X bytes from source to dest\n", count); | 
														
													
														
															
																|  |  | CHECK_COUNT(); |  |  | CHECK_COUNT(); | 
														
													
														
															
																|  |  | bytestream2_get_buffer(gb, &dest[dest_index], count); |  |  |  | 
														
													
														
															
																|  |  |  |  |  | bytestream2_get_buffer(&s->gb, &dest[dest_index], count); | 
														
													
														
															
																|  |  | dest_index += count; |  |  | dest_index += count; | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | } else { |  |  | } else { | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | count = ((opcode & 0x70) >> 4) + 3; |  |  | count = ((opcode & 0x70) >> 4) + 3; | 
														
													
														
															
																|  |  | src_pos = bytestream2_get_byte(gb) | ((opcode & 0x0F) << 8); |  |  |  | 
														
													
														
															
																|  |  | av_dlog(NULL, "(5) copy %X bytes from relpos %X\n", count, src_pos); |  |  |  | 
														
													
														
															
																|  |  |  |  |  | src_pos = bytestream2_get_byte(&s->gb) | ((opcode & 0x0F) << 8); | 
														
													
														
															
																|  |  |  |  |  | av_dlog(s->avctx, "(5) copy %X bytes from relpos %X\n", count, src_pos); | 
														
													
														
															
																|  |  | CHECK_COUNT(); |  |  | CHECK_COUNT(); | 
														
													
														
															
																|  |  | CHECK_COPY(dest_index - src_pos); |  |  | CHECK_COPY(dest_index - src_pos); | 
														
													
														
															
																|  |  | for (i = 0; i < count; i++) |  |  | for (i = 0; i < count; i++) | 
														
													
												
													
														
															
																|  | @@ -300,7 +300,7 @@ static int decode_format80(GetByteContext *gb, int src_size, | 
														
													
														
															
																|  |  | * not every entry needs to be filled */ |  |  | * not every entry needs to be filled */ | 
														
													
														
															
																|  |  | if (check_size) |  |  | if (check_size) | 
														
													
														
															
																|  |  | if (dest_index < dest_size) |  |  | if (dest_index < dest_size) | 
														
													
														
															
																|  |  | av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: decode finished with dest_index (%d) < dest_size (%d)\n", |  |  |  | 
														
													
														
															
																|  |  |  |  |  | av_log(s->avctx, AV_LOG_ERROR, "decode_format80 problem: decode finished with dest_index (%d) < dest_size (%d)\n", | 
														
													
														
															
																|  |  | dest_index, dest_size); |  |  | dest_index, dest_size); | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | return 0; // let's display what we decoded anyway |  |  | return 0; // let's display what we decoded anyway | 
														
													
												
													
														
															
																|  | @@ -434,7 +434,7 @@ static int vqa_decode_chunk(VqaContext *s) | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | bytestream2_seek(&s->gb, cbfz_chunk, SEEK_SET); |  |  | bytestream2_seek(&s->gb, cbfz_chunk, SEEK_SET); | 
														
													
														
															
																|  |  | chunk_size = bytestream2_get_be32(&s->gb); |  |  | chunk_size = bytestream2_get_be32(&s->gb); | 
														
													
														
															
																|  |  | if ((res = decode_format80(&s->gb, chunk_size, s->codebook, |  |  |  | 
														
													
														
															
																|  |  |  |  |  | if ((res = decode_format80(s, chunk_size, s->codebook, | 
														
													
														
															
																|  |  | s->codebook_size, 0)) < 0) |  |  | s->codebook_size, 0)) < 0) | 
														
													
														
															
																|  |  | return res; |  |  | return res; | 
														
													
														
															
																|  |  | } |  |  | } | 
														
													
												
													
														
															
																|  | @@ -464,7 +464,7 @@ static int vqa_decode_chunk(VqaContext *s) | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | bytestream2_seek(&s->gb, vptz_chunk, SEEK_SET); |  |  | bytestream2_seek(&s->gb, vptz_chunk, SEEK_SET); | 
														
													
														
															
																|  |  | chunk_size = bytestream2_get_be32(&s->gb); |  |  | chunk_size = bytestream2_get_be32(&s->gb); | 
														
													
														
															
																|  |  | if ((res = decode_format80(&s->gb, chunk_size, |  |  |  | 
														
													
														
															
																|  |  |  |  |  | if ((res = decode_format80(s, chunk_size, | 
														
													
														
															
																|  |  | s->decode_buffer, s->decode_buffer_size, 1)) < 0) |  |  | s->decode_buffer, s->decode_buffer_size, 1)) < 0) | 
														
													
														
															
																|  |  | return res; |  |  | return res; | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
												
													
														
															
																|  | @@ -570,7 +570,7 @@ static int vqa_decode_chunk(VqaContext *s) | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | bytestream2_init(&gb, s->next_codebook_buffer, s->next_codebook_buffer_index); |  |  | bytestream2_init(&gb, s->next_codebook_buffer, s->next_codebook_buffer_index); | 
														
													
														
															
																|  |  | /* decompress codebook */ |  |  | /* decompress codebook */ | 
														
													
														
															
																|  |  | if ((res = decode_format80(&gb, s->next_codebook_buffer_index, |  |  |  | 
														
													
														
															
																|  |  |  |  |  | if ((res = decode_format80(s, s->next_codebook_buffer_index, | 
														
													
														
															
																|  |  | s->codebook, s->codebook_size, 0)) < 0) |  |  | s->codebook, s->codebook_size, 0)) < 0) | 
														
													
														
															
																|  |  | return res; |  |  | return res; | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
												
													
														
															
																|  | @@ -594,7 +594,7 @@ static int vqa_decode_frame(AVCodecContext *avctx, | 
														
													
														
															
																|  |  | avctx->release_buffer(avctx, &s->frame); |  |  | avctx->release_buffer(avctx, &s->frame); | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
														
															
																|  |  | if (avctx->get_buffer(avctx, &s->frame)) { |  |  | if (avctx->get_buffer(avctx, &s->frame)) { | 
														
													
														
															
																|  |  | av_log(s->avctx, AV_LOG_ERROR, "  VQA Video: get_buffer() failed\n"); |  |  |  | 
														
													
														
															
																|  |  |  |  |  | av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\n"); | 
														
													
														
															
																|  |  | return -1; |  |  | return -1; | 
														
													
														
															
																|  |  | } |  |  | } | 
														
													
														
															
																|  |  | 
 |  |  | 
 | 
														
													
												
													
														
															
																|  | 
 |