| @@ -525,108 +525,108 @@ static int decode_frame(AVCodecContext *avctx, | |||
| // Process the actual scan line blocks | |||
| for (y = ymin; y <= ymax; y += scan_lines_per_block) { | |||
| uint16_t *ptr_x; | |||
| const uint8_t *red_channel_buffer, *green_channel_buffer, *blue_channel_buffer, *alpha_channel_buffer = 0; | |||
| const uint64_t line_offset = bytestream_get_le64(&buf); | |||
| int32_t data_size, line; | |||
| const uint8_t *red_channel_buffer, *green_channel_buffer, *blue_channel_buffer, *alpha_channel_buffer = 0; | |||
| const uint64_t line_offset = bytestream_get_le64(&buf); | |||
| int32_t data_size, line; | |||
| // Check if the buffer has the required bytes needed from the offset | |||
| if (line_offset > (uint64_t)buf_size - 8) | |||
| return AVERROR_INVALIDDATA; | |||
| // Check if the buffer has the required bytes needed from the offset | |||
| if (line_offset > (uint64_t)buf_size - 8) | |||
| return AVERROR_INVALIDDATA; | |||
| src = avpkt->data + line_offset + 8; | |||
| line = AV_RL32(src - 8); | |||
| if (line < ymin || line > ymax) | |||
| return AVERROR_INVALIDDATA; | |||
| src = avpkt->data + line_offset + 8; | |||
| line = AV_RL32(src - 8); | |||
| if (line < ymin || line > ymax) | |||
| return AVERROR_INVALIDDATA; | |||
| data_size = AV_RL32(src - 4); | |||
| if (data_size <= 0 || data_size > buf_size) | |||
| return AVERROR_INVALIDDATA; | |||
| data_size = AV_RL32(src - 4); | |||
| if (data_size <= 0 || data_size > buf_size) | |||
| return AVERROR_INVALIDDATA; | |||
| if ((s->compr == EXR_RAW && (data_size != uncompressed_size || | |||
| line_offset > buf_size - uncompressed_size)) || | |||
| (s->compr != EXR_RAW && line_offset > buf_size - data_size)) { | |||
| return AVERROR_INVALIDDATA; | |||
| } | |||
| if ((s->compr == EXR_RAW && (data_size != uncompressed_size || | |||
| line_offset > buf_size - uncompressed_size)) || | |||
| (s->compr != EXR_RAW && line_offset > buf_size - data_size)) { | |||
| return AVERROR_INVALIDDATA; | |||
| } | |||
| if (scan_lines_per_block > 1) | |||
| uncompressed_size = scan_line_size * FFMIN(scan_lines_per_block, ymax - y + 1); | |||
| if ((s->compr == EXR_ZIP1 || s->compr == EXR_ZIP16) && data_size < uncompressed_size) { | |||
| unsigned long dest_len = uncompressed_size; | |||
| if (scan_lines_per_block > 1) | |||
| uncompressed_size = scan_line_size * FFMIN(scan_lines_per_block, ymax - y + 1); | |||
| if ((s->compr == EXR_ZIP1 || s->compr == EXR_ZIP16) && data_size < uncompressed_size) { | |||
| unsigned long dest_len = uncompressed_size; | |||
| if (uncompress(s->tmp, &dest_len, src, data_size) != Z_OK || | |||
| dest_len != uncompressed_size) { | |||
| av_log(avctx, AV_LOG_ERROR, "error during zlib decompression\n"); | |||
| return AVERROR(EINVAL); | |||
| } | |||
| } else if (s->compr == EXR_RLE && data_size < uncompressed_size) { | |||
| if (rle_uncompress(src, data_size, s->tmp, uncompressed_size)) { | |||
| av_log(avctx, AV_LOG_ERROR, "error during rle decompression\n"); | |||
| return AVERROR(EINVAL); | |||
| } | |||
| } | |||
| if (uncompress(s->tmp, &dest_len, src, data_size) != Z_OK || | |||
| dest_len != uncompressed_size) { | |||
| av_log(avctx, AV_LOG_ERROR, "error during zlib decompression\n"); | |||
| return AVERROR(EINVAL); | |||
| } | |||
| } else if (s->compr == EXR_RLE && data_size < uncompressed_size) { | |||
| if (rle_uncompress(src, data_size, s->tmp, uncompressed_size)) { | |||
| av_log(avctx, AV_LOG_ERROR, "error during rle decompression\n"); | |||
| return AVERROR(EINVAL); | |||
| } | |||
| } | |||
| if (s->compr != EXR_RAW && data_size < uncompressed_size) { | |||
| predictor(s->tmp, uncompressed_size); | |||
| reorder_pixels(s->tmp, s->uncompressed_data, uncompressed_size); | |||
| red_channel_buffer = s->uncompressed_data + xdelta * s->channel_offsets[0]; | |||
| green_channel_buffer = s->uncompressed_data + xdelta * s->channel_offsets[1]; | |||
| blue_channel_buffer = s->uncompressed_data + xdelta * s->channel_offsets[2]; | |||
| if (s->channel_offsets[3] >= 0) | |||
| alpha_channel_buffer = s->uncompressed_data + xdelta * s->channel_offsets[3]; | |||
| } else { | |||
| red_channel_buffer = src + xdelta * s->channel_offsets[0]; | |||
| green_channel_buffer = src + xdelta * s->channel_offsets[1]; | |||
| blue_channel_buffer = src + xdelta * s->channel_offsets[2]; | |||
| if (s->channel_offsets[3] >= 0) | |||
| alpha_channel_buffer = src + xdelta * s->channel_offsets[3]; | |||
| } | |||
| if (s->compr != EXR_RAW && data_size < uncompressed_size) { | |||
| predictor(s->tmp, uncompressed_size); | |||
| reorder_pixels(s->tmp, s->uncompressed_data, uncompressed_size); | |||
| ptr = p->data[0] + line * stride; | |||
| for (i = 0; i < scan_lines_per_block && y + i <= ymax; i++, ptr += stride) { | |||
| const uint8_t *r, *g, *b, *a; | |||
| red_channel_buffer = s->uncompressed_data + xdelta * s->channel_offsets[0]; | |||
| green_channel_buffer = s->uncompressed_data + xdelta * s->channel_offsets[1]; | |||
| blue_channel_buffer = s->uncompressed_data + xdelta * s->channel_offsets[2]; | |||
| if (s->channel_offsets[3] >= 0) | |||
| alpha_channel_buffer = s->uncompressed_data + xdelta * s->channel_offsets[3]; | |||
| } else { | |||
| red_channel_buffer = src + xdelta * s->channel_offsets[0]; | |||
| green_channel_buffer = src + xdelta * s->channel_offsets[1]; | |||
| blue_channel_buffer = src + xdelta * s->channel_offsets[2]; | |||
| if (s->channel_offsets[3] >= 0) | |||
| alpha_channel_buffer = src + xdelta * s->channel_offsets[3]; | |||
| } | |||
| r = red_channel_buffer; | |||
| g = green_channel_buffer; | |||
| b = blue_channel_buffer; | |||
| ptr = p->data[0] + line * stride; | |||
| for (i = 0; i < scan_lines_per_block && y + i <= ymax; i++, ptr += stride) { | |||
| const uint8_t *r, *g, *b, *a; | |||
| r = red_channel_buffer; | |||
| g = green_channel_buffer; | |||
| b = blue_channel_buffer; | |||
| if (alpha_channel_buffer) | |||
| a = alpha_channel_buffer; | |||
| ptr_x = (uint16_t *)ptr; | |||
| // Zero out the start if xmin is not 0 | |||
| memset(ptr_x, 0, bxmin); | |||
| ptr_x += xmin * desc->nb_components; | |||
| if (s->bits_per_color_id == 2) { | |||
| // 32-bit | |||
| for (x = 0; x < xdelta; x++) { | |||
| *ptr_x++ = exr_flt2uint(bytestream_get_le32(&r)); | |||
| *ptr_x++ = exr_flt2uint(bytestream_get_le32(&g)); | |||
| *ptr_x++ = exr_flt2uint(bytestream_get_le32(&b)); | |||
| if (alpha_channel_buffer) | |||
| a = alpha_channel_buffer; | |||
| ptr_x = (uint16_t *)ptr; | |||
| // Zero out the start if xmin is not 0 | |||
| memset(ptr_x, 0, bxmin); | |||
| ptr_x += xmin * desc->nb_components; | |||
| if (s->bits_per_color_id == 2) { | |||
| // 32-bit | |||
| for (x = 0; x < xdelta; x++) { | |||
| *ptr_x++ = exr_flt2uint(bytestream_get_le32(&r)); | |||
| *ptr_x++ = exr_flt2uint(bytestream_get_le32(&g)); | |||
| *ptr_x++ = exr_flt2uint(bytestream_get_le32(&b)); | |||
| if (alpha_channel_buffer) | |||
| *ptr_x++ = exr_flt2uint(bytestream_get_le32(&a)); | |||
| } | |||
| } else { | |||
| // 16-bit | |||
| for (x = 0; x < xdelta; x++) { | |||
| *ptr_x++ = exr_halflt2uint(bytestream_get_le16(&r)); | |||
| *ptr_x++ = exr_halflt2uint(bytestream_get_le16(&g)); | |||
| *ptr_x++ = exr_halflt2uint(bytestream_get_le16(&b)); | |||
| if (alpha_channel_buffer) | |||
| *ptr_x++ = exr_halflt2uint(bytestream_get_le16(&a)); | |||
| } | |||
| } | |||
| // Zero out the end if xmax+1 is not w | |||
| memset(ptr_x, 0, axmax); | |||
| red_channel_buffer += scan_line_size; | |||
| green_channel_buffer += scan_line_size; | |||
| blue_channel_buffer += scan_line_size; | |||
| *ptr_x++ = exr_flt2uint(bytestream_get_le32(&a)); | |||
| } | |||
| } else { | |||
| // 16-bit | |||
| for (x = 0; x < xdelta; x++) { | |||
| *ptr_x++ = exr_halflt2uint(bytestream_get_le16(&r)); | |||
| *ptr_x++ = exr_halflt2uint(bytestream_get_le16(&g)); | |||
| *ptr_x++ = exr_halflt2uint(bytestream_get_le16(&b)); | |||
| if (alpha_channel_buffer) | |||
| alpha_channel_buffer += scan_line_size; | |||
| *ptr_x++ = exr_halflt2uint(bytestream_get_le16(&a)); | |||
| } | |||
| } | |||
| // Zero out the end if xmax+1 is not w | |||
| memset(ptr_x, 0, axmax); | |||
| red_channel_buffer += scan_line_size; | |||
| green_channel_buffer += scan_line_size; | |||
| blue_channel_buffer += scan_line_size; | |||
| if (alpha_channel_buffer) | |||
| alpha_channel_buffer += scan_line_size; | |||
| } | |||
| } | |||
| // Zero out the end if ymax+1 is not h | |||
| for (y = ymax + 1; y < avctx->height; y++) { | |||