Browse code

bethsoftvideo: Use bytestream2 functions to prevent buffer overreads.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Aneesh Dogra authored on 2012/01/11 03:08:03
Showing 1 changed files
... ...
@@ -34,6 +34,7 @@
34 34
 
35 35
 typedef struct BethsoftvidContext {
36 36
     AVFrame frame;
37
+    GetByteContext g;
37 38
 } BethsoftvidContext;
38 39
 
39 40
 static av_cold int bethsoftvid_decode_init(AVCodecContext *avctx)
... ...
@@ -46,18 +47,18 @@ static av_cold int bethsoftvid_decode_init(AVCodecContext *avctx)
46 46
     return 0;
47 47
 }
48 48
 
49
-static int set_palette(AVFrame * frame, const uint8_t * palette_buffer, int buf_size)
49
+static int set_palette(BethsoftvidContext *ctx)
50 50
 {
51
-    uint32_t * palette = (uint32_t *)frame->data[1];
51
+    uint32_t *palette = (uint32_t *)ctx->frame.data[1];
52 52
     int a;
53 53
 
54
-    if (buf_size < 256*3)
54
+    if (bytestream2_get_bytes_left(&ctx->g) < 256*3)
55 55
         return AVERROR_INVALIDDATA;
56 56
 
57 57
     for(a = 0; a < 256; a++){
58
-        palette[a] = AV_RB24(&palette_buffer[a * 3]) * 4;
58
+        palette[a] = bytestream2_get_be24u(&ctx->g) * 4;
59 59
     }
60
-    frame->palette_has_changed = 1;
60
+    ctx->frame.palette_has_changed = 1;
61 61
     return 256*3;
62 62
 }
63 63
 
... ...
@@ -65,8 +66,6 @@ static int bethsoftvid_decode_frame(AVCodecContext *avctx,
65 65
                               void *data, int *data_size,
66 66
                               AVPacket *avpkt)
67 67
 {
68
-    const uint8_t *buf = avpkt->data;
69
-    int buf_size = avpkt->size;
70 68
     BethsoftvidContext * vid = avctx->priv_data;
71 69
     char block_type;
72 70
     uint8_t * dst;
... ...
@@ -80,29 +79,32 @@ static int bethsoftvid_decode_frame(AVCodecContext *avctx,
80 80
         av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
81 81
         return -1;
82 82
     }
83
+
84
+    bytestream2_init(&vid->g, avpkt->data, avpkt->size);
83 85
     dst = vid->frame.data[0];
84 86
     frame_end = vid->frame.data[0] + vid->frame.linesize[0] * avctx->height;
85 87
 
86
-    switch(block_type = *buf++){
87
-        case PALETTE_BLOCK:
88
-            return set_palette(&vid->frame, buf, buf_size);
88
+    switch(block_type = bytestream2_get_byte(&vid->g)){
89
+        case PALETTE_BLOCK: {
90
+            return set_palette(vid);
91
+        }
89 92
         case VIDEO_YOFF_P_FRAME:
90
-            yoffset = bytestream_get_le16(&buf);
93
+            yoffset = bytestream2_get_le16(&vid->g);
91 94
             if(yoffset >= avctx->height)
92 95
                 return -1;
93 96
             dst += vid->frame.linesize[0] * yoffset;
94 97
     }
95 98
 
96 99
     // main code
97
-    while((code = *buf++)){
100
+    while((code = bytestream2_get_byte(&vid->g))){
98 101
         int length = code & 0x7f;
99 102
 
100 103
         // copy any bytes starting at the current position, and ending at the frame width
101 104
         while(length > remaining){
102 105
             if(code < 0x80)
103
-                bytestream_get_buffer(&buf, dst, remaining);
106
+                bytestream2_get_buffer(&vid->g, dst, remaining);
104 107
             else if(block_type == VIDEO_I_FRAME)
105
-                memset(dst, buf[0], remaining);
108
+                memset(dst, bytestream2_peek_byte(&vid->g), remaining);
106 109
             length -= remaining;      // decrement the number of bytes to be copied
107 110
             dst += remaining + wrap_to_next_line;    // skip over extra bytes at end of frame
108 111
             remaining = avctx->width;
... ...
@@ -112,9 +114,9 @@ static int bethsoftvid_decode_frame(AVCodecContext *avctx,
112 112
 
113 113
         // copy any remaining bytes after / if line overflows
114 114
         if(code < 0x80)
115
-            bytestream_get_buffer(&buf, dst, length);
115
+            bytestream2_get_buffer(&vid->g, dst, length);
116 116
         else if(block_type == VIDEO_I_FRAME)
117
-            memset(dst, *buf++, length);
117
+            memset(dst, bytestream2_get_byte(&vid->g), length);
118 118
         remaining -= length;
119 119
         dst += length;
120 120
     }
... ...
@@ -123,7 +125,7 @@ static int bethsoftvid_decode_frame(AVCodecContext *avctx,
123 123
     *data_size = sizeof(AVFrame);
124 124
     *(AVFrame*)data = vid->frame;
125 125
 
126
-    return buf_size;
126
+    return avpkt->size;
127 127
 }
128 128
 
129 129
 static av_cold int bethsoftvid_decode_end(AVCodecContext *avctx)