OSDN Git Service

Fixed invalid access in wavpack decoder on corrupted bitstream.
[coroid/libav_saccubus.git] / libavcodec / intelh263dec.c
1 /*
2  * H.263i decoder
3  *
4  * This file is part of Libav.
5  *
6  * Libav is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * Libav is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with Libav; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19  */
20
21 #include "mpegvideo.h"
22 #include "h263.h"
23
24 /* don't understand why they choose a different header ! */
25 int ff_intel_h263_decode_picture_header(MpegEncContext *s)
26 {
27     int format;
28
29     /* picture header */
30     if (get_bits_long(&s->gb, 22) != 0x20) {
31         av_log(s->avctx, AV_LOG_ERROR, "Bad picture start code\n");
32         return -1;
33     }
34     s->picture_number = get_bits(&s->gb, 8); /* picture timestamp */
35
36     if (get_bits1(&s->gb) != 1) {
37         av_log(s->avctx, AV_LOG_ERROR, "Bad marker\n");
38         return -1;      /* marker */
39     }
40     if (get_bits1(&s->gb) != 0) {
41         av_log(s->avctx, AV_LOG_ERROR, "Bad H263 id\n");
42         return -1;      /* h263 id */
43     }
44     skip_bits1(&s->gb);         /* split screen off */
45     skip_bits1(&s->gb);         /* camera  off */
46     skip_bits1(&s->gb);         /* freeze picture release off */
47
48     format = get_bits(&s->gb, 3);
49     if (format == 0 || format == 6) {
50         av_log(s->avctx, AV_LOG_ERROR, "Intel H263 free format not supported\n");
51         return -1;
52     }
53     s->h263_plus = 0;
54
55     s->pict_type = AV_PICTURE_TYPE_I + get_bits1(&s->gb);
56
57     s->unrestricted_mv = get_bits1(&s->gb);
58     s->h263_long_vectors = s->unrestricted_mv;
59
60     if (get_bits1(&s->gb) != 0) {
61         av_log(s->avctx, AV_LOG_ERROR, "SAC not supported\n");
62         return -1;      /* SAC: off */
63     }
64     s->obmc= get_bits1(&s->gb);
65     s->pb_frame = get_bits1(&s->gb);
66
67     if (format < 6) {
68         s->width = h263_format[format][0];
69         s->height = h263_format[format][1];
70         s->avctx->sample_aspect_ratio.num = 12;
71         s->avctx->sample_aspect_ratio.den = 11;
72     } else {
73         format = get_bits(&s->gb, 3);
74         if(format == 0 || format == 7){
75             av_log(s->avctx, AV_LOG_ERROR, "Wrong Intel H263 format\n");
76             return -1;
77         }
78         if(get_bits(&s->gb, 2))
79             av_log(s->avctx, AV_LOG_ERROR, "Bad value for reserved field\n");
80         s->loop_filter = get_bits1(&s->gb);
81         if(get_bits1(&s->gb))
82             av_log(s->avctx, AV_LOG_ERROR, "Bad value for reserved field\n");
83         if(get_bits1(&s->gb))
84             s->pb_frame = 2;
85         if(get_bits(&s->gb, 5))
86             av_log(s->avctx, AV_LOG_ERROR, "Bad value for reserved field\n");
87         if(get_bits(&s->gb, 5) != 1)
88             av_log(s->avctx, AV_LOG_ERROR, "Invalid marker\n");
89     }
90     if(format == 6){
91         int ar = get_bits(&s->gb, 4);
92         skip_bits(&s->gb, 9); // display width
93         skip_bits1(&s->gb);
94         skip_bits(&s->gb, 9); // display height
95         if(ar == 15){
96             s->avctx->sample_aspect_ratio.num = get_bits(&s->gb, 8); // aspect ratio - width
97             s->avctx->sample_aspect_ratio.den = get_bits(&s->gb, 8); // aspect ratio - height
98         } else {
99             s->avctx->sample_aspect_ratio = ff_h263_pixel_aspect[ar];
100         }
101         if (s->avctx->sample_aspect_ratio.num == 0)
102             av_log(s->avctx, AV_LOG_ERROR, "Invalid aspect ratio.\n");
103     }
104
105     s->chroma_qscale= s->qscale = get_bits(&s->gb, 5);
106     skip_bits1(&s->gb); /* Continuous Presence Multipoint mode: off */
107
108     if(s->pb_frame){
109         skip_bits(&s->gb, 3); //temporal reference for B-frame
110         skip_bits(&s->gb, 2); //dbquant
111     }
112
113     /* PEI */
114     while (get_bits1(&s->gb) != 0) {
115         skip_bits(&s->gb, 8);
116     }
117     s->f_code = 1;
118
119     s->y_dc_scale_table=
120     s->c_dc_scale_table= ff_mpeg1_dc_scale_table;
121
122     ff_h263_show_pict_info(s);
123
124     return 0;
125 }
126
127 AVCodec ff_h263i_decoder = {
128     .name           = "h263i",
129     .type           = AVMEDIA_TYPE_VIDEO,
130     .id             = CODEC_ID_H263I,
131     .priv_data_size = sizeof(MpegEncContext),
132     .init           = ff_h263_decode_init,
133     .close          = ff_h263_decode_end,
134     .decode         = ff_h263_decode_frame,
135     .capabilities   = CODEC_CAP_DRAW_HORIZ_BAND | CODEC_CAP_DR1,
136     .long_name = NULL_IF_CONFIG_SMALL("Intel H.263"),
137     .pix_fmts= ff_pixfmt_list_420,
138 };
139