|
|
|
@ -270,9 +270,11 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame) |
|
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
if (s->size > 0) { |
|
|
|
|
|
|
|
|
|
if (!s->size) |
|
|
|
|
return 0; |
|
|
|
|
|
|
|
|
|
/* originally UnpackFrame in VAG's code */ |
|
|
|
|
bytestream2_init(&gb, gb.buffer, s->buf + s->size - gb.buffer); |
|
|
|
|
if (bytestream2_get_bytes_left(&gb) < 1) |
|
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
|
meth = bytestream2_get_byteu(&gb); |
|
|
|
@ -293,7 +295,8 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame) |
|
|
|
|
len = bytestream2_get_byte(&gb); |
|
|
|
|
if (len & 0x80) { |
|
|
|
|
len = (len & 0x7F) + 1; |
|
|
|
|
if (ofs + len > frame_width || bytestream2_get_bytes_left(&gb) < len) |
|
|
|
|
if (ofs + len > frame_width || |
|
|
|
|
bytestream2_get_bytes_left(&gb) < len) |
|
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
|
bytestream2_get_bufferu(&gb, &dp[ofs], len); |
|
|
|
|
ofs += len; |
|
|
|
@ -306,7 +309,8 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame) |
|
|
|
|
} |
|
|
|
|
} while (ofs < frame_width); |
|
|
|
|
if (ofs > frame_width) { |
|
|
|
|
av_log(s->avctx, AV_LOG_ERROR, "offset > width (%d > %d)\n", |
|
|
|
|
av_log(s->avctx, AV_LOG_ERROR, |
|
|
|
|
"offset > width (%d > %d)\n", |
|
|
|
|
ofs, frame_width); |
|
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
|
} |
|
|
|
@ -346,7 +350,8 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame) |
|
|
|
|
} |
|
|
|
|
} while (ofs < frame_width); |
|
|
|
|
if (ofs > frame_width) { |
|
|
|
|
av_log(s->avctx, AV_LOG_ERROR, "offset > width (%d > %d)\n", |
|
|
|
|
av_log(s->avctx, AV_LOG_ERROR, |
|
|
|
|
"offset > width (%d > %d)\n", |
|
|
|
|
ofs, frame_width); |
|
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
|
} |
|
|
|
@ -355,7 +360,6 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame) |
|
|
|
|
} |
|
|
|
|
break; |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
return 0; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|