Merge commit '10f77c165c3b3e881bb174a0f57dd62083639072' into release/1.1
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 2 Jun 2013 22:40:23 +0000 (00:40 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 2 Jun 2013 22:40:23 +0000 (00:40 +0200)
* commit '10f77c165c3b3e881bb174a0f57dd62083639072':
  pixdesc: mark gray8 as pseudopal
  mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
  mjpeg: Validate sampling factors
  ljpeg: use the correct number of components in yuv
  wavpack: validate samples size parsed in wavpack_decode_block

Conflicts:
libavcodec/mjpegdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/mjpegdec.c
libavcodec/wavpack.c

@@@ -272,24 -255,25 +272,27 @@@ int ff_mjpeg_decode_sof(MJpegDecodeCont
      for (i = 0; i < nb_components; i++) {
          /* component id */
          s->component_id[i] = get_bits(&s->gb, 8) - 1;
 -        s->h_count[i]      = get_bits(&s->gb, 4);
 -        s->v_count[i]      = get_bits(&s->gb, 4);
 +        h_count[i]         = get_bits(&s->gb, 4);
 +        v_count[i]         = get_bits(&s->gb, 4);
          /* compute hmax and vmax (only used in interleaved case) */
 -        if (s->h_count[i] > s->h_max)
 -            s->h_max = s->h_count[i];
 -        if (s->v_count[i] > s->v_max)
 -            s->v_max = s->v_count[i];
 +        if (h_count[i] > s->h_max)
 +            s->h_max = h_count[i];
 +        if (v_count[i] > s->v_max)
 +            s->v_max = v_count[i];
-         if (!h_count[i] || !v_count[i]) {
-             av_log(s->avctx, AV_LOG_ERROR, "h/v_count is 0\n");
-             return -1;
-         }
          s->quant_index[i] = get_bits(&s->gb, 8);
 -        if (s->quant_index[i] >= 4)
 +        if (s->quant_index[i] >= 4) {
 +            av_log(s->avctx, AV_LOG_ERROR, "quant_index is invalid\n");
              return AVERROR_INVALIDDATA;
 -        if (!s->h_count[i] || !s->v_count[i]) {
 +        }
++        if (!h_count[i] || !v_count[i]) {
+             av_log(s->avctx, AV_LOG_ERROR,
+                    "Invalid sampling factor in component %d %d:%d\n",
 -                   i, s->h_count[i], s->v_count[i]);
++                   i, h_count[i], v_count[i]);
+             return AVERROR_INVALIDDATA;
+         }
          av_log(s->avctx, AV_LOG_DEBUG, "component %d %d:%d id: %d quant:%d\n",
 -               i, s->h_count[i], s->v_count[i],
 +               i, h_count[i], v_count[i],
                 s->component_id[i], s->quant_index[i]);
      }
  
@@@ -845,17 -716,9 +848,16 @@@ static int ljpeg_decode_rgb_scan(MJpegD
  }
  
  static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor,
-                                  int point_transform)
+                                  int point_transform, int nb_components)
  {
      int i, mb_x, mb_y;
-     const int nb_components=s->nb_components;
 +    int bits= (s->bits+7)&~7;
 +    int resync_mb_y = 0;
 +    int resync_mb_x = 0;
 +
 +    point_transform += bits - s->bits;
 +
-     av_assert0(nb_components==1 || nb_components==3);
++    av_assert0(nb_components>=1 && nb_components<=3);
  
      for (mb_y = 0; mb_y < s->mb_height; mb_y++) {
          for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
@@@ -1123,11 -943,15 +1125,12 @@@ static int mjpeg_decode_scan_progressiv
      int linesize  = s->linesize[c];
      int last_scan = 0;
      int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]];
 -    GetBitContext mb_bitmask_gb;
  
-     if (se > 63) {
-         av_log(s->avctx, AV_LOG_ERROR, "SE %d is too large\n", se);
 -    if (ss < 0  || ss >= 64 ||
 -        se < ss || se >= 64 ||
 -        Ah < 0  || Al < 0)
++    av_assert0(ss>=0 && Ah>=0 && Al>=0);
++    if (se < ss || se > 63) {
++        av_log(s->avctx, AV_LOG_ERROR, "SS/SE %d/%d is invalid\n", ss, se);
          return AVERROR_INVALIDDATA;
 -
 -    if (mb_bitmask)
 -        init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height);
 +    }
  
      if (!Al) {
          s->coefs_finished[c] |= (1LL << (se + 1)) - (1LL << ss);
@@@ -1284,10 -1100,13 +1287,12 @@@ next_field
                  return ret;
          } else {
              if (s->rgb) {
 -                if ((ret = ljpeg_decode_rgb_scan(s, predictor,
 -                                                 point_transform)) < 0)
 +                if ((ret = ljpeg_decode_rgb_scan(s, nb_components, predictor, point_transform)) < 0)
                      return ret;
              } else {
-                 if ((ret = ljpeg_decode_yuv_scan(s, predictor, point_transform)) < 0)
+                 if ((ret = ljpeg_decode_yuv_scan(s, predictor,
+                                                  point_transform,
+                                                  nb_components)) < 0)
                      return ret;
              }
          }
Simple merge