Merge commit 'c5c7e3e6f7cf17943c04bd078f260eaf789afbc9' into release/1.1
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 12 Jan 2014 14:48:39 +0000 (15:48 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 12 Jan 2014 14:48:39 +0000 (15:48 +0100)
* commit 'c5c7e3e6f7cf17943c04bd078f260eaf789afbc9':
  gifdec: check that the image dimensions are non-zero
  gifdec: return meaningful error codes.
  eacmv: check the framerate before setting it.
  rv30: fix extradata size check.
  sdp: Check that fmt->oformat is non-null before accessing it
  matroskadec: use correct compression parameters for current track CodecPrivate
  vc1: Reset numref if fieldmode is not set

Conflicts:
libavcodec/gifdec.c
libavcodec/rv30.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/eacmv.c
libavcodec/gifdec.c
libavcodec/rv30.c
libavcodec/vc1.c
libavformat/sdp.c

Simple merge
@@@ -185,53 -90,33 +185,56 @@@ static int gif_read_image(GifState *s
  
      /* verify that all the image is inside the screen dimensions */
      if (left + width > s->screen_width ||
-         top + height > s->screen_height)
+         top + height > s->screen_height ||
+         !width || !height) {
+         av_log(s->avctx, AV_LOG_ERROR, "Invalid image dimensions.\n");
          return AVERROR_INVALIDDATA;
+     }
  
 -    /* build the palette */
 -    n = (1 << bits_per_pixel);
 -    spal = palette;
 -    for(i = 0; i < n; i++) {
 -        s->image_palette[i] = (0xffu << 24) | AV_RB24(spal);
 -        spal += 3;
 +    /* process disposal method */
 +    if (s->gce_prev_disposal == GCE_DISPOSAL_BACKGROUND) {
 +        gif_fill_rect(&s->picture, s->stored_bg_color, s->gce_l, s->gce_t, s->gce_w, s->gce_h);
 +    } else if (s->gce_prev_disposal == GCE_DISPOSAL_RESTORE) {
 +        gif_copy_img_rect(s->stored_img, (uint32_t *)s->picture.data[0],
 +            s->picture.linesize[0] / sizeof(uint32_t), s->gce_l, s->gce_t, s->gce_w, s->gce_h);
      }
 -    for(; i < 256; i++)
 -        s->image_palette[i] = (0xffu << 24);
 -    /* handle transparency */
 -    if (s->transparent_color_index >= 0)
 -        s->image_palette[s->transparent_color_index] = 0;
 +
 +    s->gce_prev_disposal = s->gce_disposal;
 +
 +    if (s->gce_disposal != GCE_DISPOSAL_NONE) {
 +        s->gce_l = left;  s->gce_t = top;
 +        s->gce_w = width; s->gce_h = height;
 +
 +        if (s->gce_disposal == GCE_DISPOSAL_BACKGROUND) {
 +            if (s->transparent_color_index >= 0)
 +                s->stored_bg_color = s->trans_color;
 +            else
 +                s->stored_bg_color = s->bg_color;
 +        } else if (s->gce_disposal == GCE_DISPOSAL_RESTORE) {
 +            av_fast_malloc(&s->stored_img, &s->stored_img_size, s->picture.linesize[0] * s->picture.height);
 +            if (!s->stored_img)
 +                return AVERROR(ENOMEM);
 +
 +            gif_copy_img_rect((uint32_t *)s->picture.data[0], s->stored_img,
 +                s->picture.linesize[0] / sizeof(uint32_t), left, top, width, height);
 +        }
 +    }
 +
 +    /* Expect at least 2 bytes: 1 for lzw code size and 1 for block size. */
 +    if (bytestream2_get_bytes_left(&s->gb) < 2)
 +        return AVERROR_INVALIDDATA;
  
      /* now get the image data */
 -    code_size = bytestream_get_byte(&s->bytestream);
 -    ff_lzw_decode_init(s->lzw, code_size, s->bytestream,
 -                       s->bytestream_end - s->bytestream, FF_LZW_GIF);
 +    code_size = bytestream2_get_byteu(&s->gb);
 +    if ((ret = ff_lzw_decode_init(s->lzw, code_size, s->gb.buffer,
 +                                  bytestream2_get_bytes_left(&s->gb), FF_LZW_GIF)) < 0) {
 +        av_log(s->avctx, AV_LOG_ERROR, "LZW init failed\n");
 +        return ret;
 +    }
  
      /* read all the image */
 -    linesize = s->picture.linesize[0];
 -    ptr1 = s->picture.data[0] + top * linesize + left;
 +    linesize = s->picture.linesize[0] / sizeof(uint32_t);
 +    ptr1 = (uint32_t *)s->picture.data[0] + top * linesize + left;
      ptr = ptr1;
      pass = 0;
      y1 = 0;
@@@ -409,19 -248,18 +412,19 @@@ static int gif_read_header1(GifState *s
      return 0;
  }
  
 -static int gif_parse_next_image(GifState *s)
 +static int gif_parse_next_image(GifState *s, int *got_picture)
  {
-     int ret;
 -    while (s->bytestream < s->bytestream_end) {
 -        int code = bytestream_get_byte(&s->bytestream);
 +    *got_picture = 1;
 +    while (bytestream2_get_bytes_left(&s->gb)) {
 +        int code = bytestream2_get_byte(&s->gb);
+         int ret;
  
 -        av_dlog(s->avctx, "gif: code=%02x '%c'\n", code, code);
 +        av_dlog(s->avctx, "code=%02x '%c'\n", code, code);
  
          switch (code) {
 -        case ',':
 +        case GIF_IMAGE_SEPARATOR:
              return gif_read_image(s);
 -        case '!':
 +        case GIF_EXTENSION_INTRODUCER:
              if ((ret = gif_read_extension(s)) < 0)
                  return ret;
              break;
@@@ -51,12 -52,14 +52,19 @@@ static int rv30_parse_slice_header(RV34
      skip_bits1(gb);
      si->pts = get_bits(gb, 13);
      rpr = get_bits(gb, r->rpr);
 +    if (r->s.avctx->extradata_size < 8 + rpr*2) {
 +        av_log(r->s.avctx, AV_LOG_WARNING,
 +               "Extradata does not contain selected resolution\n");
 +        rpr = 0;
 +    }
      if(rpr){
+         if (avctx->extradata_size < rpr * 2 + 8) {
+             av_log(avctx, AV_LOG_ERROR,
+                    "Insufficient extradata - need at least %d bytes, got %d\n",
+                    8 + rpr * 2, avctx->extradata_size);
+             return AVERROR(EINVAL);
+         }
          w = r->s.avctx->extradata[6 + rpr*2] << 2;
          h = r->s.avctx->extradata[7 + rpr*2] << 2;
      }
Simple merge
Simple merge