Merge commit 'dbaf3f7b0bc9e99dff8e06bd29fcb3e84eebfe7c' into release/1.1
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 2 Jun 2013 23:56:10 +0000 (01:56 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 2 Jun 2013 23:57:01 +0000 (01:57 +0200)
* commit 'dbaf3f7b0bc9e99dff8e06bd29fcb3e84eebfe7c':
  vmd: drop incomplete chunks and spurious samples
  vmd: return meaningful errors

Conflicts:
libavcodec/vmdav.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/vmdav.c

@@@ -43,6 -43,6 +43,7 @@@
  #include <stdlib.h>
  #include <string.h>
  
++#include "libavutil/avassert.h"
  #include "libavutil/channel_layout.h"
  #include "libavutil/common.h"
  #include "libavutil/intreadwrite.h"
@@@ -253,10 -261,13 +262,13 @@@ static int vmd_decode(VmdVideoContext *
                  r = bytestream2_get_byteu(&gb) * 4;
                  g = bytestream2_get_byteu(&gb) * 4;
                  b = bytestream2_get_byteu(&gb) * 4;
 -                palette32[i] = (r << 16) | (g << 8) | (b);
 +                palette32[i] = 0xFFU << 24 | (r << 16) | (g << 8) | (b);
 +                palette32[i] |= palette32[i] >> 6 & 0x30303;
              }
+         } else {
+             av_log(s->avctx, AV_LOG_ERROR, "Incomplete palette\n");
+             return AVERROR_INVALIDDATA;
          }
 -        s->size -= (256 * 3 + 2);
      }
      if (s->size > 0) {
          /* originally UnpackFrame in VAG's code */
                      }
                  } while (ofs < frame_width);
                  if (ofs > frame_width) {
 -                    av_log(s->avctx, AV_LOG_ERROR, "VMD video: offset > width (%d > %d)\n",
 +                    av_log(s->avctx, AV_LOG_ERROR, "offset > width (%d > %d)\n",
                          ofs, frame_width);
-                     break;
+                     return AVERROR_INVALIDDATA;
                  }
                  dp += s->frame.linesize[0];
                  pp += s->prev_frame.linesize[0];
                      }
                  } while (ofs < frame_width);
                  if (ofs > frame_width) {
 -                    av_log(s->avctx, AV_LOG_ERROR, "VMD video: offset > width (%d > %d)\n",
 +                    av_log(s->avctx, AV_LOG_ERROR, "offset > width (%d > %d)\n",
                          ofs, frame_width);
+                     return AVERROR_INVALIDDATA;
                  }
                  dp += s->frame.linesize[0];
                  pp += s->prev_frame.linesize[0];
@@@ -399,11 -409,11 +413,11 @@@ static int vmdvideo_decode_frame(AVCode
      s->size = buf_size;
  
      if (buf_size < 16)
-         return buf_size;
+         return AVERROR_INVALIDDATA;
  
 -    s->frame.reference = 1;
 +    s->frame.reference = 3;
      if (ff_get_buffer(avctx, &s->frame)) {
 -        av_log(s->avctx, AV_LOG_ERROR, "VMD Video: get_buffer() failed\n");
 +        av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\n");
          return -1;
      }
  
@@@ -599,8 -613,8 +617,9 @@@ static int vmdaudio_decode_frame(AVCode
  
      /* decode audio chunks */
      if (audio_chunks > 0) {
 -        buf_end = buf + (buf_size & ~(avctx->channels > 1));
 -        while (buf + s->chunk_size <= buf_end) {
 +        buf_end = buf + buf_size;
++        av_assert0((buf_size & (avctx->channels > 1)) == 0);
 +        while (buf_end - buf >= s->chunk_size) {
              if (s->out_bps == 2) {
                  decode_audio_s16(output_samples_s16, buf, s->chunk_size,
                                   avctx->channels);