highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/rl2: Fix undefined pointer arithmetic

Browse Source 
Don't increment back_frame if it does not correspond
to a real buffer. To do this, handle copying from
the back frame separately from the "use coded value"
codepath; also use memcpy for the former, as the
chunks here are typically worth it.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2022-09-28 17:58:00 +02:00
parent 73f104201b
commit 87f243911e
1 changed files with 28 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
libavcodec/rl2.c
View File

@ -69,13 +69,16 @@ static void rl2_rle_decode(Rl2Context *s, const uint8_t *in, int size,
uint8_t *line_end;
/** copy start of the background frame */
if (s->back_frame) {
for (i = 0; i <= base_y; i++) {
if (s->back_frame)
memcpy(out, back_frame, s->avctx->width);
out += stride;
back_frame += s->avctx->width;
}
back_frame += base_x - s->avctx->width;
} else {
out += stride * (base_y + 1);
}
line_end = out - stride_adj;
out += base_x - stride;
@ -89,16 +92,32 @@ static void rl2_rle_decode(Rl2Context *s, const uint8_t *in, int size,
len = *in++;
if (!len)
break;
val &= 0x7F;
}
if (s->back_frame)
if (back_frame) {
if (!val) {
do {
size_t copy = FFMIN(line_end - out, len);
memcpy(out, back_frame, copy);
out += copy;
back_frame += copy;
len -= copy;
if (out == line_end) {
if (out == out_end)
return;
out += stride_adj;
line_end += stride;
}
} while (len > 0);
continue;
}
back_frame += len;
val |= 0x80;
else
val &= ~0x80;
}
while (len--) {
*out++ = (val == 0x80) ? *back_frame : val;
back_frame++;
*out++ = val;
if (out == line_end) {
if (out == out_end)
return;
@ -164,7 +183,9 @@ static av_cold int rl2_decode_init(AVCodecContext *avctx)
back_size = avctx->extradata_size - EXTRADATA1_SIZE;
if (back_size > 0) {
uint8_t *back_frame = av_mallocz(avctx->width*avctx->height);
/* The 254 are padding to ensure that pointer arithmetic stays within
* the buffer. */
uint8_t *back_frame = av_mallocz(avctx->width * avctx->height + 254);
if (!back_frame)
return AVERROR(ENOMEM);
rl2_rle_decode(s, avctx->extradata + EXTRADATA1_SIZE, back_size,