diff options
| author | Sebastian Dröge <slomo@circular-chaos.org> | 2013-09-19 12:55:37 +0200 |
|---|---|---|
| committer | Sebastian Dröge <slomo@circular-chaos.org> | 2013-09-19 12:55:37 +0200 |
| commit | 37017199e05383a1123242a04b8d0a9703d33220 (patch) | |
| tree | 3e017851b8876c9152d38652aa895743c6b59469 /gst-libs/ext/libav/libavcodec | |
| parent | 72cf3c094b40f37bb848e308308be15ccb056a5d (diff) | |
Imported Upstream version 1.1.90upstream/1.1.90
Diffstat (limited to 'gst-libs/ext/libav/libavcodec')
34 files changed, 1135 insertions, 732 deletions
diff --git a/gst-libs/ext/libav/libavcodec/4xm.c b/gst-libs/ext/libav/libavcodec/4xm.c index 99e0e2e..cc0361d 100644 --- a/gst-libs/ext/libav/libavcodec/4xm.c +++ b/gst-libs/ext/libav/libavcodec/4xm.c @@ -810,6 +810,12 @@ static int decode_frame(AVCodecContext *avctx, void *data, if (buf_size < 20) return AVERROR_INVALIDDATA; + if (avctx->width % 16 || avctx->height % 16) { + av_log(avctx, AV_LOG_ERROR, + "Dimensions non-multiple of 16 are invalid.\n"); + return AVERROR_INVALIDDATA; + } + if (buf_size < AV_RL32(buf + 4) + 8) { av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d\n", buf_size, AV_RL32(buf + 4)); diff --git a/gst-libs/ext/libav/libavcodec/8bps.c b/gst-libs/ext/libav/libavcodec/8bps.c index 8f0692c..3d81810 100644 --- a/gst-libs/ext/libav/libavcodec/8bps.c +++ b/gst-libs/ext/libav/libavcodec/8bps.c @@ -64,7 +64,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, unsigned char *pixptr, *pixptr_end; unsigned int height = avctx->height; // Real image height unsigned int dlen, p, row; - const unsigned char *lp, *dp; + const unsigned char *lp, *dp, *ep; unsigned char count; unsigned int px_inc; unsigned int planes = c->planes; @@ -80,6 +80,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, return -1; } + ep = encoded + buf_size; + /* Set data pointer after line lengths */ dp = encoded + planes * (height << 1); @@ -97,17 +99,19 @@ static int decode_frame(AVCodecContext *avctx, void *data, for (row = 0; row < height; row++) { pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p]; pixptr_end = pixptr + c->pic.linesize[0]; + if (ep - lp < row * 2 + 2) + return AVERROR_INVALIDDATA; dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2)); /* Decode a row of this plane */ while (dlen > 0) { - if (dp + 1 >= buf + buf_size) + if (ep - dp <= 1) return -1; if ((count = *dp++) <= 127) { count++; dlen -= count + 1; if (pixptr + count * px_inc > pixptr_end) break; - if (dp + count > buf + buf_size) + if (ep - dp < count) return -1; while (count--) { *pixptr = *dp++; diff --git a/gst-libs/ext/libav/libavcodec/aac_ac3_parser.h b/gst-libs/ext/libav/libavcodec/aac_ac3_parser.h index 90b49c5..99286f0 100644 --- a/gst-libs/ext/libav/libavcodec/aac_ac3_parser.h +++ b/gst-libs/ext/libav/libavcodec/aac_ac3_parser.h @@ -28,13 +28,13 @@ #include "parser.h" typedef enum { - AAC_AC3_PARSE_ERROR_SYNC = -1, - AAC_AC3_PARSE_ERROR_BSID = -2, - AAC_AC3_PARSE_ERROR_SAMPLE_RATE = -3, - AAC_AC3_PARSE_ERROR_FRAME_SIZE = -4, - AAC_AC3_PARSE_ERROR_FRAME_TYPE = -5, - AAC_AC3_PARSE_ERROR_CRC = -6, - AAC_AC3_PARSE_ERROR_CHANNEL_CFG = -7, + AAC_AC3_PARSE_ERROR_SYNC = -0x1030c0a, + AAC_AC3_PARSE_ERROR_BSID = -0x2030c0a, + AAC_AC3_PARSE_ERROR_SAMPLE_RATE = -0x3030c0a, + AAC_AC3_PARSE_ERROR_FRAME_SIZE = -0x4030c0a, + AAC_AC3_PARSE_ERROR_FRAME_TYPE = -0x5030c0a, + AAC_AC3_PARSE_ERROR_CRC = -0x6030c0a, + AAC_AC3_PARSE_ERROR_CHANNEL_CFG = -0x7030c0a, } AACAC3ParseError; typedef struct AACAC3ParseContext { diff --git a/gst-libs/ext/libav/libavcodec/aacdec.c b/gst-libs/ext/libav/libavcodec/aacdec.c index dec6d01..325bf63 100644 --- a/gst-libs/ext/libav/libavcodec/aacdec.c +++ b/gst-libs/ext/libav/libavcodec/aacdec.c @@ -206,28 +206,39 @@ struct elem_to_channel { static int assign_pair(struct elem_to_channel e2c_vec[MAX_ELEM_ID], uint8_t (*layout_map)[3], int offset, uint64_t left, - uint64_t right, int pos) + uint64_t right, int pos) { if (layout_map[offset][0] == TYPE_CPE) { e2c_vec[offset] = (struct elem_to_channel) { - .av_position = left | right, .syn_ele = TYPE_CPE, - .elem_id = layout_map[offset ][1], .aac_position = pos }; + .av_position = left | right, + .syn_ele = TYPE_CPE, + .elem_id = layout_map[offset][1], + .aac_position = pos + }; return 1; } else { - e2c_vec[offset] = (struct elem_to_channel) { - .av_position = left, .syn_ele = TYPE_SCE, - .elem_id = layout_map[offset ][1], .aac_position = pos }; + e2c_vec[offset] = (struct elem_to_channel) { + .av_position = left, + .syn_ele = TYPE_SCE, + .elem_id = layout_map[offset][1], + .aac_position = pos + }; e2c_vec[offset + 1] = (struct elem_to_channel) { - .av_position = right, .syn_ele = TYPE_SCE, - .elem_id = layout_map[offset + 1][1], .aac_position = pos }; + .av_position = right, + .syn_ele = TYPE_SCE, + .elem_id = layout_map[offset + 1][1], + .aac_position = pos + }; return 2; } } -static int count_paired_channels(uint8_t (*layout_map)[3], int tags, int pos, int *current) { +static int count_paired_channels(uint8_t (*layout_map)[3], int tags, int pos, + int *current) +{ int num_pos_channels = 0; - int first_cpe = 0; - int sce_parity = 0; + int first_cpe = 0; + int sce_parity = 0; int i; for (i = *current; i < tags; i++) { if (layout_map[i][2] != pos) @@ -241,7 +252,7 @@ static int count_paired_channels(uint8_t (*layout_map)[3], int tags, int pos, in } } num_pos_channels += 2; - first_cpe = 1; + first_cpe = 1; } else { num_pos_channels++; sce_parity ^= 1; @@ -249,7 +260,7 @@ static int count_paired_channels(uint8_t (*layout_map)[3], int tags, int pos, in } if (sce_parity && ((pos == AAC_CHANNEL_FRONT && first_cpe) || pos == AAC_CHANNEL_SIDE)) - return -1; + return -1; *current = i; return num_pos_channels; } @@ -257,7 +268,7 @@ static int count_paired_channels(uint8_t (*layout_map)[3], int tags, int pos, in static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) { int i, n, total_non_cc_elements; - struct elem_to_channel e2c_vec[4*MAX_ELEM_ID] = {{ 0 }}; + struct elem_to_channel e2c_vec[4 * MAX_ELEM_ID] = { { 0 } }; int num_front_channels, num_side_channels, num_back_channels; uint64_t layout; @@ -281,8 +292,11 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) i = 0; if (num_front_channels & 1) { e2c_vec[i] = (struct elem_to_channel) { - .av_position = AV_CH_FRONT_CENTER, .syn_ele = TYPE_SCE, - .elem_id = layout_map[i][1], .aac_position = AAC_CHANNEL_FRONT }; + .av_position = AV_CH_FRONT_CENTER, + .syn_ele = TYPE_SCE, + .elem_id = layout_map[i][1], + .aac_position = AAC_CHANNEL_FRONT + }; i++; num_front_channels--; } @@ -339,22 +353,31 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) } if (num_back_channels) { e2c_vec[i] = (struct elem_to_channel) { - .av_position = AV_CH_BACK_CENTER, .syn_ele = TYPE_SCE, - .elem_id = layout_map[i][1], .aac_position = AAC_CHANNEL_BACK }; + .av_position = AV_CH_BACK_CENTER, + .syn_ele = TYPE_SCE, + .elem_id = layout_map[i][1], + .aac_position = AAC_CHANNEL_BACK + }; i++; num_back_channels--; } if (i < tags && layout_map[i][2] == AAC_CHANNEL_LFE) { e2c_vec[i] = (struct elem_to_channel) { - .av_position = AV_CH_LOW_FREQUENCY, .syn_ele = TYPE_LFE, - .elem_id = layout_map[i][1], .aac_position = AAC_CHANNEL_LFE }; + .av_position = AV_CH_LOW_FREQUENCY, + .syn_ele = TYPE_LFE, + .elem_id = layout_map[i][1], + .aac_position = AAC_CHANNEL_LFE + }; i++; } while (i < tags && layout_map[i][2] == AAC_CHANNEL_LFE) { e2c_vec[i] = (struct elem_to_channel) { - .av_position = UINT64_MAX, .syn_ele = TYPE_LFE, - .elem_id = layout_map[i][1], .aac_position = AAC_CHANNEL_LFE }; + .av_position = UINT64_MAX, + .syn_ele = TYPE_LFE, + .elem_id = layout_map[i][1], + .aac_position = AAC_CHANNEL_LFE + }; i++; } @@ -362,12 +385,11 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) total_non_cc_elements = n = i; do { int next_n = 0; - for (i = 1; i < n; i++) { - if (e2c_vec[i-1].av_position > e2c_vec[i].av_position) { - FFSWAP(struct elem_to_channel, e2c_vec[i-1], e2c_vec[i]); + for (i = 1; i < n; i++) + if (e2c_vec[i - 1].av_position > e2c_vec[i].av_position) { + FFSWAP(struct elem_to_channel, e2c_vec[i - 1], e2c_vec[i]); next_n = i; } - } n = next_n; } while (n > 0); @@ -407,12 +429,13 @@ static void pop_output_configuration(AACContext *ac) { } /** - * Configure output channel order based on the current program configuration element. + * Configure output channel order based on the current program + * configuration element. * * @return Returns error status. 0 - OK, !0 - error */ static int output_configure(AACContext *ac, - uint8_t layout_map[MAX_ELEM_ID*4][3], int tags, + uint8_t layout_map[MAX_ELEM_ID * 4][3], int tags, enum OCStatus oc_type, int get_new_frame) { AVCodecContext *avctx = ac->avctx; @@ -448,7 +471,7 @@ static int output_configure(AACContext *ac, memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0])); avctx->channel_layout = ac->oc[1].channel_layout = layout; - avctx->channels = ac->oc[1].channels = channels; + avctx->channels = ac->oc[1].channels = channels; ac->oc[1].status = oc_type; if (get_new_frame) { @@ -466,34 +489,38 @@ static int output_configure(AACContext *ac, * @return Returns error status. 0 - OK, !0 - error */ static int set_default_channel_config(AVCodecContext *avctx, - uint8_t (*layout_map)[3], - int *tags, - int channel_config) + uint8_t (*layout_map)[3], + int *tags, + int channel_config) { if (channel_config < 1 || channel_config > 7) { - av_log(avctx, AV_LOG_ERROR, "invalid default channel configuration (%d)\n", + av_log(avctx, AV_LOG_ERROR, + "invalid default channel configuration (%d)\n", channel_config); - return -1; + return AVERROR_INVALIDDATA; } *tags = tags_per_config[channel_config]; - memcpy(layout_map, aac_channel_layout_map[channel_config-1], *tags * sizeof(*layout_map)); + memcpy(layout_map, aac_channel_layout_map[channel_config - 1], + *tags * sizeof(*layout_map)); return 0; } static ChannelElement *get_che(AACContext *ac, int type, int elem_id) { - // For PCE based channel configurations map the channels solely based on tags. + /* For PCE based channel configurations map the channels solely based + * on tags. */ if (!ac->oc[1].m4ac.chan_config) { return ac->tag_che_map[type][elem_id]; } // Allow single CPE stereo files to be signalled with mono configuration. - if (!ac->tags_mapped && type == TYPE_CPE && ac->oc[1].m4ac.chan_config == 1) { + if (!ac->tags_mapped && type == TYPE_CPE && + ac->oc[1].m4ac.chan_config == 1) { uint8_t layout_map[MAX_ELEM_ID*4][3]; int layout_map_tags; push_output_configuration(ac); - if (set_default_channel_config(ac->avctx, layout_map, &layout_map_tags, - 2) < 0) + if (set_default_channel_config(ac->avctx, layout_map, + &layout_map_tags, 2) < 0) return NULL; if (output_configure(ac, layout_map, layout_map_tags, OC_TRIAL_FRAME, 1) < 0) @@ -503,13 +530,14 @@ static ChannelElement *get_che(AACContext *ac, int type, int elem_id) ac->oc[1].m4ac.ps = 0; } // And vice-versa - if (!ac->tags_mapped && type == TYPE_SCE && ac->oc[1].m4ac.chan_config == 2) { - uint8_t layout_map[MAX_ELEM_ID*4][3]; + if (!ac->tags_mapped && type == TYPE_SCE && + ac->oc[1].m4ac.chan_config == 2) { + uint8_t layout_map[MAX_ELEM_ID * 4][3]; int layout_map_tags; push_output_configuration(ac); - if (set_default_channel_config(ac->avctx, layout_map, &layout_map_tags, - 1) < 0) + if (set_default_channel_config(ac->avctx, layout_map, + &layout_map_tags, 1) < 0) return NULL; if (output_configure(ac, layout_map, layout_map_tags, OC_TRIAL_FRAME, 1) < 0) @@ -519,7 +547,8 @@ static ChannelElement *get_che(AACContext *ac, int type, int elem_id) if (ac->oc[1].m4ac.sbr) ac->oc[1].m4ac.ps = -1; } - // For indexed channel configurations map the channels solely based on position. + /* For indexed channel configurations map the channels solely based + * on position. */ switch (ac->oc[1].m4ac.chan_config) { case 7: if (ac->tags_mapped == 3 && type == TYPE_CPE) { @@ -527,9 +556,12 @@ static ChannelElement *get_che(AACContext *ac, int type, int elem_id) return ac->tag_che_map[TYPE_CPE][elem_id] = ac->che[TYPE_CPE][2]; } case 6: - /* Some streams incorrectly code 5.1 audio as SCE[0] CPE[0] CPE[1] SCE[1] - instead of SCE[0] CPE[0] CPE[1] LFE[0]. If we seem to have - encountered such a stream, transfer the LFE[0] element to the SCE[1]'s mapping */ + /* Some streams incorrectly code 5.1 audio as + * SCE[0] CPE[0] CPE[1] SCE[1] + * instead of + * SCE[0] CPE[0] CPE[1] LFE[0]. + * If we seem to have encountered such a stream, transfer + * the LFE[0] element to the SCE[1]'s mapping */ if (ac->tags_mapped == tags_per_config[ac->oc[1].m4ac.chan_config] - 1 && (type == TYPE_LFE || type == TYPE_SCE)) { ac->tags_mapped++; return ac->tag_che_map[type][elem_id] = ac->che[TYPE_LFE][0]; @@ -540,13 +572,16 @@ static ChannelElement *get_che(AACContext *ac, int type, int elem_id) return ac->tag_che_map[TYPE_CPE][elem_id] = ac->che[TYPE_CPE][1]; } case 4: - if (ac->tags_mapped == 2 && ac->oc[1].m4ac.chan_config == 4 && type == TYPE_SCE) { + if (ac->tags_mapped == 2 && + ac->oc[1].m4ac.chan_config == 4 && + type == TYPE_SCE) { ac->tags_mapped++; return ac->tag_che_map[TYPE_SCE][elem_id] = ac->che[TYPE_SCE][1]; } case 3: case 2: - if (ac->tags_mapped == (ac->oc[1].m4ac.chan_config != 2) && type == TYPE_CPE) { + if (ac->tags_mapped == (ac->oc[1].m4ac.chan_config != 2) && + type == TYPE_CPE) { ac->tags_mapped++; return ac->tag_che_map[TYPE_CPE][elem_id] = ac->che[TYPE_CPE][0]; } else if (ac->oc[1].m4ac.chan_config == 2) { @@ -563,7 +598,8 @@ static ChannelElement *get_che(AACContext *ac, int type, int elem_id) } /** - * Decode an array of 4 bit element IDs, optionally interleaved with a stereo/mono switching bit. + * Decode an array of 4 bit element IDs, optionally interleaved with a + * stereo/mono switching bit. * * @param type speaker type/position for these channels */ @@ -603,7 +639,8 @@ static int decode_pce(AVCodecContext *avctx, MPEG4AudioConfig *m4ac, uint8_t (*layout_map)[3], GetBitContext *gb) { - int num_front, num_side, num_back, num_lfe, num_assoc_data, num_cc, sampling_index; + int num_front, num_side, num_back, num_lfe, num_assoc_data, num_cc; + int sampling_index; int comment_len; int tags; @@ -611,7 +648,9 @@ static int decode_pce(AVCodecContext *avctx, MPEG4AudioConfig *m4ac, sampling_index = get_bits(gb, 4); if (m4ac->sampling_index != sampling_index) - av_log(avctx, AV_LOG_WARNING, "Sample rate index in program config element does not match the sample rate index configured by the container.\n"); + av_log(avctx, AV_LOG_WARNING, + "Sample rate index in program config element does not " + "match the sample rate index configured by the container.\n"); num_front = get_bits(gb, 4); num_side = get_bits(gb, 4); @@ -648,7 +687,7 @@ static int decode_pce(AVCodecContext *avctx, MPEG4AudioConfig *m4ac, comment_len = get_bits(gb, 8) * 8; if (get_bits_left(gb) < comment_len) { av_log(avctx, AV_LOG_ERROR, overread_err); - return -1; + return AVERROR_INVALIDDATA; } skip_bits_long(gb, comment_len); return tags; @@ -690,7 +729,8 @@ static int decode_ga_specific_config(AACContext *ac, AVCodecContext *avctx, if (tags < 0) return tags; } else { - if ((ret = set_default_channel_config(avctx, layout_map, &tags, channel_config))) + if ((ret = set_default_channel_config(avctx, layout_map, + &tags, channel_config))) return ret; } @@ -712,7 +752,7 @@ static int decode_ga_specific_config(AACContext *ac, AVCodecContext *avctx, case AOT_ER_AAC_LTP: case AOT_ER_AAC_SCALABLE: case AOT_ER_AAC_LD: - skip_bits(gb, 3); /* aacSectionDataResilienceFlag + skip_bits(gb, 3); /* aacSectionDataResilienceFlag * aacScalefactorDataResilienceFlag * aacSpectralDataResilienceFlag */ @@ -742,20 +782,24 @@ static int decode_audio_specific_config(AACContext *ac, int sync_extension) { GetBitContext gb; - int i; + int i, ret; av_dlog(avctx, "extradata size %d\n", avctx->extradata_size); for (i = 0; i < avctx->extradata_size; i++) - av_dlog(avctx, "%02x ", avctx->extradata[i]); + av_dlog(avctx, "%02x ", avctx->extradata[i]); av_dlog(avctx, "\n"); - init_get_bits(&gb, data, bit_size); + if ((ret = init_get_bits(&gb, data, bit_size)) < 0) + return ret; - if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size, sync_extension)) < 0) - return -1; + if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size, + sync_extension)) < 0) + return AVERROR_INVALIDDATA; if (m4ac->sampling_index > 12) { - av_log(avctx, AV_LOG_ERROR, "invalid sampling rate index %d\n", m4ac->sampling_index); - return -1; + av_log(avctx, AV_LOG_ERROR, + "invalid sampling rate index %d\n", + m4ac->sampling_index); + return AVERROR_INVALIDDATA; } skip_bits_long(&gb, i); @@ -764,18 +808,23 @@ static int decode_audio_specific_config(AACContext *ac, case AOT_AAC_MAIN: case AOT_AAC_LC: case AOT_AAC_LTP: - if (decode_ga_specific_config(ac, avctx, &gb, m4ac, m4ac->chan_config)) - return -1; + if ((ret = decode_ga_specific_config(ac, avctx, &gb, + m4ac, m4ac->chan_config)) < 0) + return ret; break; default: - av_log(avctx, AV_LOG_ERROR, "Audio object type %s%d is not supported.\n", - m4ac->sbr == 1? "SBR+" : "", m4ac->object_type); - return -1; + av_log(avctx, AV_LOG_ERROR, + "Audio object type %s%d is not supported.\n", + m4ac->sbr == 1 ? "SBR+" : "", + m4ac->object_type); + return AVERROR(ENOSYS); } - av_dlog(avctx, "AOT %d chan config %d sampling index %d (%d) SBR %d PS %d\n", + av_dlog(avctx, + "AOT %d chan config %d sampling index %d (%d) SBR %d PS %d\n", m4ac->object_type, m4ac->chan_config, m4ac->sampling_index, - m4ac->sample_rate, m4ac->sbr, m4ac->ps); + m4ac->sample_rate, m4ac->sbr, + m4ac->ps); return get_bits_count(&gb); } @@ -833,15 +882,18 @@ static void reset_predictor_group(PredictorState *ps, int group_num) reset_predict_state(&ps[i]); } -#define AAC_INIT_VLC_STATIC(num, size) \ - INIT_VLC_STATIC(&vlc_spectral[num], 8, ff_aac_spectral_sizes[num], \ - ff_aac_spectral_bits[num], sizeof( ff_aac_spectral_bits[num][0]), sizeof( ff_aac_spectral_bits[num][0]), \ - ff_aac_spectral_codes[num], sizeof(ff_aac_spectral_codes[num][0]), sizeof(ff_aac_spectral_codes[num][0]), \ +#define AAC_INIT_VLC_STATIC(num, size) \ + INIT_VLC_STATIC(&vlc_spectral[num], 8, ff_aac_spectral_sizes[num], \ + ff_aac_spectral_bits[num], sizeof(ff_aac_spectral_bits[num][0]), \ + sizeof(ff_aac_spectral_bits[num][0]), \ + ff_aac_spectral_codes[num], sizeof(ff_aac_spectral_codes[num][0]), \ + sizeof(ff_aac_spectral_codes[num][0]), \ size); static av_cold int aac_decode_init(AVCodecContext *avctx) { AACContext *ac = avctx->priv_data; + int ret; ac->avctx = avctx; ac->oc[1].m4ac.sample_rate = avctx->sample_rate; @@ -849,10 +901,11 @@ static av_cold int aac_decode_init(AVCodecContext *avctx) avctx->sample_fmt = AV_SAMPLE_FMT_FLTP; if (avctx->extradata_size > 0) { - if (decode_audio_specific_config(ac, ac->avctx, &ac->oc[1].m4ac, - avctx->extradata, - avctx->extradata_size*8, 1) < 0) - return -1; + if ((ret = decode_audio_specific_config(ac, ac->avctx, &ac->oc[1].m4ac, + avctx->extradata, + avctx->extradata_size * 8, + 1)) < 0) + return ret; } else { int sr, i; uint8_t layout_map[MAX_ELEM_ID*4][3]; @@ -905,9 +958,14 @@ static av_cold int aac_decode_init(AVCodecContext *avctx) ff_aac_tableinit(); - INIT_VLC_STATIC(&vlc_scalefactors,7,FF_ARRAY_ELEMS(ff_aac_scalefactor_code), - ff_aac_scalefactor_bits, sizeof(ff_aac_scalefactor_bits[0]), sizeof(ff_aac_scalefactor_bits[0]), - ff_aac_scalefactor_code, sizeof(ff_aac_scalefactor_code[0]), sizeof(ff_aac_scalefactor_code[0]), + INIT_VLC_STATIC(&vlc_scalefactors, 7, + FF_ARRAY_ELEMS(ff_aac_scalefactor_code), + ff_aac_scalefactor_bits, + sizeof(ff_aac_scalefactor_bits[0]), + sizeof(ff_aac_scalefactor_bits[0]), + ff_aac_scalefactor_code, + sizeof(ff_aac_scalefactor_code[0]), + sizeof(ff_aac_scalefactor_code[0]), 352); ff_mdct_init(&ac->mdct, 11, 1, 1.0 / (32768.0 * 1024.0)); @@ -941,7 +999,7 @@ static int skip_data_stream_element(AACContext *ac, GetBitContext *gb) if (get_bits_left(gb) < 8 * count) { av_log(ac->avctx, AV_LOG_ERROR, overread_err); - return -1; + return AVERROR_INVALIDDATA; } skip_bits_long(gb, 8 * count); return 0; @@ -953,9 +1011,11 @@ static int decode_prediction(AACContext *ac, IndividualChannelStream *ics, int sfb; if (get_bits1(gb)) { ics->predictor_reset_group = get_bits(gb, 5); - if (ics->predictor_reset_group == 0 || ics->predictor_reset_group > 30) { - av_log(ac->avctx, AV_LOG_ERROR, "Invalid Predictor Reset Group.\n"); - return -1; + if (ics->predictor_reset_group == 0 || + ics->predictor_reset_group > 30) { + av_log(ac->avctx, AV_LOG_ERROR, + "Invalid Predictor Reset Group.\n"); + return AVERROR_INVALIDDATA; } } for (sfb = 0; sfb < FFMIN(ics->max_sfb, ff_aac_pred_sfb_max[ac->oc[1].m4ac.sampling_index]); sfb++) { @@ -1024,7 +1084,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics, return AVERROR_INVALIDDATA; } } else if (ac->oc[1].m4ac.object_type == AOT_AAC_LC) { - av_log(ac->avctx, AV_LOG_ERROR, "Prediction is not allowed in AAC-LC.\n"); + av_log(ac->avctx, AV_LOG_ERROR, + "Prediction is not allowed in AAC-LC.\n"); return AVERROR_INVALIDDATA; } else { if ((ics->ltp.present = get_bits(gb, 1))) @@ -1035,7 +1096,8 @@ static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics, if (ics->max_sfb > ics->num_swb) { av_log(ac->avctx, AV_LOG_ERROR, - "Number of scalefactor bands in group (%d) exceeds limit (%d).\n", + "Number of scalefactor bands in group (%d) " + "exceeds limit (%d).\n", ics->max_sfb, ics->num_swb); return AVERROR_INVALIDDATA; } @@ -1065,20 +1127,20 @@ static int decode_band_types(AACContext *ac, enum BandType band_type[120], int sect_band_type = get_bits(gb, 4); if (sect_band_type == 12) { av_log(ac->avctx, AV_LOG_ERROR, "invalid band type\n"); - return -1; + return AVERROR_INVALIDDATA; } do { sect_len_incr = get_bits(gb, bits); sect_end += sect_len_incr; if (get_bits_left(gb) < 0) { av_log(ac->avctx, AV_LOG_ERROR, overread_err); - return -1; + return AVERROR_INVALIDDATA; } if (sect_end > ics->max_sfb) { av_log(ac->avctx, AV_LOG_ERROR, "Number of bands (%d) exceeds limit (%d).\n", sect_end, ics->max_sfb); - return -1; + return AVERROR_INVALIDDATA; } } while (sect_len_incr == (1 << bits) - 1); for (; k < sect_end; k++) { @@ -1116,7 +1178,8 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb, if (band_type[idx] == ZERO_BT) { for (; i < run_end; i++, idx++) sf[idx] = 0.; - } else if ((band_type[idx] == INTENSITY_BT) || (band_type[idx] == INTENSITY_BT2)) { + } else if ((band_type[idx] == INTENSITY_BT) || + (band_type[idx] == INTENSITY_BT2)) { for (; i < run_end; i++, idx++) { offset[2] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60; clipped_offset = av_clip(offset[2], -155, 100); @@ -1149,7 +1212,7 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb, if (offset[0] > 255U) { av_log(ac->avctx, AV_LOG_ERROR, "Scalefactor (%d) out of range.\n", offset[0]); - return -1; + return AVERROR_INVALIDDATA; } sf[idx] = -ff_aac_pow2sf_tab[offset[0] - 100 + POW_SF2_ZERO]; } @@ -1204,10 +1267,11 @@ static int decode_tns(AACContext *ac, TemporalNoiseShaping *tns, tns->length[w][filt] = get_bits(gb, 6 - 2 * is8); if ((tns->order[w][filt] = get_bits(gb, 5 - 2 * is8)) > tns_max_order) { - av_log(ac->avctx, AV_LOG_ERROR, "TNS filter order %d is greater than maximum %d.\n", + av_log(ac->avctx, AV_LOG_ERROR, + "TNS filter order %d is greater than maximum %d.\n", tns->order[w][filt], tns_max_order); tns->order[w][filt] = 0; - return -1; + return AVERROR_INVALIDDATA; } if (tns->order[w][filt]) { tns->direction[w][filt] = get_bits1(gb); @@ -1236,7 +1300,9 @@ static void decode_mid_side_stereo(ChannelElement *cpe, GetBitContext *gb, { int idx; if (ms_present == 1) { - for (idx = 0; idx < cpe->ch[0].ics.num_window_groups * cpe->ch[0].ics.max_sfb; idx++) + for (idx = 0; + idx < cpe->ch[0].ics.num_window_groups * cpe->ch[0].ics.max_sfb; + idx++) cpe->ms_mask[idx] = get_bits1(gb); } else if (ms_present == 2) { memset(cpe->ms_mask, 1, cpe->ch[0].ics.num_window_groups * cpe->ch[0].ics.max_sfb * sizeof(cpe->ms_mask[0])); @@ -1335,7 +1401,8 @@ static int decode_spectrum_and_dequant(AACContext *ac, float coef[1024], float *coef_base = coef; for (g = 0; g < ics->num_windows; g++) - memset(coef + g * 128 + offsets[ics->max_sfb], 0, sizeof(float) * (c - offsets[ics->max_sfb])); + memset(coef + g * 128 + offsets[ics->max_sfb], 0, + sizeof(float) * (c - offsets[ics->max_sfb])); for (g = 0; g < ics->num_window_groups; g++) { unsigned g_len = ics->group_len[g]; @@ -1490,7 +1557,7 @@ static int decode_spectrum_and_dequant(AACContext *ac, float coef[1024], if (b > 8) { av_log(ac->avctx, AV_LOG_ERROR, "error in spectral data, ESC overflow\n"); - return -1; + return AVERROR_INVALIDDATA; } SKIP_BITS(re, gb, b + 1); @@ -1605,14 +1672,20 @@ static void apply_prediction(AACContext *ac, SingleChannelElement *sce) } if (sce->ics.window_sequence[0] != EIGHT_SHORT_SEQUENCE) { - for (sfb = 0; sfb < ff_aac_pred_sfb_max[ac->oc[1].m4ac.sampling_index]; sfb++) { - for (k = sce->ics.swb_offset[sfb]; k < sce->ics.swb_offset[sfb + 1]; k++) { + for (sfb = 0; + sfb < ff_aac_pred_sfb_max[ac->oc[1].m4ac.sampling_index]; + sfb++) { + for (k = sce->ics.swb_offset[sfb]; + k < sce->ics.swb_offset[sfb + 1]; + k++) { predict(&sce->predictor_state[k], &sce->coeffs[k], - sce->ics.predictor_present && sce->ics.prediction_used[sfb]); + sce->ics.predictor_present && + sce->ics.prediction_used[sfb]); } } if (sce->ics.predictor_reset_group) - reset_predictor_group(sce->predictor_state, sce->ics.predictor_reset_group); + reset_predictor_group(sce->predictor_state, + sce->ics.predictor_reset_group); } else reset_all_predictors(sce->predictor_state); } @@ -1633,6 +1706,7 @@ static int decode_ics(AACContext *ac, SingleChannelElement *sce, IndividualChannelStream *ics = &sce->ics; float *out = sce->coeffs; int global_gain, pulse_present = 0; + int ret; /* This assignment is to silence a GCC warning about the variable being used * uninitialized when in fact it always is. @@ -1646,33 +1720,38 @@ static int decode_ics(AACContext *ac, SingleChannelElement *sce, return AVERROR_INVALIDDATA; } - if (decode_band_types(ac, sce->band_type, sce->band_type_run_end, gb, ics) < 0) - return -1; - if (decode_scalefactors(ac, sce->sf, gb, global_gain, ics, sce->band_type, sce->band_type_run_end) < 0) - return -1; + if ((ret = decode_band_types(ac, sce->band_type, + sce->band_type_run_end, gb, ics)) < 0) + return ret; + if ((ret = decode_scalefactors(ac, sce->sf, gb, global_gain, ics, + sce->band_type, sce->band_type_run_end)) < 0) + return ret; pulse_present = 0; if (!scale_flag) { if ((pulse_present = get_bits1(gb))) { if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) { - av_log(ac->avctx, AV_LOG_ERROR, "Pulse tool not allowed in eight short sequence.\n"); - return -1; + av_log(ac->avctx, AV_LOG_ERROR, + "Pulse tool not allowed in eight short sequence.\n"); + return AVERROR_INVALIDDATA; } if (decode_pulses(&pulse, gb, ics->swb_offset, ics->num_swb)) { - av_log(ac->avctx, AV_LOG_ERROR, "Pulse data corrupt or invalid.\n"); - return -1; + av_log(ac->avctx, AV_LOG_ERROR, + "Pulse data corrupt or invalid.\n"); + return AVERROR_INVALIDDATA; } } if ((tns->present = get_bits1(gb)) && decode_tns(ac, tns, gb, ics)) - return -1; + return AVERROR_INVALIDDATA; if (get_bits1(gb)) { av_log_missing_feature(ac->avctx, "SSR", 1); return AVERROR_PATCHWELCOME; } } - if (decode_spectrum_and_dequant(ac, out, gb, sce->sf, pulse_present, &pulse, ics, sce->band_type) < 0) - return -1; + if (decode_spectrum_and_dequant(ac, out, gb, sce->sf, pulse_present, + &pulse, ics, sce->band_type) < 0) + return AVERROR_INVALIDDATA; if (ac->oc[1].m4ac.object_type == AOT_AAC_MAIN && !common_window) apply_prediction(ac, sce); @@ -1693,7 +1772,8 @@ static void apply_mid_side_stereo(AACContext *ac, ChannelElement *cpe) for (g = 0; g < ics->num_window_groups; g++) { for (i = 0; i < ics->max_sfb; i++, idx++) { if (cpe->ms_mask[idx] && - cpe->ch[0].band_type[idx] < NOISE_BT && cpe->ch[1].band_type[idx] < NOISE_BT) { + cpe->ch[0].band_type[idx] < NOISE_BT && + cpe->ch[1].band_type[idx] < NOISE_BT) { for (group = 0; group < ics->group_len[g]; group++) { ac->dsp.butterflies_float(ch0 + group * 128 + offsets[i], ch1 + group * 128 + offsets[i], @@ -1713,7 +1793,8 @@ static void apply_mid_side_stereo(AACContext *ac, ChannelElement *cpe) * [1] mask is decoded from bitstream; [2] mask is all 1s; * [3] reserved for scalable AAC */ -static void apply_intensity_stereo(AACContext *ac, ChannelElement *cpe, int ms_present) +static void apply_intensity_stereo(AACContext *ac, + ChannelElement *cpe, int ms_present) { const IndividualChannelStream *ics = &cpe->ch[1].ics; SingleChannelElement *sce1 = &cpe->ch[1]; @@ -1724,7 +1805,8 @@ static void apply_intensity_stereo(AACContext *ac, ChannelElement *cpe, int ms_p float scale; for (g = 0; g < ics->num_window_groups; g++) { for (i = 0; i < ics->max_sfb;) { - if (sce1->band_type[idx] == INTENSITY_BT || sce1->band_type[idx] == INTENSITY_BT2) { + if (sce1->band_type[idx] == INTENSITY_BT || + sce1->band_type[idx] == INTENSITY_BT2) { const int bt_run_end = sce1->band_type_run_end[idx]; for (; i < bt_run_end; i++, idx++) { c = -1 + 2 * (sce1->band_type[idx] - 14); @@ -1764,13 +1846,14 @@ static int decode_cpe(AACContext *ac, GetBitContext *gb, ChannelElement *cpe) i = cpe->ch[1].ics.use_kb_window[0]; cpe->ch[1].ics = cpe->ch[0].ics; cpe->ch[1].ics.use_kb_window[1] = i; - if (cpe->ch[1].ics.predictor_present && (ac->oc[1].m4ac.object_type != AOT_AAC_MAIN)) + if (cpe->ch[1].ics.predictor_present && + (ac->oc[1].m4ac.object_type != AOT_AAC_MAIN)) if ((cpe->ch[1].ics.ltp.present = get_bits(gb, 1))) decode_ltp(&cpe->ch[1].ics.ltp, gb, cpe->ch[1].ics.max_sfb); ms_present = get_bits(gb, 2); if (ms_present == 3) { av_log(ac->avctx, AV_LOG_ERROR, "ms_present = 3 is reserved.\n"); - return -1; + return AVERROR_INVALIDDATA; } else if (ms_present) decode_mid_side_stereo(cpe, gb, ms_present); } @@ -2556,7 +2639,8 @@ static int aac_decode_frame(AVCodecContext *avctx, void *data, } } - init_get_bits(&gb, buf, buf_size * 8); + if ((err = init_get_bits(&gb, buf, buf_size * 8)) < 0) + return err; if ((err = aac_decode_frame_int(avctx, data, got_frame_ptr, &gb)) < 0) return err; @@ -2592,13 +2676,13 @@ static av_cold int aac_decode_close(AVCodecContext *avctx) #define LOAS_SYNC_WORD 0x2b7 ///< 11 bits LOAS sync word struct LATMContext { - AACContext aac_ctx; ///< containing AACContext - int initialized; ///< initilized after a valid extradata was seen + AACContext aac_ctx; ///< containing AACContext + int initialized; ///< initilized after a valid extradata was seen // parser data - int audio_mux_version_A; ///< LATM syntax version - int frame_length_type; ///< 0/1 variable/fixed frame length - int frame_length; ///< frame length for fixed frame length + int audio_mux_version_A; ///< LATM syntax version + int frame_length_type; ///< 0/1 variable/fixed frame length + int frame_length; ///< frame length for fixed frame length }; static inline uint32_t latm_get_value(GetBitContext *b) @@ -2801,7 +2885,8 @@ static int latm_decode_frame(AVCodecContext *avctx, void *out, int muxlength, err; GetBitContext gb; - init_get_bits(&gb, avpkt->data, avpkt->size * 8); + if ((err = init_get_bits(&gb, avpkt->data, avpkt->size * 8)) < 0) + return err; // check for LOAS sync word if (get_bits(&gb, 11) != LOAS_SYNC_WORD) diff --git a/gst-libs/ext/libav/libavcodec/ac3dec.c b/gst-libs/ext/libav/libavcodec/ac3dec.c index 0d1ba89..51ac334 100644 --- a/gst-libs/ext/libav/libavcodec/ac3dec.c +++ b/gst-libs/ext/libav/libavcodec/ac3dec.c @@ -292,7 +292,7 @@ static int parse_frame_header(AC3DecodeContext *s) return ff_eac3_parse_header(s); } else { av_log(s->avctx, AV_LOG_ERROR, "E-AC-3 support not compiled in\n"); - return -1; + return AVERROR(ENOSYS); } } @@ -787,12 +787,12 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) if (start_subband >= end_subband) { av_log(s->avctx, AV_LOG_ERROR, "invalid spectral extension " "range (%d >= %d)\n", start_subband, end_subband); - return -1; + return AVERROR_INVALIDDATA; } if (dst_start_freq >= src_start_freq) { av_log(s->avctx, AV_LOG_ERROR, "invalid spectral extension " "copy start bin (%d >= %d)\n", dst_start_freq, src_start_freq); - return -1; + return AVERROR_INVALIDDATA; } s->spx_dst_start_freq = dst_start_freq; @@ -869,7 +869,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) if (channel_mode < AC3_CHMODE_STEREO) { av_log(s->avctx, AV_LOG_ERROR, "coupling not allowed in mono or dual-mono\n"); - return -1; + return AVERROR_INVALIDDATA; } /* check for enhanced coupling */ @@ -899,7 +899,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) if (cpl_start_subband >= cpl_end_subband) { av_log(s->avctx, AV_LOG_ERROR, "invalid coupling range (%d >= %d)\n", cpl_start_subband, cpl_end_subband); - return -1; + return AVERROR_INVALIDDATA; } s->start_freq[CPL_CH] = cpl_start_subband * 12 + 37; s->end_freq[CPL_CH] = cpl_end_subband * 12 + 37; @@ -921,7 +921,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) if (!blk) { av_log(s->avctx, AV_LOG_ERROR, "new coupling strategy must " "be present in block 0\n"); - return -1; + return AVERROR_INVALIDDATA; } else { s->cpl_in_use[blk] = s->cpl_in_use[blk-1]; } @@ -951,7 +951,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) } else if (!blk) { av_log(s->avctx, AV_LOG_ERROR, "new coupling coordinates must " "be present in block 0\n"); - return -1; + return AVERROR_INVALIDDATA; } } else { /* channel not in coupling */ @@ -1006,7 +1006,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) int bandwidth_code = get_bits(gbc, 6); if (bandwidth_code > 60) { av_log(s->avctx, AV_LOG_ERROR, "bandwidth code = %d > 60\n", bandwidth_code); - return -1; + return AVERROR_INVALIDDATA; } s->end_freq[ch] = bandwidth_code * 3 + 73; } @@ -1029,7 +1029,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) s->num_exp_groups[ch], s->dexps[ch][0], &s->dexps[ch][s->start_freq[ch]+!!ch])) { av_log(s->avctx, AV_LOG_ERROR, "exponent out-of-range\n"); - return -1; + return AVERROR_INVALIDDATA; } if (ch != CPL_CH && ch != s->lfe_ch) skip_bits(gbc, 2); /* skip gainrng */ @@ -1049,7 +1049,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) } else if (!blk) { av_log(s->avctx, AV_LOG_ERROR, "new bit allocation info must " "be present in block 0\n"); - return -1; + return AVERROR_INVALIDDATA; } } @@ -1080,7 +1080,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) } } else if (!s->eac3 && !blk) { av_log(s->avctx, AV_LOG_ERROR, "new snr offsets must be present in block 0\n"); - return -1; + return AVERROR_INVALIDDATA; } } @@ -1119,7 +1119,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) } else if (!s->eac3 && !blk) { av_log(s->avctx, AV_LOG_ERROR, "new coupling leak info must " "be present in block 0\n"); - return -1; + return AVERROR_INVALIDDATA; } s->first_cpl_leak = 0; } @@ -1131,7 +1131,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) s->dba_mode[ch] = get_bits(gbc, 2); if (s->dba_mode[ch] == DBA_RESERVED) { av_log(s->avctx, AV_LOG_ERROR, "delta bit allocation strategy reserved\n"); - return -1; + return AVERROR_INVALIDDATA; } bit_alloc_stages[ch] = FFMAX(bit_alloc_stages[ch], 2); } @@ -1172,7 +1172,7 @@ static int decode_audio_block(AC3DecodeContext *s, int blk) s->dba_offsets[ch], s->dba_lengths[ch], s->dba_values[ch], s->mask[ch])) { av_log(s->avctx, AV_LOG_ERROR, "error in bit allocation\n"); - return -1; + return AVERROR_INVALIDDATA; } } if (bit_alloc_stages[ch] > 0) { @@ -1291,7 +1291,7 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, switch (err) { case AAC_AC3_PARSE_ERROR_SYNC: av_log(avctx, AV_LOG_ERROR, "frame sync error\n"); - return -1; + return AVERROR_INVALIDDATA; case AAC_AC3_PARSE_ERROR_BSID: av_log(avctx, AV_LOG_ERROR, "invalid bitstream id\n"); break; @@ -1305,17 +1305,20 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, /* skip frame if CRC is ok. otherwise use error concealment. */ /* TODO: add support for substreams and dependent frames */ if (s->frame_type == EAC3_FRAME_TYPE_DEPENDENT || s->substreamid) { - av_log(avctx, AV_LOG_ERROR, "unsupported frame type : " + av_log(avctx, AV_LOG_WARNING, "unsupported frame type : " "skipping frame\n"); *got_frame_ptr = 0; - return s->frame_size; + return buf_size; } else { av_log(avctx, AV_LOG_ERROR, "invalid frame type\n"); } break; - default: - av_log(avctx, AV_LOG_ERROR, "invalid header\n"); + case AAC_AC3_PARSE_ERROR_CRC: + case AAC_AC3_PARSE_ERROR_CHANNEL_CFG: break; + default: // Normal AVERROR do not try to recover. + *got_frame_ptr = 0; + return err; } } else { /* check that reported frame size fits in input buffer */ @@ -1393,10 +1396,10 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, if (err) for (ch = 0; ch < s->out_channels; ch++) memcpy(s->outptr[channel_map[ch]], output[ch], 1024); - for (ch = 0; ch < s->out_channels; ch++) { + for (ch = 0; ch < s->out_channels; ch++) output[ch] = s->outptr[channel_map[ch]]; - s->outptr[channel_map[ch]] += AC3_BLOCK_SIZE; - } + for (ch = 0; ch < s->channels; ch++) + s->outptr[ch] += AC3_BLOCK_SIZE; } /* keep last block for error concealment in next frame */ diff --git a/gst-libs/ext/libav/libavcodec/adpcm.c b/gst-libs/ext/libav/libavcodec/adpcm.c index 3b0eb8b..df6b9d3 100644 --- a/gst-libs/ext/libav/libavcodec/adpcm.c +++ b/gst-libs/ext/libav/libavcodec/adpcm.c @@ -773,7 +773,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, return AVERROR_INVALIDDATA; } } - for (n = nb_samples >> (1 - st); n > 0; n--) { + for (n = (nb_samples >> (1 - st)) - 1; n > 0; n--) { int v = bytestream2_get_byteu(&gb); *samples++ = adpcm_ima_expand_nibble(&c->status[0 ], v >> 4 , 3); *samples++ = adpcm_ima_expand_nibble(&c->status[st], v & 0x0F, 3); diff --git a/gst-libs/ext/libav/libavcodec/alac.c b/gst-libs/ext/libav/libavcodec/alac.c index 1a3f769..72e9353 100644 --- a/gst-libs/ext/libav/libavcodec/alac.c +++ b/gst-libs/ext/libav/libavcodec/alac.c @@ -418,7 +418,8 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data, } channels = (element == TYPE_CPE) ? 2 : 1; - if (ch + channels > alac->channels) { + if (ch + channels > alac->channels || + ff_alac_channel_layout_offsets[alac->channels - 1][ch] + channels > alac->channels) { av_log(avctx, AV_LOG_ERROR, "invalid element channel count\n"); return AVERROR_INVALIDDATA; } @@ -495,7 +496,8 @@ static int alac_set_info(ALACContext *alac) bytestream2_skipu(&gb, 12); // size:4, alac:4, version:4 alac->max_samples_per_frame = bytestream2_get_be32u(&gb); - if (!alac->max_samples_per_frame || alac->max_samples_per_frame > INT_MAX) { + if (!alac->max_samples_per_frame || + alac->max_samples_per_frame > INT_MAX / sizeof(int32_t)) { av_log(alac->avctx, AV_LOG_ERROR, "max samples per frame invalid: %u\n", alac->max_samples_per_frame); return AVERROR_INVALIDDATA; diff --git a/gst-libs/ext/libav/libavcodec/alsdec.c b/gst-libs/ext/libav/libavcodec/alsdec.c index ff2a735..f1d01a2 100644 --- a/gst-libs/ext/libav/libavcodec/alsdec.c +++ b/gst-libs/ext/libav/libavcodec/alsdec.c @@ -295,12 +295,12 @@ static av_cold int read_specific_config(ALSDecContext *ctx) avctx->extradata_size * 8, 1); if (config_offset < 0) - return -1; + return AVERROR_INVALIDDATA; skip_bits_long(&gb, config_offset); if (get_bits_left(&gb) < (30 << 3)) - return -1; + return AVERROR_INVALIDDATA; // read the fixed items als_id = get_bits_long(&gb, 32); @@ -335,7 +335,7 @@ static av_cold int read_specific_config(ALSDecContext *ctx) // check for ALSSpecificConfig struct if (als_id != MKBETAG('A','L','S','\0')) - return -1; + return AVERROR_INVALIDDATA; ctx->cur_frame_length = sconf->frame_length; @@ -350,7 +350,7 @@ static av_cold int read_specific_config(ALSDecContext *ctx) int chan_pos_bits = av_ceil_log2(avctx->channels); int bits_needed = avctx->channels * chan_pos_bits + 7; if (get_bits_left(&gb) < bits_needed) - return -1; + return AVERROR_INVALIDDATA; if (!(sconf->chan_pos = av_malloc(avctx->channels * sizeof(*sconf->chan_pos)))) return AVERROR(ENOMEM); @@ -368,7 +368,7 @@ static av_cold int read_specific_config(ALSDecContext *ctx) // read fixed header and trailer sizes, // if size = 0xFFFFFFFF then there is no data field! if (get_bits_left(&gb) < 64) - return -1; + return AVERROR_INVALIDDATA; header_size = get_bits_long(&gb, 32); trailer_size = get_bits_long(&gb, 32); @@ -382,10 +382,10 @@ static av_cold int read_specific_config(ALSDecContext *ctx) // skip the header and trailer data if (get_bits_left(&gb) < ht_size) - return -1; + return AVERROR_INVALIDDATA; if (ht_size > INT32_MAX) - return -1; + return AVERROR_PATCHWELCOME; skip_bits_long(&gb, ht_size); @@ -393,7 +393,7 @@ static av_cold int read_specific_config(ALSDecContext *ctx) // initialize CRC calculation if (sconf->crc_enabled) { if (get_bits_left(&gb) < 32) - return -1; + return AVERROR_INVALIDDATA; if (avctx->err_recognition & AV_EF_CRCCHECK) { ctx->crc_table = av_crc_get_table(AV_CRC_32_IEEE_LE); @@ -633,7 +633,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) if (bd->block_length & (sub_blocks - 1)) { av_log(avctx, AV_LOG_WARNING, "Block length is not evenly divisible by the number of subblocks.\n"); - return -1; + return AVERROR_INVALIDDATA; } sb_length = bd->block_length >> log2_sub_blocks; @@ -964,18 +964,18 @@ static int decode_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) */ static int read_block(ALSDecContext *ctx, ALSBlockData *bd) { + int ret = 0; GetBitContext *gb = &ctx->gb; *bd->shift_lsbs = 0; // read block type flag and read the samples accordingly if (get_bits1(gb)) { - if (read_var_block_data(ctx, bd)) - return -1; + ret = read_var_block_data(ctx, bd); } else { read_const_block_data(ctx, bd); } - return 0; + return ret; } @@ -984,12 +984,16 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd) static int decode_block(ALSDecContext *ctx, ALSBlockData *bd) { unsigned int smp; + int ret = 0; // read block type flag and read the samples accordingly if (*bd->const_block) decode_const_block_data(ctx, bd); - else if (decode_var_block_data(ctx, bd)) - return -1; + else + ret = decode_var_block_data(ctx, bd); // always return 0 + + if (ret < 0) + return ret; // TODO: read RLSLMS extension data @@ -1007,14 +1011,10 @@ static int read_decode_block(ALSDecContext *ctx, ALSBlockData *bd) { int ret; - ret = read_block(ctx, bd); - - if (ret) + if ((ret = read_block(ctx, bd)) < 0) return ret; - ret = decode_block(ctx, bd); - - return ret; + return decode_block(ctx, bd); } @@ -1040,6 +1040,7 @@ static int decode_blocks_ind(ALSDecContext *ctx, unsigned int ra_frame, unsigned int c, const unsigned int *div_blocks, unsigned int *js_blocks) { + int ret; unsigned int b; ALSBlockData bd = { 0 }; @@ -1060,10 +1061,10 @@ static int decode_blocks_ind(ALSDecContext *ctx, unsigned int ra_frame, for (b = 0; b < ctx->num_blocks; b++) { bd.block_length = div_blocks[b]; - if (read_decode_block(ctx, &bd)) { + if ((ret = read_decode_block(ctx, &bd)) < 0) { // damaged block, write zero for the rest of the frame zero_remaining(b, ctx->num_blocks, div_blocks, bd.raw_samples); - return -1; + return ret; } bd.raw_samples += div_blocks[b]; bd.ra_block = 0; @@ -1082,6 +1083,7 @@ static int decode_blocks(ALSDecContext *ctx, unsigned int ra_frame, ALSSpecificConfig *sconf = &ctx->sconf; unsigned int offset = 0; unsigned int b; + int ret; ALSBlockData bd[2] = { { 0 } }; bd[0].ra_block = ra_frame; @@ -1123,12 +1125,9 @@ static int decode_blocks(ALSDecContext *ctx, unsigned int ra_frame, bd[0].raw_other = bd[1].raw_samples; bd[1].raw_other = bd[0].raw_samples; - if(read_decode_block(ctx, &bd[0]) || read_decode_block(ctx, &bd[1])) { - // damaged block, write zero for the rest of the frame - zero_remaining(b, ctx->num_blocks, div_blocks, bd[0].raw_samples); - zero_remaining(b, ctx->num_blocks, div_blocks, bd[1].raw_samples); - return -1; - } + if ((ret = read_decode_block(ctx, &bd[0])) < 0 || + (ret = read_decode_block(ctx, &bd[1])) < 0) + goto fail; // reconstruct joint-stereo blocks if (bd[0].js_blocks) { @@ -1154,8 +1153,19 @@ static int decode_blocks(ALSDecContext *ctx, unsigned int ra_frame, sizeof(*ctx->raw_samples[c]) * sconf->max_order); return 0; +fail: + // damaged block, write zero for the rest of the frame + zero_remaining(b, ctx->num_blocks, div_blocks, bd[0].raw_samples); + zero_remaining(b, ctx->num_blocks, div_blocks, bd[1].raw_samples); + return ret; } +static inline int als_weighting(GetBitContext *gb, int k, int off) +{ + int idx = av_clip(decode_rice(gb, k) + off, + 0, FF_ARRAY_ELEMS(mcc_weightings) - 1); + return mcc_weightings[idx]; +} /** Read the channel data. */ @@ -1171,19 +1181,19 @@ static int read_channel_data(ALSDecContext *ctx, ALSChannelData *cd, int c) if (current->master_channel >= channels) { av_log(ctx->avctx, AV_LOG_ERROR, "Invalid master channel!\n"); - return -1; + return AVERROR_INVALIDDATA; } if (current->master_channel != c) { current->time_diff_flag = get_bits1(gb); - current->weighting[0] = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 32)]; - current->weighting[1] = mcc_weightings[av_clip(decode_rice(gb, 2) + 14, 0, 32)]; - current->weighting[2] = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 32)]; + current->weighting[0] = als_weighting(gb, 1, 16); + current->weighting[1] = als_weighting(gb, 2, 14); + current->weighting[2] = als_weighting(gb, 1, 16); if (current->time_diff_flag) { - current->weighting[3] = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 32)]; - current->weighting[4] = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 32)]; - current->weighting[5] = mcc_weightings[av_clip(decode_rice(gb, 1) + 16, 0, 32)]; + current->weighting[3] = als_weighting(gb, 1, 16); + current->weighting[4] = als_weighting(gb, 1, 16); + current->weighting[5] = als_weighting(gb, 1, 16); current->time_diff_sign = get_bits1(gb); current->time_diff_index = get_bits(gb, ctx->ltp_lag_length - 3) + 3; @@ -1196,7 +1206,7 @@ static int read_channel_data(ALSDecContext *ctx, ALSChannelData *cd, int c) if (entries == channels) { av_log(ctx->avctx, AV_LOG_ERROR, "Damaged channel data!\n"); - return -1; + return AVERROR_INVALIDDATA; } align_get_bits(gb); @@ -1228,7 +1238,7 @@ static int revert_channel_correlation(ALSDecContext *ctx, ALSBlockData *bd, if (dep == channels) { av_log(ctx->avctx, AV_LOG_WARNING, "Invalid channel correlation!\n"); - return -1; + return AVERROR_INVALIDDATA; } bd->const_block = ctx->const_block + c; @@ -1299,8 +1309,8 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame) unsigned int div_blocks[32]; ///< block sizes. unsigned int c; unsigned int js_blocks[2]; - uint32_t bs_info = 0; + int ret; // skip the size of the ra unit if present in the frame if (sconf->ra_flag == RA_FLAG_FRAMES && ra_frame) @@ -1331,13 +1341,15 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame) independent_bs = 1; if (independent_bs) { - if (decode_blocks_ind(ctx, ra_frame, c, div_blocks, js_blocks)) - return -1; - + ret = decode_blocks_ind(ctx, ra_frame, c, + div_blocks, js_blocks); + if (ret < 0) + return ret; independent_bs--; } else { - if (decode_blocks(ctx, ra_frame, c, div_blocks, js_blocks)) - return -1; + ret = decode_blocks(ctx, ra_frame, c, div_blocks, js_blocks); + if (ret < 0) + return ret; c++; } @@ -1356,7 +1368,7 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame) for (c = 0; c < avctx->channels; c++) if (ctx->chan_data[c] < ctx->chan_data_buffer) { av_log(ctx->avctx, AV_LOG_ERROR, "Invalid channel data!\n"); - return -1; + return AVERROR_INVALIDDATA; } memset(reverted_channels, 0, sizeof(*reverted_channels) * avctx->channels); @@ -1388,11 +1400,12 @@ static int read_frame_data(ALSDecContext *ctx, unsigned int ra_frame) return ret; } - for (c = 0; c < avctx->channels; c++) - if (revert_channel_correlation(ctx, &bd, ctx->chan_data, - reverted_channels, offset, c)) - return -1; - + for (c = 0; c < avctx->channels; c++) { + ret = revert_channel_correlation(ctx, &bd, ctx->chan_data, + reverted_channels, offset, c); + if (ret < 0) + return ret; + } for (c = 0; c < avctx->channels; c++) { bd.const_block = ctx->const_block + c; bd.shift_lsbs = ctx->shift_lsbs + c; @@ -1590,30 +1603,30 @@ static av_cold int decode_init(AVCodecContext *avctx) { unsigned int c; unsigned int channel_size; - int num_buffers; + int num_buffers, ret; ALSDecContext *ctx = avctx->priv_data; ALSSpecificConfig *sconf = &ctx->sconf; ctx->avctx = avctx; if (!avctx->extradata) { av_log(avctx, AV_LOG_ERROR, "Missing required ALS extradata.\n"); - return -1; + return AVERROR_INVALIDDATA; } - if (read_specific_config(ctx)) { + if ((ret = read_specific_config(ctx)) < 0) { av_log(avctx, AV_LOG_ERROR, "Reading ALSSpecificConfig failed.\n"); - decode_end(avctx); - return -1; + goto fail; } - if (check_specific_config(ctx)) { - decode_end(avctx); - return -1; + if ((ret = check_specific_config(ctx)) < 0) { + goto fail; } - if (sconf->bgmc) - ff_bgmc_init(avctx, &ctx->bgmc_lut, &ctx->bgmc_lut_status); - + if (sconf->bgmc) { + ret = ff_bgmc_init(avctx, &ctx->bgmc_lut, &ctx->bgmc_lut_status); + if (ret < 0) + goto fail; + } if (sconf->floating) { avctx->sample_fmt = AV_SAMPLE_FMT_FLT; avctx->bits_per_raw_sample = 32; @@ -1648,7 +1661,8 @@ static av_cold int decode_init(AVCodecContext *avctx) !ctx->quant_cof_buffer || !ctx->lpc_cof_buffer || !ctx->lpc_cof_reversed_buffer) { av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); - return AVERROR(ENOMEM); + ret = AVERROR(ENOMEM); + goto fail; } // assign quantized parcor coefficient buffers @@ -1673,8 +1687,8 @@ static av_cold int decode_init(AVCodecContext *avctx) !ctx->use_ltp || !ctx->ltp_lag || !ctx->ltp_gain || !ctx->ltp_gain_buffer) { av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); - decode_end(avctx); - return AVERROR(ENOMEM); + ret = AVERROR(ENOMEM); + goto fail; } for (c = 0; c < num_buffers; c++) @@ -1691,8 +1705,8 @@ static av_cold int decode_init(AVCodecContext *avctx) if (!ctx->chan_data_buffer || !ctx->chan_data || !ctx->reverted_channels) { av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); - decode_end(avctx); - return AVERROR(ENOMEM); + ret = AVERROR(ENOMEM); + goto fail; } for (c = 0; c < num_buffers; c++) @@ -1712,8 +1726,8 @@ static av_cold int decode_init(AVCodecContext *avctx) // allocate previous raw sample buffer if (!ctx->prev_raw_samples || !ctx->raw_buffer|| !ctx->raw_samples) { av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); - decode_end(avctx); - return AVERROR(ENOMEM); + ret = AVERROR(ENOMEM); + goto fail; } // assign raw samples buffers @@ -1730,8 +1744,8 @@ static av_cold int decode_init(AVCodecContext *avctx) av_get_bytes_per_sample(avctx->sample_fmt)); if (!ctx->crc_buffer) { av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n"); - decode_end(avctx); - return AVERROR(ENOMEM); + ret = AVERROR(ENOMEM); + goto fail; } } @@ -1741,6 +1755,10 @@ static av_cold int decode_init(AVCodecContext *avctx) avctx->coded_frame = &ctx->frame; return 0; + +fail: + decode_end(avctx); + return ret; } diff --git a/gst-libs/ext/libav/libavcodec/atrac3.c b/gst-libs/ext/libav/libavcodec/atrac3.c index 910c15e..68ce247 100644 --- a/gst-libs/ext/libav/libavcodec/atrac3.c +++ b/gst-libs/ext/libav/libavcodec/atrac3.c @@ -664,8 +664,8 @@ static int decode_channel_sound_unit(ATRAC3Context *q, GetBitContext *gb, snd->num_components = decode_tonal_components(gb, snd->components, snd->bands_coded); - if (snd->num_components == -1) - return -1; + if (snd->num_components < 0) + return snd->num_components; num_subbands = decode_spectrum(gb, snd->spectrum); @@ -742,7 +742,7 @@ static int decode_frame(AVCodecContext *avctx, const uint8_t *databuf, /* set the bitstream reader at the start of the second Sound Unit*/ - init_get_bits(&q->gb, ptr1, avctx->block_align * 8); + init_get_bits(&q->gb, ptr1, (avctx->block_align - i) * 8); /* Fill the Weighting coeffs delay buffer */ memmove(q->weighting_delay, &q->weighting_delay[2], @@ -941,9 +941,11 @@ static av_cold int atrac3_decode_init(AVCodecContext *avctx) if (q->coding_mode == STEREO) av_log(avctx, AV_LOG_DEBUG, "Normal stereo detected.\n"); - else if (q->coding_mode == JOINT_STEREO) + else if (q->coding_mode == JOINT_STEREO) { + if (avctx->channels != 2) + return AVERROR_INVALIDDATA; av_log(avctx, AV_LOG_DEBUG, "Joint stereo detected.\n"); - else { + } else { av_log(avctx, AV_LOG_ERROR, "Unknown channel coding mode %x!\n", q->coding_mode); return AVERROR_INVALIDDATA; diff --git a/gst-libs/ext/libav/libavcodec/bink.c b/gst-libs/ext/libav/libavcodec/bink.c index 059601d..c637f4e 100644 --- a/gst-libs/ext/libav/libavcodec/bink.c +++ b/gst-libs/ext/libav/libavcodec/bink.c @@ -677,6 +677,9 @@ static int read_dct_coeffs(GetBitContext *gb, int32_t block[64], const uint8_t * quant_idx = q; } + if (quant_idx >= 16) + return AVERROR_INVALIDDATA; + quant = quant_matrices[quant_idx]; block[0] = (block[0] * quant[0]) >> 11; diff --git a/gst-libs/ext/libav/libavcodec/dcadec.c b/gst-libs/ext/libav/libavcodec/dcadec.c index f26111a..561c30c 100644 --- a/gst-libs/ext/libav/libavcodec/dcadec.c +++ b/gst-libs/ext/libav/libavcodec/dcadec.c @@ -809,6 +809,12 @@ static int dca_subframe_header(DCAContext *s, int base_channel, int block_index) "Invalid channel mode %d\n", am); return AVERROR_INVALIDDATA; } + if (s->prim_channels > FF_ARRAY_ELEMS(dca_default_coeffs[0])) { + av_log_ask_for_sample(s->avctx, "Downmixing %d channels", + s->prim_channels); + return AVERROR_PATCHWELCOME; + } + for (j = base_channel; j < s->prim_channels; j++) { s->downmix_coef[j][0] = dca_default_coeffs[am][j][0]; s->downmix_coef[j][1] = dca_default_coeffs[am][j][1]; @@ -1258,6 +1264,7 @@ static int dca_subsubframe(DCAContext *s, int base_channel, int block_index) #endif } else { av_log(s->avctx, AV_LOG_ERROR, "Didn't get subframe DSYNC\n"); + return AVERROR_INVALIDDATA; } } diff --git a/gst-libs/ext/libav/libavcodec/dsicinav.c b/gst-libs/ext/libav/libavcodec/dsicinav.c index 39b6a4c..772fb8d 100644 --- a/gst-libs/ext/libav/libavcodec/dsicinav.c +++ b/gst-libs/ext/libav/libavcodec/dsicinav.c @@ -109,27 +109,30 @@ static av_cold int cinvideo_decode_init(AVCodecContext *avctx) return 0; } -static void cin_apply_delta_data(const unsigned char *src, unsigned char *dst, int size) +static void cin_apply_delta_data(const unsigned char *src, unsigned char *dst, + int size) { while (size--) *dst++ += *src++; } -static int cin_decode_huffman(const unsigned char *src, int src_size, unsigned char *dst, int dst_size) +static int cin_decode_huffman(const unsigned char *src, int src_size, + unsigned char *dst, int dst_size) { int b, huff_code = 0; unsigned char huff_code_table[15]; - unsigned char *dst_cur = dst; - unsigned char *dst_end = dst + dst_size; + unsigned char *dst_cur = dst; + unsigned char *dst_end = dst + dst_size; const unsigned char *src_end = src + src_size; - memcpy(huff_code_table, src, 15); src += 15; + memcpy(huff_code_table, src, 15); + src += 15; while (src < src_end) { huff_code = *src++; if ((huff_code >> 4) == 15) { - b = huff_code << 4; - huff_code = *src++; + b = huff_code << 4; + huff_code = *src++; *dst_cur++ = b | (huff_code >> 4); } else *dst_cur++ = huff_code_table[huff_code >> 4]; @@ -148,11 +151,12 @@ static int cin_decode_huffman(const unsigned char *src, int src_size, unsigned c return dst_cur - dst; } -static int cin_decode_lzss(const unsigned char *src, int src_size, unsigned char *dst, int dst_size) +static int cin_decode_lzss(const unsigned char *src, int src_size, + unsigned char *dst, int dst_size) { uint16_t cmd; int i, sz, offset, code; - unsigned char *dst_end = dst + dst_size, *dst_start = dst; + unsigned char *dst_end = dst + dst_size, *dst_start = dst; const unsigned char *src_end = src + src_size; while (src < src_end && dst < dst_end) { @@ -161,13 +165,15 @@ static int cin_decode_lzss(const unsigned char *src, int src_size, unsigned char if (code & (1 << i)) { *dst++ = *src++; } else { - cmd = AV_RL16(src); src += 2; + cmd = AV_RL16(src); + src += 2; offset = cmd >> 4; - if ((int) (dst - dst_start) < offset + 1) + if ((int)(dst - dst_start) < offset + 1) return AVERROR_INVALIDDATA; sz = (cmd & 0xF) + 2; - /* don't use memcpy/memmove here as the decoding routine (ab)uses */ - /* buffer overlappings to repeat bytes in the destination */ + /* don't use memcpy/memmove here as the decoding routine + * (ab)uses buffer overlappings to repeat bytes in the + * destination */ sz = FFMIN(sz, dst_end - dst); while (sz--) { *dst = *(dst - offset - 1); @@ -180,20 +186,23 @@ static int cin_decode_lzss(const unsigned char *src, int src_size, unsigned char return 0; } -static void cin_decode_rle(const unsigned char *src, int src_size, unsigned char *dst, int dst_size) +static void cin_decode_rle(const unsigned char *src, int src_size, + unsigned char *dst, int dst_size) { int len, code; - unsigned char *dst_end = dst + dst_size; + unsigned char *dst_end = dst + dst_size; const unsigned char *src_end = src + src_size; while (src < src_end && dst < dst_end) { code = *src++; if (code & 0x80) { + if (src >= src_end) + break; len = code - 0x7F; memset(dst, *src++, FFMIN(len, dst_end - dst)); } else { len = code + 1; - memcpy(dst, src, FFMIN(len, dst_end - dst)); + memcpy(dst, src, FFMIN3(len, dst_end - dst, src_end - src)); src += len; } dst += len; @@ -204,15 +213,16 @@ static int cinvideo_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPacket *avpkt) { - const uint8_t *buf = avpkt->data; - int buf_size = avpkt->size; + const uint8_t *buf = avpkt->data; + int buf_size = avpkt->size; CinVideoContext *cin = avctx->priv_data; - int i, y, palette_type, palette_colors_count, bitmap_frame_type, bitmap_frame_size, res = 0; + int i, y, palette_type, palette_colors_count, + bitmap_frame_type, bitmap_frame_size, res = 0; - palette_type = buf[0]; - palette_colors_count = AV_RL16(buf+1); - bitmap_frame_type = buf[3]; - buf += 4; + palette_type = buf[0]; + palette_colors_count = AV_RL16(buf + 1); + bitmap_frame_type = buf[3]; + buf += 4; bitmap_frame_size = buf_size - 4; @@ -223,46 +233,50 @@ static int cinvideo_decode_frame(AVCodecContext *avctx, if (palette_colors_count > 256) return AVERROR_INVALIDDATA; for (i = 0; i < palette_colors_count; ++i) { - cin->palette[i] = bytestream_get_le24(&buf); + cin->palette[i] = bytestream_get_le24(&buf); bitmap_frame_size -= 3; } } else { for (i = 0; i < palette_colors_count; ++i) { - cin->palette[buf[0]] = AV_RL24(buf+1); - buf += 4; - bitmap_frame_size -= 4; + cin->palette[buf[0]] = AV_RL24(buf + 1); + buf += 4; + bitmap_frame_size -= 4; } } - /* note: the decoding routines below assumes that surface.width = surface.pitch */ + bitmap_frame_size = FFMIN(cin->bitmap_size, bitmap_frame_size); + + /* note: the decoding routines below assumes that + * surface.width = surface.pitch */ switch (bitmap_frame_type) { case 9: cin_decode_rle(buf, bitmap_frame_size, - cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); break; case 34: cin_decode_rle(buf, bitmap_frame_size, - cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); cin_apply_delta_data(cin->bitmap_table[CIN_PRE_BMP], - cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); break; case 35: cin_decode_huffman(buf, bitmap_frame_size, - cin->bitmap_table[CIN_INT_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_INT_BMP], cin->bitmap_size); cin_decode_rle(cin->bitmap_table[CIN_INT_BMP], bitmap_frame_size, - cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); break; case 36: bitmap_frame_size = cin_decode_huffman(buf, bitmap_frame_size, - cin->bitmap_table[CIN_INT_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_INT_BMP], + cin->bitmap_size); cin_decode_rle(cin->bitmap_table[CIN_INT_BMP], bitmap_frame_size, - cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); cin_apply_delta_data(cin->bitmap_table[CIN_PRE_BMP], - cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); break; case 37: cin_decode_huffman(buf, bitmap_frame_size, - cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); break; case 38: res = cin_decode_lzss(buf, bitmap_frame_size, @@ -278,24 +292,26 @@ static int cinvideo_decode_frame(AVCodecContext *avctx, if (res < 0) return res; cin_apply_delta_data(cin->bitmap_table[CIN_PRE_BMP], - cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); + cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_size); break; } cin->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE; - if (avctx->reget_buffer(avctx, &cin->frame)) { - av_log(cin->avctx, AV_LOG_ERROR, "delphinecinvideo: reget_buffer() failed to allocate a frame\n"); - return -1; + if ((res = avctx->reget_buffer(avctx, &cin->frame)) < 0) { + av_log(cin->avctx, AV_LOG_ERROR, + "delphinecinvideo: reget_buffer() failed to allocate a frame\n"); + return res; } memcpy(cin->frame.data[1], cin->palette, sizeof(cin->palette)); cin->frame.palette_has_changed = 1; for (y = 0; y < cin->avctx->height; ++y) memcpy(cin->frame.data[0] + (cin->avctx->height - 1 - y) * cin->frame.linesize[0], - cin->bitmap_table[CIN_CUR_BMP] + y * cin->avctx->width, - cin->avctx->width); + cin->bitmap_table[CIN_CUR_BMP] + y * cin->avctx->width, + cin->avctx->width); - FFSWAP(uint8_t *, cin->bitmap_table[CIN_CUR_BMP], cin->bitmap_table[CIN_PRE_BMP]); + FFSWAP(uint8_t *, cin->bitmap_table[CIN_CUR_BMP], + cin->bitmap_table[CIN_PRE_BMP]); *got_frame = 1; *(AVFrame *)data = cin->frame; @@ -336,8 +352,8 @@ static av_cold int cinaudio_decode_init(AVCodecContext *avctx) static int cinaudio_decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr, AVPacket *avpkt) { - const uint8_t *buf = avpkt->data; - CinAudioContext *cin = avctx->priv_data; + const uint8_t *buf = avpkt->data; + CinAudioContext *cin = avctx->priv_data; const uint8_t *buf_end = buf + avpkt->size; int16_t *samples; int delta, ret; @@ -353,13 +369,13 @@ static int cinaudio_decode_frame(AVCodecContext *avctx, void *data, delta = cin->delta; if (cin->initial_decode_frame) { cin->initial_decode_frame = 0; - delta = sign_extend(AV_RL16(buf), 16); - buf += 2; - *samples++ = delta; + delta = sign_extend(AV_RL16(buf), 16); + buf += 2; + *samples++ = delta; } while (buf < buf_end) { - delta += cinaudio_delta16_table[*buf++]; - delta = av_clip_int16(delta); + delta += cinaudio_delta16_table[*buf++]; + delta = av_clip_int16(delta); *samples++ = delta; } cin->delta = delta; @@ -370,7 +386,6 @@ static int cinaudio_decode_frame(AVCodecContext *avctx, void *data, return avpkt->size; } - AVCodec ff_dsicinvideo_decoder = { .name = "dsicinvideo", .type = AVMEDIA_TYPE_VIDEO, diff --git a/gst-libs/ext/libav/libavcodec/dxa.c b/gst-libs/ext/libav/libavcodec/dxa.c index 0f590f1..ddc8d98 100644 --- a/gst-libs/ext/libav/libavcodec/dxa.c +++ b/gst-libs/ext/libav/libavcodec/dxa.c @@ -256,6 +256,12 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac case 5: c->pic.key_frame = !(compr & 1); c->pic.pict_type = (compr & 1) ? AV_PICTURE_TYPE_P : AV_PICTURE_TYPE_I; + + if (!tmpptr && !c->pic.key_frame) { + av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n"); + return AVERROR_INVALIDDATA; + } + for(j = 0; j < avctx->height; j++){ if(compr & 1){ for(i = 0; i < avctx->width; i++) diff --git a/gst-libs/ext/libav/libavcodec/h261dec.c b/gst-libs/ext/libav/libavcodec/h261dec.c index 55453c1..77c6cab 100644 --- a/gst-libs/ext/libav/libavcodec/h261dec.c +++ b/gst-libs/ext/libav/libavcodec/h261dec.c @@ -286,6 +286,11 @@ static int h261_decode_mb(H261Context *h){ // Read mtype h->mtype = get_vlc2(&s->gb, h261_mtype_vlc.table, H261_MTYPE_VLC_BITS, 2); + if (h->mtype < 0 || h->mtype >= FF_ARRAY_ELEMS(h261_mtype_map)) { + av_log(s->avctx, AV_LOG_ERROR, "Invalid mtype index %d\n", + h->mtype); + return SLICE_ERROR; + } h->mtype = h261_mtype_map[h->mtype]; // Read mquant diff --git a/gst-libs/ext/libav/libavcodec/iff.c b/gst-libs/ext/libav/libavcodec/iff.c index 99da7b5..b7a7bb3 100644 --- a/gst-libs/ext/libav/libavcodec/iff.c +++ b/gst-libs/ext/libav/libavcodec/iff.c @@ -272,7 +272,7 @@ static int decode_frame_ilbm(AVCodecContext *avctx, if (avctx->codec_tag == MKTAG('I','L','B','M')) { // interleaved if (avctx->pix_fmt == AV_PIX_FMT_PAL8 || avctx->pix_fmt == AV_PIX_FMT_GRAY8) { - for(y = 0; y < avctx->height; y++ ) { + for (y = 0; y < avctx->height && buf < buf_end; y++ ) { uint8_t *row = &s->frame.data[0][ y*s->frame.linesize[0] ]; memset(row, 0, avctx->width); for (plane = 0; plane < avctx->bits_per_coded_sample && buf < buf_end; plane++) { diff --git a/gst-libs/ext/libav/libavcodec/imc.c b/gst-libs/ext/libav/libavcodec/imc.c index 5cff70f..316dd77 100644 --- a/gst-libs/ext/libav/libavcodec/imc.c +++ b/gst-libs/ext/libav/libavcodec/imc.c @@ -450,6 +450,10 @@ static int bit_allocation(IMCContext *q, IMCChannel *chctx, iacc += chctx->bandWidthT[i]; summa += chctx->bandWidthT[i] * chctx->flcoeffs4[i]; } + + if (!iacc) + return AVERROR_INVALIDDATA; + chctx->bandWidthT[BANDS - 1] = 0; summa = (summa * 0.5 - freebits) / iacc; diff --git a/gst-libs/ext/libav/libavcodec/indeo4.c b/gst-libs/ext/libav/libavcodec/indeo4.c index 2eebc26..42b1130 100644 --- a/gst-libs/ext/libav/libavcodec/indeo4.c +++ b/gst-libs/ext/libav/libavcodec/indeo4.c @@ -210,6 +210,7 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx) if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf)) { if (ff_ivi_init_planes(ctx->planes, &pic_conf)) { av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n"); + ctx->pic_conf.luma_bands = 0; return AVERROR(ENOMEM); } @@ -347,12 +348,25 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, band->inv_transform = transforms[transform_id].inv_trans; band->dc_transform = transforms[transform_id].dc_trans; band->is_2d_trans = transforms[transform_id].is_2d_trans; + if (transform_id < 10) + band->transform_size = 8; + else + band->transform_size = 4; + + if (band->blk_size != band->transform_size) + return AVERROR_INVALIDDATA; scan_indx = get_bits(&ctx->gb, 4); if (scan_indx == 15) { av_log(avctx, AV_LOG_ERROR, "Custom scan pattern encountered!\n"); return AVERROR_INVALIDDATA; } + if (scan_indx > 4 && scan_indx < 10) { + if (band->blk_size != 4) + return AVERROR_INVALIDDATA; + } else if (band->blk_size != 8) + return AVERROR_INVALIDDATA; + band->scan = scan_index_to_tab[scan_indx]; band->quant_mat = get_bits(&ctx->gb, 5); @@ -360,6 +374,11 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, av_log(avctx, AV_LOG_ERROR, "Custom quant matrix encountered!\n"); return AVERROR_INVALIDDATA; } + if (band->quant_mat >= FF_ARRAY_ELEMS(quant_index_to_tab)) { + av_log_ask_for_sample(avctx, "Quantization matrix %d", + band->quant_mat); + return AVERROR_INVALIDDATA; + } } /* decode block huffman codebook */ @@ -457,7 +476,7 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, } mb->mv_x = mb->mv_y = 0; /* no motion vector coded */ - if (band->inherit_mv) { + if (band->inherit_mv && ref_mb) { /* motion vector inheritance */ if (mv_scale) { mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale); @@ -469,7 +488,10 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, } } else { if (band->inherit_mv) { - mb->type = ref_mb->type; /* copy mb_type from corresponding reference mb */ + /* copy mb_type from corresponding reference mb */ + if (!ref_mb) + return AVERROR_INVALIDDATA; + mb->type = ref_mb->type; } else if (ctx->frame_type == FRAMETYPE_INTRA || ctx->frame_type == FRAMETYPE_INTRA1) { mb->type = 0; /* mb_type is always INTRA for intra-frames */ @@ -493,14 +515,15 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, mb->mv_x = mb->mv_y = 0; /* there is no motion vector in intra-macroblocks */ } else { if (band->inherit_mv) { - /* motion vector inheritance */ - if (mv_scale) { - mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale); - mb->mv_y = ivi_scale_mv(ref_mb->mv_y, mv_scale); - } else { - mb->mv_x = ref_mb->mv_x; - mb->mv_y = ref_mb->mv_y; - } + if (ref_mb) + /* motion vector inheritance */ + if (mv_scale) { + mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale); + mb->mv_y = ivi_scale_mv(ref_mb->mv_y, mv_scale); + } else { + mb->mv_x = ref_mb->mv_x; + mb->mv_y = ref_mb->mv_y; + } } else { /* decode motion vector deltas */ mv_delta = get_vlc2(&ctx->gb, ctx->mb_vlc.tab->table, diff --git a/gst-libs/ext/libav/libavcodec/indeo5.c b/gst-libs/ext/libav/libavcodec/indeo5.c index dc5f6f0..b7cfc5f 100644 --- a/gst-libs/ext/libav/libavcodec/indeo5.c +++ b/gst-libs/ext/libav/libavcodec/indeo5.c @@ -74,7 +74,7 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx) tile_size = (ctx->gop_flags & 0x40) ? 64 << get_bits(&ctx->gb, 2) : 0; if (tile_size > 256) { av_log(avctx, AV_LOG_ERROR, "Invalid tile size: %d\n", tile_size); - return -1; + return AVERROR_INVALIDDATA; } /* decode number of wavelet bands */ @@ -85,7 +85,7 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx) if (ctx->is_scalable && (pic_conf.luma_bands != 4 || pic_conf.chroma_bands != 1)) { av_log(avctx, AV_LOG_ERROR, "Scalability: unsupported subdivision! Luma bands: %d, chroma bands: %d\n", pic_conf.luma_bands, pic_conf.chroma_bands); - return -1; + return AVERROR_INVALIDDATA; } pic_size_indx = get_bits(&ctx->gb, 4); @@ -98,8 +98,8 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx) } if (ctx->gop_flags & 2) { - av_log(avctx, AV_LOG_ERROR, "YV12 picture format not supported!\n"); - return -1; + av_log_missing_feature(avctx, "YV12 picture format", 0); + return AVERROR_PATCHWELCOME; } pic_conf.chroma_height = (pic_conf.pic_height + 3) >> 2; @@ -113,11 +113,11 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx) } /* check if picture layout was changed and reallocate buffers */ - if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf)) { + if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf) || ctx->gop_invalid) { result = ff_ivi_init_planes(ctx->planes, &pic_conf); - if (result) { + if (result < 0) { av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n"); - return -1; + return result; } ctx->pic_conf = pic_conf; blk_size_changed = 1; /* force reallocation of the internal structures */ @@ -140,46 +140,54 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx) } if (get_bits1(&ctx->gb)) { - av_log(avctx, AV_LOG_ERROR, "Extended transform info encountered!\n"); - return -1; + av_log_missing_feature(avctx, "Extended transform info", 0); + return AVERROR_PATCHWELCOME; } /* select transform function and scan pattern according to plane and band number */ switch ((p << 2) + i) { case 0: - band->inv_transform = ff_ivi_inverse_slant_8x8; - band->dc_transform = ff_ivi_dc_slant_2d; - band->scan = ff_zigzag_direct; + band->inv_transform = ff_ivi_inverse_slant_8x8; + band->dc_transform = ff_ivi_dc_slant_2d; + band->scan = ff_zigzag_direct; + band->transform_size = 8; break; case 1: - band->inv_transform = ff_ivi_row_slant8; - band->dc_transform = ff_ivi_dc_row_slant; - band->scan = ff_ivi_vertical_scan_8x8; + band->inv_transform = ff_ivi_row_slant8; + band->dc_transform = ff_ivi_dc_row_slant; + band->scan = ff_ivi_vertical_scan_8x8; + band->transform_size = 8; break; case 2: - band->inv_transform = ff_ivi_col_slant8; - band->dc_transform = ff_ivi_dc_col_slant; - band->scan = ff_ivi_horizontal_scan_8x8; + band->inv_transform = ff_ivi_col_slant8; + band->dc_transform = ff_ivi_dc_col_slant; + band->scan = ff_ivi_horizontal_scan_8x8; + band->transform_size = 8; break; case 3: - band->inv_transform = ff_ivi_put_pixels_8x8; - band->dc_transform = ff_ivi_put_dc_pixel_8x8; - band->scan = ff_ivi_horizontal_scan_8x8; + band->inv_transform = ff_ivi_put_pixels_8x8; + band->dc_transform = ff_ivi_put_dc_pixel_8x8; + band->scan = ff_ivi_horizontal_scan_8x8; + band->transform_size = 8; break; case 4: - band->inv_transform = ff_ivi_inverse_slant_4x4; - band->dc_transform = ff_ivi_dc_slant_2d; - band->scan = ff_ivi_direct_scan_4x4; + band->inv_transform = ff_ivi_inverse_slant_4x4; + band->dc_transform = ff_ivi_dc_slant_2d; + band->scan = ff_ivi_direct_scan_4x4; + band->transform_size = 4; break; } band->is_2d_trans = band->inv_transform == ff_ivi_inverse_slant_8x8 || band->inv_transform == ff_ivi_inverse_slant_4x4; + if (band->transform_size != band->blk_size) + return AVERROR_INVALIDDATA; + /* select dequant matrix according to plane and band number */ if (!p) { quant_mat = (pic_conf.luma_bands > 1) ? i+1 : 0; @@ -201,7 +209,7 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx) if (get_bits(&ctx->gb, 2)) { av_log(avctx, AV_LOG_ERROR, "End marker missing!\n"); - return -1; + return AVERROR_INVALIDDATA; } } } @@ -230,17 +238,17 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx) if (blk_size_changed) { result = ff_ivi_init_tiles(ctx->planes, pic_conf.tile_width, pic_conf.tile_height); - if (result) { + if (result < 0) { av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate internal structures!\n"); - return -1; + return result; } } if (ctx->gop_flags & 8) { if (get_bits(&ctx->gb, 3)) { av_log(avctx, AV_LOG_ERROR, "Alignment bits are not zero!\n"); - return -1; + return AVERROR_INVALIDDATA; } if (get_bits1(&ctx->gb)) @@ -289,25 +297,27 @@ static inline void skip_hdr_extension(GetBitContext *gb) */ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx) { + int ret; + if (get_bits(&ctx->gb, 5) != 0x1F) { av_log(avctx, AV_LOG_ERROR, "Invalid picture start code!\n"); - return -1; + return AVERROR_INVALIDDATA; } ctx->prev_frame_type = ctx->frame_type; ctx->frame_type = get_bits(&ctx->gb, 3); if (ctx->frame_type >= 5) { av_log(avctx, AV_LOG_ERROR, "Invalid frame type: %d \n", ctx->frame_type); - return -1; + return AVERROR_INVALIDDATA; } ctx->frame_num = get_bits(&ctx->gb, 8); if (ctx->frame_type == FRAMETYPE_INTRA) { - ctx->gop_invalid = 1; - if (decode_gop_header(ctx, avctx)) { + if ((ret = decode_gop_header(ctx, avctx)) < 0) { av_log(avctx, AV_LOG_ERROR, "Invalid GOP header, skipping frames.\n"); - return AVERROR_INVALIDDATA; + ctx->gop_invalid = 1; + return ret; } ctx->gop_invalid = 0; } @@ -324,8 +334,10 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx) skip_hdr_extension(&ctx->gb); /* XXX: untested */ /* decode macroblock huffman codebook */ - if (ff_ivi_dec_huff_desc(&ctx->gb, ctx->frame_flags & 0x40, IVI_MB_HUFF, &ctx->mb_vlc, avctx)) - return -1; + ret = ff_ivi_dec_huff_desc(&ctx->gb, ctx->frame_flags & 0x40, + IVI_MB_HUFF, &ctx->mb_vlc, avctx); + if (ret < 0) + return ret; skip_bits(&ctx->gb, 3); /* FIXME: unknown meaning! */ } @@ -347,7 +359,7 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx) static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, AVCodecContext *avctx) { - int i; + int i, ret; uint8_t band_flags; band_flags = get_bits(&ctx->gb, 8); @@ -371,7 +383,7 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, if (band->num_corr > 61) { av_log(avctx, AV_LOG_ERROR, "Too many corrections: %d\n", band->num_corr); - return -1; + return AVERROR_INVALIDDATA; } /* read correction pairs */ @@ -383,8 +395,10 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, band->rvmap_sel = (band_flags & 0x40) ? get_bits(&ctx->gb, 3) : 8; /* decode block huffman codebook */ - if (ff_ivi_dec_huff_desc(&ctx->gb, band_flags & 0x80, IVI_BLK_HUFF, &band->blk_vlc, avctx)) - return -1; + ret = ff_ivi_dec_huff_desc(&ctx->gb, band_flags & 0x80, IVI_BLK_HUFF, + &band->blk_vlc, avctx); + if (ret < 0) + return ret; band->checksum_present = get_bits1(&ctx->gb); if (band->checksum_present) @@ -451,7 +465,7 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, if (get_bits1(&ctx->gb)) { if (ctx->frame_type == FRAMETYPE_INTRA) { av_log(avctx, AV_LOG_ERROR, "Empty macroblock in an INTRA picture!\n"); - return -1; + return AVERROR_INVALIDDATA; } mb->type = 1; /* empty macroblocks are always INTER */ mb->cbp = 0; /* all blocks are empty */ @@ -615,7 +629,7 @@ static av_cold int decode_init(AVCodecContext *avctx) result = ff_ivi_init_planes(ctx->planes, &ctx->pic_conf); if (result) { av_log(avctx, AV_LOG_ERROR, "Couldn't allocate color planes!\n"); - return -1; + return AVERROR_INVALIDDATA; } ctx->buf_switch = 0; diff --git a/gst-libs/ext/libav/libavcodec/ivi_common.c b/gst-libs/ext/libav/libavcodec/ivi_common.c index 815a5cb..2a73754 100644 --- a/gst-libs/ext/libav/libavcodec/ivi_common.c +++ b/gst-libs/ext/libav/libavcodec/ivi_common.c @@ -44,16 +44,22 @@ static VLC ivi_blk_vlc_tabs[8]; ///< static block Huffman tables typedef void (*ivi_mc_func) (int16_t *buf, const int16_t *ref_buf, uint32_t pitch, int mc_type); -static int ivi_mc(ivi_mc_func mc, int16_t *buf, const int16_t *ref_buf, - int offs, int mv_x, int mv_y, uint32_t pitch, - int mc_type) +static int ivi_mc(IVIBandDesc *band, ivi_mc_func mc, + int offs, int mv_x, int mv_y, int mc_type) { - int ref_offs = offs + mv_y * pitch + mv_x; + int ref_offs = offs + mv_y * band->pitch + mv_x; + int buf_size = band->pitch * band->aheight; + int min_size = band->pitch * (band->blk_size - 1) + band->blk_size; + int ref_size = (mc_type > 1) * band->pitch + (mc_type & 1); - if (offs < 0 || ref_offs < 0 || !ref_buf) + if (offs < 0 || ref_offs < 0 || !band->ref_buf) + return AVERROR_INVALIDDATA; + if (buf_size - min_size < offs) + return AVERROR_INVALIDDATA; + if (buf_size - min_size - ref_size < ref_offs) return AVERROR_INVALIDDATA; - mc(buf + offs, ref_buf + ref_offs, pitch, mc_type); + mc(band->buf + offs, band->ref_buf + ref_offs, band->pitch, mc_type); return 0; } @@ -238,6 +244,7 @@ static av_cold void ivi_free_buffers(IVIPlaneDesc *planes) av_freep(&planes[p].bands[b].tiles); } av_freep(&planes[p].bands); + planes[p].num_bands = 0; } } @@ -250,6 +257,10 @@ av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg) ivi_free_buffers(planes); + if (cfg->pic_width < 1 || cfg->pic_height < 1 || + cfg->luma_bands < 1 || cfg->chroma_bands < 1) + return AVERROR_INVALIDDATA; + /* fill in the descriptor of the luminance plane */ planes[0].width = cfg->pic_width; planes[0].height = cfg->pic_height; @@ -332,6 +343,8 @@ static int ivi_init_tiles(IVIBandDesc *band, IVITile *ref_tile, tile->ref_mbs = 0; if (p || b) { + if (tile->num_MBs != ref_tile->num_MBs) + return AVERROR_INVALIDDATA; tile->ref_mbs = ref_tile->mbs; ref_tile++; } @@ -407,6 +420,24 @@ static int ivi_dec_tile_data_size(GetBitContext *gb) return len; } +static int ivi_dc_transform(IVIBandDesc *band, int *prev_dc, int buf_offs, + int blk_size) +{ + int buf_size = band->pitch * band->aheight - buf_offs; + int min_size = (blk_size - 1) * band->pitch + blk_size; + + if (!band->dc_transform) + return 0; + + + if (min_size > buf_size) + return AVERROR_INVALIDDATA; + + band->dc_transform(prev_dc, band->buf + buf_offs, + band->pitch, blk_size); + + return 0; +} static int ivi_decode_coded_blocks(GetBitContext *gb, IVIBandDesc *band, ivi_mc_func mc, int mv_x, int mv_y, @@ -424,6 +455,12 @@ static int ivi_decode_coded_blocks(GetBitContext *gb, IVIBandDesc *band, int num_coeffs = blk_size * blk_size; int col_mask = blk_size - 1; int scan_pos = -1; + int min_size = band->pitch * (band->transform_size - 1) + + band->transform_size; + int buf_size = band->pitch * band->aheight - offs; + + if (min_size > buf_size) + return AVERROR_INVALIDDATA; if (!band->scan) { av_log(avctx, AV_LOG_ERROR, "Scan pattern is not set.\n"); @@ -489,8 +526,7 @@ static int ivi_decode_coded_blocks(GetBitContext *gb, IVIBandDesc *band, /* apply motion compensation */ if (!is_intra) - return ivi_mc(mc, band->buf, band->ref_buf, offs, mv_x, mv_y, - band->pitch, mc_type); + return ivi_mc(band, mc, offs, mv_x, mv_y, mc_type); return 0; } @@ -585,12 +621,12 @@ static int ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, /* for intra blocks apply the dc slant transform */ /* for inter - perform the motion compensation without delta */ if (is_intra) { - if (band->dc_transform) - band->dc_transform(&prev_dc, band->buf + buf_offs, - band->pitch, blk_size); + ret = ivi_dc_transform(band, &prev_dc, buf_offs, blk_size); + if (ret < 0) + return ret; } else { - ret = ivi_mc(mc_no_delta_func, band->buf, band->ref_buf, - buf_offs, mv_x, mv_y, band->pitch, mc_type); + ret = ivi_mc(band, mc_no_delta_func, buf_offs, + mv_x, mv_y, mc_type); if (ret < 0) return ret; } @@ -696,8 +732,8 @@ static int ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band, for (blk = 0; blk < num_blocks; blk++) { /* adjust block position in the buffer according with its number */ offs = mb->buf_offs + band->blk_size * ((blk & 1) + !!(blk & 2) * band->pitch); - ret = ivi_mc(mc_no_delta_func, band->buf, band->ref_buf, - offs, mv_x, mv_y, band->pitch, mc_type); + ret = ivi_mc(band, mc_no_delta_func, offs, + mv_x, mv_y, mc_type); if (ret < 0) return ret; } @@ -917,6 +953,14 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, } } } + } else { + if (ctx->is_scalable) + return AVERROR_INVALIDDATA; + + for (p = 0; p < 3; p++) { + if (!ctx->planes[p].bands[0].buf) + return AVERROR_INVALIDDATA; + } } //STOP_TIMER("decode_planes"); } diff --git a/gst-libs/ext/libav/libavcodec/ivi_common.h b/gst-libs/ext/libav/libavcodec/ivi_common.h index 8ac41a5..fb25374 100644 --- a/gst-libs/ext/libav/libavcodec/ivi_common.h +++ b/gst-libs/ext/libav/libavcodec/ivi_common.h @@ -159,6 +159,7 @@ typedef struct IVIBandDesc { int num_tiles; ///< number of tiles in this band IVITile *tiles; ///< array of tile descriptors InvTransformPtr *inv_transform; + int transform_size; DCTransformPtr *dc_transform; int is_2d_trans; ///< 1 indicates that the two-dimensional inverse transform is used int32_t checksum; ///< for debug purposes diff --git a/gst-libs/ext/libav/libavcodec/mjpegdec.c b/gst-libs/ext/libav/libavcodec/mjpegdec.c index 05f2f02..74bbfa6 100644 --- a/gst-libs/ext/libav/libavcodec/mjpegdec.c +++ b/gst-libs/ext/libav/libavcodec/mjpegdec.c @@ -243,6 +243,13 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) if (nb_components <= 0 || nb_components > MAX_COMPONENTS) return -1; + if (s->interlaced && (s->bottom_field == !s->interlace_polarity)) { + if (nb_components != s->nb_components) { + av_log(s->avctx, AV_LOG_ERROR, + "nb_components changing in interlaced picture\n"); + return AVERROR_INVALIDDATA; + } + } if (s->ls && !(s->bits <= 8 || nb_components == 1)) { av_log_missing_feature(s->avctx, "For JPEG-LS anything except <= 8 bits/component" diff --git a/gst-libs/ext/libav/libavcodec/mlpdec.c b/gst-libs/ext/libav/libavcodec/mlpdec.c index 0eaf2e3..d999495 100644 --- a/gst-libs/ext/libav/libavcodec/mlpdec.c +++ b/gst-libs/ext/libav/libavcodec/mlpdec.c @@ -392,9 +392,10 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp, uint8_t checksum; uint8_t lossless_check; int start_count = get_bits_count(gbp); - const int max_matrix_channel = m->avctx->codec_id == AV_CODEC_ID_MLP - ? MAX_MATRIX_CHANNEL_MLP - : MAX_MATRIX_CHANNEL_TRUEHD; + int min_channel, max_channel, max_matrix_channel; + const int std_max_matrix_channel = m->avctx->codec_id == AV_CODEC_ID_MLP + ? MAX_MATRIX_CHANNEL_MLP + : MAX_MATRIX_CHANNEL_TRUEHD; sync_word = get_bits(gbp, 13); @@ -413,18 +414,18 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp, skip_bits(gbp, 16); /* Output timestamp */ - s->min_channel = get_bits(gbp, 4); - s->max_channel = get_bits(gbp, 4); - s->max_matrix_channel = get_bits(gbp, 4); + min_channel = get_bits(gbp, 4); + max_channel = get_bits(gbp, 4); + max_matrix_channel = get_bits(gbp, 4); - if (s->max_matrix_channel > max_matrix_channel) { + if (max_matrix_channel > std_max_matrix_channel) { av_log(m->avctx, AV_LOG_ERROR, "Max matrix channel cannot be greater than %d.\n", max_matrix_channel); return AVERROR_INVALIDDATA; } - if (s->max_channel != s->max_matrix_channel) { + if (max_channel != max_matrix_channel) { av_log(m->avctx, AV_LOG_ERROR, "Max channel must be equal max matrix channel.\n"); return AVERROR_INVALIDDATA; @@ -439,15 +440,20 @@ static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp, return AVERROR_PATCHWELCOME; } - if (s->min_channel > s->max_channel) { + if (min_channel > max_channel) { av_log(m->avctx, AV_LOG_ERROR, "Substream min channel cannot be greater than max channel.\n"); return AVERROR_INVALIDDATA; } - if (m->avctx->request_channels > 0 - && s->max_channel + 1 >= m->avctx->request_channels - && substr < m->max_decoded_substream) { + + s->min_channel = min_channel; + s->max_channel = max_channel; + s->max_matrix_channel = max_matrix_channel; + + if (m->avctx->request_channels > 0 && + m->avctx->request_channels <= s->max_channel + 1 && + m->max_decoded_substream > substr) { av_log(m->avctx, AV_LOG_DEBUG, "Extracting %d channel downmix from substream %d. " "Further substreams will be skipped.\n", diff --git a/gst-libs/ext/libav/libavcodec/mpegvideo_motion.c b/gst-libs/ext/libav/libavcodec/mpegvideo_motion.c index 536377a..a432763 100644 --- a/gst-libs/ext/libav/libavcodec/mpegvideo_motion.c +++ b/gst-libs/ext/libav/libavcodec/mpegvideo_motion.c @@ -214,7 +214,8 @@ void mpeg_motion_internal(MpegEncContext *s, { uint8_t *ptr_y, *ptr_cb, *ptr_cr; int dxy, uvdxy, mx, my, src_x, src_y, - uvsrc_x, uvsrc_y, v_edge_pos, uvlinesize, linesize; + uvsrc_x, uvsrc_y, v_edge_pos; + ptrdiff_t uvlinesize, linesize; #if 0 if(s->quarter_sample) diff --git a/gst-libs/ext/libav/libavcodec/nuv.c b/gst-libs/ext/libav/libavcodec/nuv.c index 0b47e97..e253bfb 100644 --- a/gst-libs/ext/libav/libavcodec/nuv.c +++ b/gst-libs/ext/libav/libavcodec/nuv.c @@ -87,7 +87,7 @@ static int get_quant(AVCodecContext *avctx, NuvContext *c, const uint8_t *buf, int i; if (size < 2 * 64 * 4) { av_log(avctx, AV_LOG_ERROR, "insufficient rtjpeg quant data\n"); - return -1; + return AVERROR_INVALIDDATA; } for (i = 0; i < 64; i++, buf += 4) c->lq[i] = AV_RL32(buf); @@ -113,29 +113,37 @@ static int codec_reinit(AVCodecContext *avctx, int width, int height, int quality) { NuvContext *c = avctx->priv_data; + int ret; + width = FFALIGN(width, 2); height = FFALIGN(height, 2); if (quality >= 0) get_quant_quality(c, quality); if (width != c->width || height != c->height) { - if (av_image_check_size(height, width, 0, avctx) < 0) - return 0; + void *ptr; + if ((ret = av_image_check_size(height, width, 0, avctx)) < 0) + return ret; avctx->width = c->width = width; avctx->height = c->height = height; - av_fast_malloc(&c->decomp_buf, &c->decomp_size, - c->height * c->width * 3 / 2); - if (!c->decomp_buf) { + ptr = av_fast_realloc(c->decomp_buf, &c->decomp_size, + c->height * c->width * 3 / 2 + + FF_INPUT_BUFFER_PADDING_SIZE + + RTJPEG_HEADER_SIZE); + if (!ptr) { av_log(avctx, AV_LOG_ERROR, "Can't allocate decompression buffer.\n"); - return 0; - } + return AVERROR(ENOMEM); + } else + c->decomp_buf = ptr; ff_rtjpeg_decode_init(&c->rtj, &c->dsp, c->width, c->height, c->lq, c->cq); + if (c->pic.data[0]) + avctx->release_buffer(avctx, &c->pic); } else if (quality != c->quality) ff_rtjpeg_decode_init(&c->rtj, &c->dsp, c->width, c->height, c->lq, c->cq); - return 1; + return 0; } static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, @@ -148,6 +156,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, int orig_size = buf_size; int keyframe; int result; + int ret; enum { NUV_UNCOMPRESSED = '0', NUV_RTJPEG = '1', @@ -159,7 +168,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, if (buf_size < 12) { av_log(avctx, AV_LOG_ERROR, "coded frame too small\n"); - return -1; + return AVERROR_INVALIDDATA; } // codec data (rtjpeg quant tables) @@ -178,7 +187,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, if (buf[0] != 'V' || buf_size < 12) { av_log(avctx, AV_LOG_ERROR, "not a nuv video frame\n"); - return -1; + return AVERROR_INVALIDDATA; } comptype = buf[1]; switch (comptype) { @@ -197,11 +206,14 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, buf = &buf[12]; buf_size -= 12; if (comptype == NUV_RTJPEG_IN_LZO || comptype == NUV_LZO) { - int outlen = c->decomp_size, inlen = buf_size; - if (av_lzo1x_decode(c->decomp_buf, &outlen, buf, &inlen)) + int outlen = c->decomp_size - FF_INPUT_BUFFER_PADDING_SIZE; + int inlen = buf_size; + if (av_lzo1x_decode(c->decomp_buf, &outlen, buf, &inlen)) { av_log(avctx, AV_LOG_ERROR, "error during lzo decompression\n"); + return AVERROR_INVALIDDATA; + } buf = c->decomp_buf; - buf_size = c->decomp_size; + buf_size = outlen; } if (c->codec_frameheader) { int w, h, q; @@ -213,8 +225,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, w = AV_RL16(&buf[6]); h = AV_RL16(&buf[8]); q = buf[10]; - if (!codec_reinit(avctx, w, h, q)) - return -1; + if ((result = codec_reinit(avctx, w, h, q)) < 0) + return result; + if (comptype == NUV_RTJPEG_IN_LZO || comptype == NUV_LZO) + buf = c->decomp_buf; buf = &buf[RTJPEG_HEADER_SIZE]; buf_size -= RTJPEG_HEADER_SIZE; } @@ -227,7 +241,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, result = avctx->reget_buffer(avctx, &c->pic); if (result < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); - return -1; + return result; } c->pic.pict_type = keyframe ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P; @@ -246,7 +260,9 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, } case NUV_RTJPEG_IN_LZO: case NUV_RTJPEG: - ff_rtjpeg_decode_frame_yuv420(&c->rtj, &c->pic, buf, buf_size); + ret = ff_rtjpeg_decode_frame_yuv420(&c->rtj, &c->pic, buf, buf_size); + if (ret < 0) + return ret; break; case NUV_BLACK: memset(c->pic.data[0], 0, c->width * c->height); @@ -258,7 +274,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, break; default: av_log(avctx, AV_LOG_ERROR, "unknown compression\n"); - return -1; + return AVERROR_INVALIDDATA; } *picture = c->pic; @@ -269,6 +285,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, static av_cold int decode_init(AVCodecContext *avctx) { NuvContext *c = avctx->priv_data; + int ret; + avctx->pix_fmt = AV_PIX_FMT_YUV420P; c->pic.data[0] = NULL; c->decomp_buf = NULL; @@ -283,8 +301,8 @@ static av_cold int decode_init(AVCodecContext *avctx) ff_dsputil_init(&c->dsp, avctx); - if (!codec_reinit(avctx, avctx->width, avctx->height, -1)) - return 1; + if ((ret = codec_reinit(avctx, avctx->width, avctx->height, -1)) < 0) + return ret; return 0; } diff --git a/gst-libs/ext/libav/libavcodec/pcm.c b/gst-libs/ext/libav/libavcodec/pcm.c index d6899cf..5cc989b 100644 --- a/gst-libs/ext/libav/libavcodec/pcm.c +++ b/gst-libs/ext/libav/libavcodec/pcm.c @@ -268,7 +268,7 @@ static int pcm_decode_frame(AVCodecContext *avctx, void *data, /* av_get_bits_per_sample returns 0 for AV_CODEC_ID_PCM_DVD */ samples_per_block = 1; - if (AV_CODEC_ID_PCM_DVD == avctx->codec_id) { + if (avctx->codec->id == AV_CODEC_ID_PCM_DVD) { if (avctx->bits_per_coded_sample != 20 && avctx->bits_per_coded_sample != 24) { av_log(avctx, AV_LOG_ERROR, "PCM DVD unsupported sample depth\n"); diff --git a/gst-libs/ext/libav/libavcodec/pcx.c b/gst-libs/ext/libav/libavcodec/pcx.c index 1bd8612..ba3703a 100644 --- a/gst-libs/ext/libav/libavcodec/pcx.c +++ b/gst-libs/ext/libav/libavcodec/pcx.c @@ -44,16 +44,19 @@ static av_cold int pcx_init(AVCodecContext *avctx) { /** * @return advanced src pointer */ -static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst, - unsigned int bytes_per_scanline, int compressed) { +static const uint8_t *pcx_rle_decode(const uint8_t *src, + const uint8_t *end, + uint8_t *dst, + unsigned int bytes_per_scanline, + int compressed) { unsigned int i = 0; unsigned char run, value; if (compressed) { - while (i<bytes_per_scanline) { + while (i < bytes_per_scanline && src < end) { run = 1; value = *src++; - if (value >= 0xc0) { + if (value >= 0xc0 && src < end) { run = value & 0x3f; value = *src++; } @@ -88,6 +91,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x, bytes_per_scanline; uint8_t *ptr; + const uint8_t *buf_end = buf + buf_size; uint8_t const *bufstart = buf; uint8_t *scanline; int ret = -1; @@ -116,7 +120,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, nplanes = buf[65]; bytes_per_scanline = nplanes * bytes_per_line; - if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8) { + if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8 || + (!compressed && bytes_per_scanline > buf_size / h)) { av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n"); return -1; } @@ -164,7 +169,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, if (nplanes == 3 && bits_per_pixel == 8) { for (y=0; y<h; y++) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x=0; x<w; x++) { ptr[3*x ] = scanline[x ]; @@ -179,7 +185,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, const uint8_t *palstart = bufstart + buf_size - 769; for (y=0; y<h; y++, ptr+=stride) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); memcpy(ptr, scanline, w); } @@ -198,7 +205,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, for (y=0; y<h; y++) { init_get_bits(&s, scanline, bytes_per_scanline<<3); - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x=0; x<w; x++) ptr[x] = get_bits(&s, bits_per_pixel); @@ -209,7 +217,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, int i; for (y=0; y<h; y++) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x=0; x<w; x++) { int m = 0x80 >> (x&7), v = 0; diff --git a/gst-libs/ext/libav/libavcodec/pictordec.c b/gst-libs/ext/libav/libavcodec/pictordec.c index 16f9307..53fef1c 100644 --- a/gst-libs/ext/libav/libavcodec/pictordec.c +++ b/gst-libs/ext/libav/libavcodec/pictordec.c @@ -122,7 +122,7 @@ static int decode_frame(AVCodecContext *avctx, s->nb_planes = (tmp >> 4) + 1; bpp = bits_per_plane * s->nb_planes; if (bits_per_plane > 8 || bpp < 1 || bpp > 32) { - av_log_ask_for_sample(s, "unsupported bit depth\n"); + av_log_ask_for_sample(avctx, "unsupported bit depth\n"); return AVERROR_PATCHWELCOME; } @@ -227,16 +227,17 @@ static int decode_frame(AVCodecContext *avctx, if (bits_per_plane == 8) { picmemset_8bpp(s, val, run, &x, &y); if (y < 0) - break; + goto finish; } else { picmemset(s, val, run, &x, &y, &plane, bits_per_plane); } } } } else { - av_log_ask_for_sample(s, "uncompressed image\n"); + av_log_ask_for_sample(avctx, "uncompressed image\n"); return avpkt->size; } +finish: *got_frame = 1; *(AVFrame*)data = s->frame; diff --git a/gst-libs/ext/libav/libavcodec/qdm2.c b/gst-libs/ext/libav/libavcodec/qdm2.c index 17729d1..99775d2 100644 --- a/gst-libs/ext/libav/libavcodec/qdm2.c +++ b/gst-libs/ext/libav/libavcodec/qdm2.c @@ -219,121 +219,154 @@ static const uint16_t qdm2_vlc_offs[] = { 0,260,566,598,894,1166,1230,1294,1678,1950,2214,2278,2310,2570,2834,3124,3448,3838, }; +static const int switchtable[23] = { + 0, 5, 1, 5, 5, 5, 5, 5, 2, 5, 5, 5, 5, 5, 5, 5, 3, 5, 5, 5, 5, 5, 4 +}; + static av_cold void qdm2_init_vlc(void) { - static int vlcs_initialized = 0; static VLC_TYPE qdm2_table[3838][2]; - if (!vlcs_initialized) { - - vlc_tab_level.table = &qdm2_table[qdm2_vlc_offs[0]]; - vlc_tab_level.table_allocated = qdm2_vlc_offs[1] - qdm2_vlc_offs[0]; - init_vlc (&vlc_tab_level, 8, 24, - vlc_tab_level_huffbits, 1, 1, - vlc_tab_level_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_diff.table = &qdm2_table[qdm2_vlc_offs[1]]; - vlc_tab_diff.table_allocated = qdm2_vlc_offs[2] - qdm2_vlc_offs[1]; - init_vlc (&vlc_tab_diff, 8, 37, - vlc_tab_diff_huffbits, 1, 1, - vlc_tab_diff_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_run.table = &qdm2_table[qdm2_vlc_offs[2]]; - vlc_tab_run.table_allocated = qdm2_vlc_offs[3] - qdm2_vlc_offs[2]; - init_vlc (&vlc_tab_run, 5, 6, - vlc_tab_run_huffbits, 1, 1, - vlc_tab_run_huffcodes, 1, 1, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - fft_level_exp_alt_vlc.table = &qdm2_table[qdm2_vlc_offs[3]]; - fft_level_exp_alt_vlc.table_allocated = qdm2_vlc_offs[4] - qdm2_vlc_offs[3]; - init_vlc (&fft_level_exp_alt_vlc, 8, 28, - fft_level_exp_alt_huffbits, 1, 1, - fft_level_exp_alt_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - - fft_level_exp_vlc.table = &qdm2_table[qdm2_vlc_offs[4]]; - fft_level_exp_vlc.table_allocated = qdm2_vlc_offs[5] - qdm2_vlc_offs[4]; - init_vlc (&fft_level_exp_vlc, 8, 20, - fft_level_exp_huffbits, 1, 1, - fft_level_exp_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - fft_stereo_exp_vlc.table = &qdm2_table[qdm2_vlc_offs[5]]; - fft_stereo_exp_vlc.table_allocated = qdm2_vlc_offs[6] - qdm2_vlc_offs[5]; - init_vlc (&fft_stereo_exp_vlc, 6, 7, - fft_stereo_exp_huffbits, 1, 1, - fft_stereo_exp_huffcodes, 1, 1, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - fft_stereo_phase_vlc.table = &qdm2_table[qdm2_vlc_offs[6]]; - fft_stereo_phase_vlc.table_allocated = qdm2_vlc_offs[7] - qdm2_vlc_offs[6]; - init_vlc (&fft_stereo_phase_vlc, 6, 9, - fft_stereo_phase_huffbits, 1, 1, - fft_stereo_phase_huffcodes, 1, 1, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_tone_level_idx_hi1.table = &qdm2_table[qdm2_vlc_offs[7]]; - vlc_tab_tone_level_idx_hi1.table_allocated = qdm2_vlc_offs[8] - qdm2_vlc_offs[7]; - init_vlc (&vlc_tab_tone_level_idx_hi1, 8, 20, - vlc_tab_tone_level_idx_hi1_huffbits, 1, 1, - vlc_tab_tone_level_idx_hi1_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_tone_level_idx_mid.table = &qdm2_table[qdm2_vlc_offs[8]]; - vlc_tab_tone_level_idx_mid.table_allocated = qdm2_vlc_offs[9] - qdm2_vlc_offs[8]; - init_vlc (&vlc_tab_tone_level_idx_mid, 8, 24, - vlc_tab_tone_level_idx_mid_huffbits, 1, 1, - vlc_tab_tone_level_idx_mid_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_tone_level_idx_hi2.table = &qdm2_table[qdm2_vlc_offs[9]]; - vlc_tab_tone_level_idx_hi2.table_allocated = qdm2_vlc_offs[10] - qdm2_vlc_offs[9]; - init_vlc (&vlc_tab_tone_level_idx_hi2, 8, 24, - vlc_tab_tone_level_idx_hi2_huffbits, 1, 1, - vlc_tab_tone_level_idx_hi2_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_type30.table = &qdm2_table[qdm2_vlc_offs[10]]; - vlc_tab_type30.table_allocated = qdm2_vlc_offs[11] - qdm2_vlc_offs[10]; - init_vlc (&vlc_tab_type30, 6, 9, - vlc_tab_type30_huffbits, 1, 1, - vlc_tab_type30_huffcodes, 1, 1, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_type34.table = &qdm2_table[qdm2_vlc_offs[11]]; - vlc_tab_type34.table_allocated = qdm2_vlc_offs[12] - qdm2_vlc_offs[11]; - init_vlc (&vlc_tab_type34, 5, 10, - vlc_tab_type34_huffbits, 1, 1, - vlc_tab_type34_huffcodes, 1, 1, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_fft_tone_offset[0].table = &qdm2_table[qdm2_vlc_offs[12]]; - vlc_tab_fft_tone_offset[0].table_allocated = qdm2_vlc_offs[13] - qdm2_vlc_offs[12]; - init_vlc (&vlc_tab_fft_tone_offset[0], 8, 23, - vlc_tab_fft_tone_offset_0_huffbits, 1, 1, - vlc_tab_fft_tone_offset_0_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_fft_tone_offset[1].table = &qdm2_table[qdm2_vlc_offs[13]]; - vlc_tab_fft_tone_offset[1].table_allocated = qdm2_vlc_offs[14] - qdm2_vlc_offs[13]; - init_vlc (&vlc_tab_fft_tone_offset[1], 8, 28, - vlc_tab_fft_tone_offset_1_huffbits, 1, 1, - vlc_tab_fft_tone_offset_1_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_fft_tone_offset[2].table = &qdm2_table[qdm2_vlc_offs[14]]; - vlc_tab_fft_tone_offset[2].table_allocated = qdm2_vlc_offs[15] - qdm2_vlc_offs[14]; - init_vlc (&vlc_tab_fft_tone_offset[2], 8, 32, - vlc_tab_fft_tone_offset_2_huffbits, 1, 1, - vlc_tab_fft_tone_offset_2_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_fft_tone_offset[3].table = &qdm2_table[qdm2_vlc_offs[15]]; - vlc_tab_fft_tone_offset[3].table_allocated = qdm2_vlc_offs[16] - qdm2_vlc_offs[15]; - init_vlc (&vlc_tab_fft_tone_offset[3], 8, 35, - vlc_tab_fft_tone_offset_3_huffbits, 1, 1, - vlc_tab_fft_tone_offset_3_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlc_tab_fft_tone_offset[4].table = &qdm2_table[qdm2_vlc_offs[16]]; - vlc_tab_fft_tone_offset[4].table_allocated = qdm2_vlc_offs[17] - qdm2_vlc_offs[16]; - init_vlc (&vlc_tab_fft_tone_offset[4], 8, 38, - vlc_tab_fft_tone_offset_4_huffbits, 1, 1, - vlc_tab_fft_tone_offset_4_huffcodes, 2, 2, INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); - - vlcs_initialized=1; - } + vlc_tab_level.table = &qdm2_table[qdm2_vlc_offs[0]]; + vlc_tab_level.table_allocated = qdm2_vlc_offs[1] - qdm2_vlc_offs[0]; + init_vlc(&vlc_tab_level, 8, 24, + vlc_tab_level_huffbits, 1, 1, + vlc_tab_level_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_diff.table = &qdm2_table[qdm2_vlc_offs[1]]; + vlc_tab_diff.table_allocated = qdm2_vlc_offs[2] - qdm2_vlc_offs[1]; + init_vlc(&vlc_tab_diff, 8, 37, + vlc_tab_diff_huffbits, 1, 1, + vlc_tab_diff_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_run.table = &qdm2_table[qdm2_vlc_offs[2]]; + vlc_tab_run.table_allocated = qdm2_vlc_offs[3] - qdm2_vlc_offs[2]; + init_vlc(&vlc_tab_run, 5, 6, + vlc_tab_run_huffbits, 1, 1, + vlc_tab_run_huffcodes, 1, 1, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + fft_level_exp_alt_vlc.table = &qdm2_table[qdm2_vlc_offs[3]]; + fft_level_exp_alt_vlc.table_allocated = qdm2_vlc_offs[4] - + qdm2_vlc_offs[3]; + init_vlc(&fft_level_exp_alt_vlc, 8, 28, + fft_level_exp_alt_huffbits, 1, 1, + fft_level_exp_alt_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + fft_level_exp_vlc.table = &qdm2_table[qdm2_vlc_offs[4]]; + fft_level_exp_vlc.table_allocated = qdm2_vlc_offs[5] - qdm2_vlc_offs[4]; + init_vlc(&fft_level_exp_vlc, 8, 20, + fft_level_exp_huffbits, 1, 1, + fft_level_exp_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + fft_stereo_exp_vlc.table = &qdm2_table[qdm2_vlc_offs[5]]; + fft_stereo_exp_vlc.table_allocated = qdm2_vlc_offs[6] - + qdm2_vlc_offs[5]; + init_vlc(&fft_stereo_exp_vlc, 6, 7, + fft_stereo_exp_huffbits, 1, 1, + fft_stereo_exp_huffcodes, 1, 1, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + fft_stereo_phase_vlc.table = &qdm2_table[qdm2_vlc_offs[6]]; + fft_stereo_phase_vlc.table_allocated = qdm2_vlc_offs[7] - + qdm2_vlc_offs[6]; + init_vlc(&fft_stereo_phase_vlc, 6, 9, + fft_stereo_phase_huffbits, 1, 1, + fft_stereo_phase_huffcodes, 1, 1, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_tone_level_idx_hi1.table = + &qdm2_table[qdm2_vlc_offs[7]]; + vlc_tab_tone_level_idx_hi1.table_allocated = qdm2_vlc_offs[8] - + qdm2_vlc_offs[7]; + init_vlc(&vlc_tab_tone_level_idx_hi1, 8, 20, + vlc_tab_tone_level_idx_hi1_huffbits, 1, 1, + vlc_tab_tone_level_idx_hi1_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_tone_level_idx_mid.table = + &qdm2_table[qdm2_vlc_offs[8]]; + vlc_tab_tone_level_idx_mid.table_allocated = qdm2_vlc_offs[9] - + qdm2_vlc_offs[8]; + init_vlc(&vlc_tab_tone_level_idx_mid, 8, 24, + vlc_tab_tone_level_idx_mid_huffbits, 1, 1, + vlc_tab_tone_level_idx_mid_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_tone_level_idx_hi2.table = + &qdm2_table[qdm2_vlc_offs[9]]; + vlc_tab_tone_level_idx_hi2.table_allocated = qdm2_vlc_offs[10] - + qdm2_vlc_offs[9]; + init_vlc(&vlc_tab_tone_level_idx_hi2, 8, 24, + vlc_tab_tone_level_idx_hi2_huffbits, 1, 1, + vlc_tab_tone_level_idx_hi2_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_type30.table = &qdm2_table[qdm2_vlc_offs[10]]; + vlc_tab_type30.table_allocated = qdm2_vlc_offs[11] - qdm2_vlc_offs[10]; + init_vlc(&vlc_tab_type30, 6, 9, + vlc_tab_type30_huffbits, 1, 1, + vlc_tab_type30_huffcodes, 1, 1, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_type34.table = &qdm2_table[qdm2_vlc_offs[11]]; + vlc_tab_type34.table_allocated = qdm2_vlc_offs[12] - qdm2_vlc_offs[11]; + init_vlc(&vlc_tab_type34, 5, 10, + vlc_tab_type34_huffbits, 1, 1, + vlc_tab_type34_huffcodes, 1, 1, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_fft_tone_offset[0].table = + &qdm2_table[qdm2_vlc_offs[12]]; + vlc_tab_fft_tone_offset[0].table_allocated = qdm2_vlc_offs[13] - + qdm2_vlc_offs[12]; + init_vlc(&vlc_tab_fft_tone_offset[0], 8, 23, + vlc_tab_fft_tone_offset_0_huffbits, 1, 1, + vlc_tab_fft_tone_offset_0_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_fft_tone_offset[1].table = + &qdm2_table[qdm2_vlc_offs[13]]; + vlc_tab_fft_tone_offset[1].table_allocated = qdm2_vlc_offs[14] - + qdm2_vlc_offs[13]; + init_vlc(&vlc_tab_fft_tone_offset[1], 8, 28, + vlc_tab_fft_tone_offset_1_huffbits, 1, 1, + vlc_tab_fft_tone_offset_1_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_fft_tone_offset[2].table = + &qdm2_table[qdm2_vlc_offs[14]]; + vlc_tab_fft_tone_offset[2].table_allocated = qdm2_vlc_offs[15] - + qdm2_vlc_offs[14]; + init_vlc(&vlc_tab_fft_tone_offset[2], 8, 32, + vlc_tab_fft_tone_offset_2_huffbits, 1, 1, + vlc_tab_fft_tone_offset_2_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_fft_tone_offset[3].table = + &qdm2_table[qdm2_vlc_offs[15]]; + vlc_tab_fft_tone_offset[3].table_allocated = qdm2_vlc_offs[16] - + qdm2_vlc_offs[15]; + init_vlc(&vlc_tab_fft_tone_offset[3], 8, 35, + vlc_tab_fft_tone_offset_3_huffbits, 1, 1, + vlc_tab_fft_tone_offset_3_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); + + vlc_tab_fft_tone_offset[4].table = + &qdm2_table[qdm2_vlc_offs[16]]; + vlc_tab_fft_tone_offset[4].table_allocated = qdm2_vlc_offs[17] - + qdm2_vlc_offs[16]; + init_vlc(&vlc_tab_fft_tone_offset[4], 8, 38, + vlc_tab_fft_tone_offset_4_huffbits, 1, 1, + vlc_tab_fft_tone_offset_4_huffcodes, 2, 2, + INIT_VLC_USE_NEW_STATIC | INIT_VLC_LE); } -static int qdm2_get_vlc (GetBitContext *gb, VLC *vlc, int flag, int depth) +static int qdm2_get_vlc(GetBitContext *gb, VLC *vlc, int flag, int depth) { int value; @@ -341,29 +374,27 @@ static int qdm2_get_vlc (GetBitContext *gb, VLC *vlc, int flag, int depth) /* stage-2, 3 bits exponent escape sequence */ if (value-- == 0) - value = get_bits (gb, get_bits (gb, 3) + 1); + value = get_bits(gb, get_bits(gb, 3) + 1); /* stage-3, optional */ if (flag) { int tmp = vlc_stage3_values[value]; if ((value & ~3) > 0) - tmp += get_bits (gb, (value >> 2)); + tmp += get_bits(gb, (value >> 2)); value = tmp; } return value; } - -static int qdm2_get_se_vlc (VLC *vlc, GetBitContext *gb, int depth) +static int qdm2_get_se_vlc(VLC *vlc, GetBitContext *gb, int depth) { - int value = qdm2_get_vlc (gb, vlc, 0, depth); + int value = qdm2_get_vlc(gb, vlc, 0, depth); return (value & 1) ? ((value + 1) >> 1) : -(value >> 1); } - /** * QDM2 checksum * @@ -373,49 +404,50 @@ static int qdm2_get_se_vlc (VLC *vlc, GetBitContext *gb, int depth) * * @return 0 if checksum is OK */ -static uint16_t qdm2_packet_checksum (const uint8_t *data, int length, int value) { +static uint16_t qdm2_packet_checksum(const uint8_t *data, int length, int value) +{ int i; - for (i=0; i < length; i++) + for (i = 0; i < length; i++) value -= data[i]; return (uint16_t)(value & 0xffff); } - /** * Fill a QDM2SubPacket structure with packet type, size, and data pointer. * * @param gb bitreader context * @param sub_packet packet under analysis */ -static void qdm2_decode_sub_packet_header (GetBitContext *gb, QDM2SubPacket *sub_packet) +static void qdm2_decode_sub_packet_header(GetBitContext *gb, + QDM2SubPacket *sub_packet) { - sub_packet->type = get_bits (gb, 8); + sub_packet->type = get_bits(gb, 8); if (sub_packet->type == 0) { sub_packet->size = 0; sub_packet->data = NULL; } else { - sub_packet->size = get_bits (gb, 8); + sub_packet->size = get_bits(gb, 8); - if (sub_packet->type & 0x80) { - sub_packet->size <<= 8; - sub_packet->size |= get_bits (gb, 8); - sub_packet->type &= 0x7f; - } + if (sub_packet->type & 0x80) { + sub_packet->size <<= 8; + sub_packet->size |= get_bits(gb, 8); + sub_packet->type &= 0x7f; + } - if (sub_packet->type == 0x7f) - sub_packet->type |= (get_bits (gb, 8) << 8); + if (sub_packet->type == 0x7f) + sub_packet->type |= (get_bits(gb, 8) << 8); - sub_packet->data = &gb->buffer[get_bits_count(gb) / 8]; // FIXME: this depends on bitreader internal data + // FIXME: this depends on bitreader-internal data + sub_packet->data = &gb->buffer[get_bits_count(gb) / 8]; } - av_log(NULL,AV_LOG_DEBUG,"Subpacket: type=%d size=%d start_offs=%x\n", - sub_packet->type, sub_packet->size, get_bits_count(gb) / 8); + av_log(NULL, AV_LOG_DEBUG, "Subpacket: type=%d size=%d start_offs=%x\n", + sub_packet->type, sub_packet->size, get_bits_count(gb) / 8); } - /** * Return node pointer to first packet of requested type in list. * @@ -423,7 +455,8 @@ static void qdm2_decode_sub_packet_header (GetBitContext *gb, QDM2SubPacket *sub * @param type type of searched subpacket * @return node pointer for subpacket if found, else NULL */ -static QDM2SubPNode* qdm2_search_subpacket_type_in_list (QDM2SubPNode *list, int type) +static QDM2SubPNode *qdm2_search_subpacket_type_in_list(QDM2SubPNode *list, + int type) { while (list != NULL && list->packet != NULL) { if (list->packet->type == type) @@ -433,14 +466,13 @@ static QDM2SubPNode* qdm2_search_subpacket_type_in_list (QDM2SubPNode *list, int return NULL; } - /** * Replace 8 elements with their average value. * Called by qdm2_decode_superblock before starting subblock decoding. * * @param q context */ -static void average_quantized_coeffs (QDM2Context *q) +static void average_quantized_coeffs(QDM2Context *q) { int i, j, n, ch, sum; @@ -457,12 +489,11 @@ static void average_quantized_coeffs (QDM2Context *q) if (sum > 0) sum--; - for (j=0; j < 8; j++) + for (j = 0; j < 8; j++) q->quantized_coeffs[ch][i][j] = sum; } } - /** * Build subband samples with noise weighted by q->tone_level. * Called by synthfilt_build_sb_samples. @@ -470,7 +501,7 @@ static void average_quantized_coeffs (QDM2Context *q) * @param q context * @param sb subband index */ -static void build_sb_samples_from_noise (QDM2Context *q, int sb) +static void build_sb_samples_from_noise(QDM2Context *q, int sb) { int ch, j; @@ -479,14 +510,16 @@ static void build_sb_samples_from_noise (QDM2Context *q, int sb) if (!q->nb_channels) return; - for (ch = 0; ch < q->nb_channels; ch++) + for (ch = 0; ch < q->nb_channels; ch++) { for (j = 0; j < 64; j++) { - q->sb_samples[ch][j * 2][sb] = SB_DITHERING_NOISE(sb,q->noise_idx) * q->tone_level[ch][sb][j]; - q->sb_samples[ch][j * 2 + 1][sb] = SB_DITHERING_NOISE(sb,q->noise_idx) * q->tone_level[ch][sb][j]; + q->sb_samples[ch][j * 2][sb] = + SB_DITHERING_NOISE(sb, q->noise_idx) * q->tone_level[ch][sb][j]; + q->sb_samples[ch][j * 2 + 1][sb] = + SB_DITHERING_NOISE(sb, q->noise_idx) * q->tone_level[ch][sb][j]; } + } } - /** * Called while processing data from subpackets 11 and 12. * Used after making changes to coding_method array. @@ -495,44 +528,65 @@ static void build_sb_samples_from_noise (QDM2Context *q, int sb) * @param channels number of channels * @param coding_method q->coding_method[0][0][0] */ -static void fix_coding_method_array (int sb, int channels, sb_int8_array coding_method) +static int fix_coding_method_array(int sb, int channels, + sb_int8_array coding_method) { - int j,k; + int j, k; int ch; int run, case_val; - static const int switchtable[23] = {0,5,1,5,5,5,5,5,2,5,5,5,5,5,5,5,3,5,5,5,5,5,4}; for (ch = 0; ch < channels; ch++) { for (j = 0; j < 64; ) { - if((coding_method[ch][sb][j] - 8) > 22) { - run = 1; + if (coding_method[ch][sb][j] < 8) + return -1; + if ((coding_method[ch][sb][j] - 8) > 22) { + run = 1; case_val = 8; } else { - switch (switchtable[coding_method[ch][sb][j]-8]) { - case 0: run = 10; case_val = 10; break; - case 1: run = 1; case_val = 16; break; - case 2: run = 5; case_val = 24; break; - case 3: run = 3; case_val = 30; break; - case 4: run = 1; case_val = 30; break; - case 5: run = 1; case_val = 8; break; - default: run = 1; case_val = 8; break; + switch (switchtable[coding_method[ch][sb][j] - 8]) { + case 0: run = 10; + case_val = 10; + break; + case 1: run = 1; + case_val = 16; + break; + case 2: run = 5; + case_val = 24; + break; + case 3: run = 3; + case_val = 30; + break; + case 4: run = 1; + case_val = 30; + break; + case 5: run = 1; + case_val = 8; + break; + default: run = 1; + case_val = 8; + break; } } - for (k = 0; k < run; k++) - if (j + k < 128) - if (coding_method[ch][sb + (j + k) / 64][(j + k) % 64] > coding_method[ch][sb][j]) + for (k = 0; k < run; k++) { + if (j + k < 128) { + if (coding_method[ch][sb + (j + k) / 64][(j + k) % 64] > coding_method[ch][sb][j]) { if (k > 0) { - SAMPLES_NEEDED + SAMPLES_NEEDED //not debugged, almost never used - memset(&coding_method[ch][sb][j + k], case_val, k * sizeof(int8_t)); - memset(&coding_method[ch][sb][j + k], case_val, 3 * sizeof(int8_t)); + memset(&coding_method[ch][sb][j + k], case_val, + k *sizeof(int8_t)); + memset(&coding_method[ch][sb][j + k], case_val, + 3 * sizeof(int8_t)); } + } + } + } j += run; } } + return 0; } - /** * Related to synthesis filter * Called by process_subpacket_10 @@ -540,7 +594,7 @@ static void fix_coding_method_array (int sb, int channels, sb_int8_array coding_ * @param q context * @param flag 1 if called after getting data from subpacket 10, 0 if no subpacket 10 */ -static void fill_tone_level_array (QDM2Context *q, int flag) +static void fill_tone_level_array(QDM2Context *q, int flag) { int i, sb, ch, sb_used; int tmp, tab; @@ -612,16 +666,14 @@ static void fill_tone_level_array (QDM2Context *q, int flag) } } } - - return; } - /** * Related to synthesis filter * Called by process_subpacket_11 * c is built with data from subpacket 11 - * Most of this function is used only if superblock_type_2_3 == 0, never seen it in samples + * Most of this function is used only if superblock_type_2_3 == 0, + * never seen it in samples. * * @param tone_level_idx * @param tone_level_idx_temp @@ -631,9 +683,12 @@ static void fill_tone_level_array (QDM2Context *q, int flag) * @param superblocktype_2_3 flag based on superblock packet type * @param cm_table_select q->cm_table_select */ -static void fill_coding_method_array (sb_int8_array tone_level_idx, sb_int8_array tone_level_idx_temp, - sb_int8_array coding_method, int nb_channels, - int c, int superblocktype_2_3, int cm_table_select) +static void fill_coding_method_array(sb_int8_array tone_level_idx, + sb_int8_array tone_level_idx_temp, + sb_int8_array coding_method, + int nb_channels, + int c, int superblocktype_2_3, + int cm_table_select) { int ch, sb, j; int tmp, acc, esp_40, comp; @@ -739,15 +794,14 @@ static void fill_coding_method_array (sb_int8_array tone_level_idx, sb_int8_arra for (j = 0; j < 64; j++) coding_method[ch][sb][j] = coding_method_table[cm_table_select][sb]; } - - return; } - /** * - * Called by process_subpacket_11 to process more data from subpacket 11 with sb 0-8 - * Called by process_subpacket_12 to process data from subpacket 12 with sb 8-sb_used + * Called by process_subpacket_11 to process more data from subpacket 11 + * with sb 0-8. + * Called by process_subpacket_12 to process data from subpacket 12 with + * sb 8-sb_used. * * @param q context * @param gb bitreader context @@ -755,10 +809,11 @@ static void fill_coding_method_array (sb_int8_array tone_level_idx, sb_int8_arra * @param sb_min lower subband processed (sb_min included) * @param sb_max higher subband processed (sb_max excluded) */ -static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int length, int sb_min, int sb_max) +static void synthfilt_build_sb_samples(QDM2Context *q, GetBitContext *gb, + int length, int sb_min, int sb_max) { int sb, j, k, n, ch, run, channels; - int joined_stereo, zero_encoding, chs; + int joined_stereo, zero_encoding; int type34_first; float type34_div = 0; float type34_predictor; @@ -773,8 +828,6 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l } for (sb = sb_min; sb < sb_max; sb++) { - FIX_NOISE_IDX(q->noise_idx); - channels = q->nb_channels; if (q->nb_channels <= 1 || sb < 12) @@ -793,11 +846,16 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l if (q->coding_method[1][sb][j] > q->coding_method[0][sb][j]) q->coding_method[0][sb][j] = q->coding_method[1][sb][j]; - fix_coding_method_array(sb, q->nb_channels, q->coding_method); + if (fix_coding_method_array(sb, q->nb_channels, + q->coding_method)) { + build_sb_samples_from_noise(q, sb); + continue; + } channels = 1; } for (ch = 0; ch < channels; ch++) { + FIX_NOISE_IDX(q->noise_idx); zero_encoding = (get_bits_left(gb) >= 1) ? get_bits1(gb) : 0; type34_predictor = 0.0; type34_first = 1; @@ -913,16 +971,18 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l } if (joined_stereo) { - float tmp[10][MPA_MAX_CHANNELS]; - - for (k = 0; k < run; k++) { - tmp[k][0] = samples[k]; - tmp[k][1] = (sign_bits[(j + k) / 8]) ? -samples[k] : samples[k]; + for (k = 0; k < run && j + k < 128; k++) { + q->sb_samples[0][j + k][sb] = + q->tone_level[0][sb][(j + k) / 2] * samples[k]; + if (q->nb_channels == 2) { + if (sign_bits[(j + k) / 8]) + q->sb_samples[1][j + k][sb] = + q->tone_level[1][sb][(j + k) / 2] * -samples[k]; + else + q->sb_samples[1][j + k][sb] = + q->tone_level[1][sb][(j + k) / 2] * samples[k]; + } } - for (chs = 0; chs < q->nb_channels; chs++) - for (k = 0; k < run; k++) - if ((j + k) < 128) - q->sb_samples[chs][j + k][sb] = q->tone_level[chs][sb][((j + k)/2)] * tmp[k][chs]; } else { for (k = 0; k < run; k++) if ((j + k) < 128) @@ -935,16 +995,18 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l } // subband loop } - /** - * Init the first element of a channel in quantized_coeffs with data from packet 10 (quantized_coeffs[ch][0]). - * This is similar to process_subpacket_9, but for a single channel and for element [0] + * Init the first element of a channel in quantized_coeffs with data + * from packet 10 (quantized_coeffs[ch][0]). + * This is similar to process_subpacket_9, but for a single channel + * and for element [0] * same VLC tables as process_subpacket_9 are used. * * @param quantized_coeffs pointer to quantized_coeffs[ch][0] * @param gb bitreader context */ -static void init_quantized_coeffs_elem0 (int8_t *quantized_coeffs, GetBitContext *gb) +static void init_quantized_coeffs_elem0(int8_t *quantized_coeffs, + GetBitContext *gb) { int i, k, run, level, diff; @@ -971,11 +1033,11 @@ static void init_quantized_coeffs_elem0 (int8_t *quantized_coeffs, GetBitContext } } - /** * Related to synthesis filter, process data from packet 10 * Init part of quantized_coeffs via function init_quantized_coeffs_elem0 - * Init tone_level_idx_hi1, tone_level_idx_hi2, tone_level_idx_mid with data from packet 10 + * Init tone_level_idx_hi1, tone_level_idx_hi2, tone_level_idx_mid with + * data from packet 10 * * @param q context * @param gb bitreader context @@ -1043,29 +1105,29 @@ static void init_tone_level_dequantization (QDM2Context *q, GetBitContext *gb) * @param q context * @param node pointer to node with packet */ -static void process_subpacket_9 (QDM2Context *q, QDM2SubPNode *node) +static void process_subpacket_9(QDM2Context *q, QDM2SubPNode *node) { GetBitContext gb; int i, j, k, n, ch, run, level, diff; - init_get_bits(&gb, node->packet->data, node->packet->size*8); + init_get_bits(&gb, node->packet->data, node->packet->size * 8); - n = coeff_per_sb_for_avg[q->coeff_per_sb_select][QDM2_SB_USED(q->sub_sampling) - 1] + 1; // same as averagesomething function + n = coeff_per_sb_for_avg[q->coeff_per_sb_select][QDM2_SB_USED(q->sub_sampling) - 1] + 1; for (i = 1; i < n; i++) - for (ch=0; ch < q->nb_channels; ch++) { + for (ch = 0; ch < q->nb_channels; ch++) { level = qdm2_get_vlc(&gb, &vlc_tab_level, 0, 2); q->quantized_coeffs[ch][i][0] = level; for (j = 0; j < (8 - 1); ) { - run = qdm2_get_vlc(&gb, &vlc_tab_run, 0, 1) + 1; + run = qdm2_get_vlc(&gb, &vlc_tab_run, 0, 1) + 1; diff = qdm2_get_se_vlc(&vlc_tab_diff, &gb, 2); for (k = 1; k <= run; k++) - q->quantized_coeffs[ch][i][j + k] = (level + ((k*diff) / run)); + q->quantized_coeffs[ch][i][j + k] = (level + ((k * diff) / run)); level += diff; - j += run; + j += run; } } @@ -1074,14 +1136,13 @@ static void process_subpacket_9 (QDM2Context *q, QDM2SubPNode *node) q->quantized_coeffs[ch][0][i] = 0; } - /** * Process subpacket 10 if not null, else * * @param q context * @param node pointer to node with packet */ -static void process_subpacket_10 (QDM2Context *q, QDM2SubPNode *node) +static void process_subpacket_10(QDM2Context *q, QDM2SubPNode *node) { GetBitContext gb; @@ -1094,14 +1155,13 @@ static void process_subpacket_10 (QDM2Context *q, QDM2SubPNode *node) } } - /** * Process subpacket 11 * * @param q context * @param node pointer to node with packet */ -static void process_subpacket_11 (QDM2Context *q, QDM2SubPNode *node) +static void process_subpacket_11(QDM2Context *q, QDM2SubPNode *node) { GetBitContext gb; int length = 0; @@ -1112,24 +1172,25 @@ static void process_subpacket_11 (QDM2Context *q, QDM2SubPNode *node) } if (length >= 32) { - int c = get_bits (&gb, 13); + int c = get_bits(&gb, 13); if (c > 3) - fill_coding_method_array (q->tone_level_idx, q->tone_level_idx_temp, q->coding_method, - q->nb_channels, 8*c, q->superblocktype_2_3, q->cm_table_select); + fill_coding_method_array(q->tone_level_idx, + q->tone_level_idx_temp, q->coding_method, + q->nb_channels, 8 * c, + q->superblocktype_2_3, q->cm_table_select); } synthfilt_build_sb_samples(q, &gb, length, 0, 8); } - /** * Process subpacket 12 * * @param q context * @param node pointer to node with packet */ -static void process_subpacket_12 (QDM2Context *q, QDM2SubPNode *node) +static void process_subpacket_12(QDM2Context *q, QDM2SubPNode *node) { GetBitContext gb; int length = 0; @@ -1148,7 +1209,7 @@ static void process_subpacket_12 (QDM2Context *q, QDM2SubPNode *node) * @param q context * @param list list with synthesis filter packets (list D) */ -static void process_synthesis_subpackets (QDM2Context *q, QDM2SubPNode *list) +static void process_synthesis_subpackets(QDM2Context *q, QDM2SubPNode *list) { QDM2SubPNode *nodes[4]; @@ -1175,13 +1236,12 @@ static void process_synthesis_subpackets (QDM2Context *q, QDM2SubPNode *list) process_subpacket_12(q, NULL); } - /* * Decode superblock, fill packet lists. * * @param q context */ -static void qdm2_decode_super_block (QDM2Context *q) +static void qdm2_decode_super_block(QDM2Context *q) { GetBitContext gb; QDM2SubPacket header, *packet; @@ -1193,33 +1253,33 @@ static void qdm2_decode_super_block (QDM2Context *q) memset(q->tone_level_idx_hi2, 0, sizeof(q->tone_level_idx_hi2)); q->sub_packets_B = 0; - sub_packets_D = 0; + sub_packets_D = 0; average_quantized_coeffs(q); // average elements in quantized_coeffs[max_ch][10][8] - init_get_bits(&gb, q->compressed_data, q->compressed_size*8); + init_get_bits(&gb, q->compressed_data, q->compressed_size * 8); qdm2_decode_sub_packet_header(&gb, &header); if (header.type < 2 || header.type >= 8) { q->has_errors = 1; - av_log(NULL,AV_LOG_ERROR,"bad superblock type\n"); + av_log(NULL, AV_LOG_ERROR, "bad superblock type\n"); return; } q->superblocktype_2_3 = (header.type == 2 || header.type == 3); - packet_bytes = (q->compressed_size - get_bits_count(&gb) / 8); + packet_bytes = (q->compressed_size - get_bits_count(&gb) / 8); - init_get_bits(&gb, header.data, header.size*8); + init_get_bits(&gb, header.data, header.size * 8); if (header.type == 2 || header.type == 4 || header.type == 5) { - int csum = 257 * get_bits(&gb, 8); - csum += 2 * get_bits(&gb, 8); + int csum = 257 * get_bits(&gb, 8); + csum += 2 * get_bits(&gb, 8); csum = qdm2_packet_checksum(q->compressed_data, q->checksum_size, csum); if (csum != 0) { q->has_errors = 1; - av_log(NULL,AV_LOG_ERROR,"bad packet checksum\n"); + av_log(NULL, AV_LOG_ERROR, "bad packet checksum\n"); return; } } @@ -1245,8 +1305,8 @@ static void qdm2_decode_super_block (QDM2Context *q) q->sub_packet_list_A[i - 1].next = &q->sub_packet_list_A[i]; /* seek to next block */ - init_get_bits(&gb, header.data, header.size*8); - skip_bits(&gb, next_index*8); + init_get_bits(&gb, header.data, header.size * 8); + skip_bits(&gb, next_index * 8); if (next_index >= header.size) break; @@ -1255,7 +1315,7 @@ static void qdm2_decode_super_block (QDM2Context *q) /* decode subpacket */ packet = &q->sub_packets[i]; qdm2_decode_sub_packet_header(&gb, packet); - next_index = packet->size + get_bits_count(&gb) / 8; + next_index = packet->size + get_bits_count(&gb) / 8; sub_packet_size = ((packet->size > 0xff) ? 1 : 0) + packet->size + 2; if (packet->type == 0) @@ -1288,13 +1348,13 @@ static void qdm2_decode_super_block (QDM2Context *q) } else if (packet->type == 15) { SAMPLES_NEEDED_2("packet type 15") return; - } else if (packet->type >= 16 && packet->type < 48 && !fft_subpackets[packet->type - 16]) { + } else if (packet->type >= 16 && packet->type < 48 && + !fft_subpackets[packet->type - 16]) { /* packets for FFT */ QDM2_LIST_ADD(q->sub_packet_list_B, q->sub_packets_B, packet); } } // Packet bytes loop -/* **************************************************************** */ if (q->sub_packet_list_D[0].packet != NULL) { process_synthesis_subpackets(q, q->sub_packet_list_D); q->do_synth_filter = 1; @@ -1303,49 +1363,48 @@ static void qdm2_decode_super_block (QDM2Context *q) process_subpacket_11(q, NULL); process_subpacket_12(q, NULL); } -/* **************************************************************** */ } - -static void qdm2_fft_init_coefficient (QDM2Context *q, int sub_packet, - int offset, int duration, int channel, - int exp, int phase) +static void qdm2_fft_init_coefficient(QDM2Context *q, int sub_packet, + int offset, int duration, int channel, + int exp, int phase) { if (q->fft_coefs_min_index[duration] < 0) q->fft_coefs_min_index[duration] = q->fft_coefs_index; - q->fft_coefs[q->fft_coefs_index].sub_packet = ((sub_packet >= 16) ? (sub_packet - 16) : sub_packet); + q->fft_coefs[q->fft_coefs_index].sub_packet = + ((sub_packet >= 16) ? (sub_packet - 16) : sub_packet); q->fft_coefs[q->fft_coefs_index].channel = channel; - q->fft_coefs[q->fft_coefs_index].offset = offset; - q->fft_coefs[q->fft_coefs_index].exp = exp; - q->fft_coefs[q->fft_coefs_index].phase = phase; + q->fft_coefs[q->fft_coefs_index].offset = offset; + q->fft_coefs[q->fft_coefs_index].exp = exp; + q->fft_coefs[q->fft_coefs_index].phase = phase; q->fft_coefs_index++; } - -static void qdm2_fft_decode_tones (QDM2Context *q, int duration, GetBitContext *gb, int b) +static void qdm2_fft_decode_tones(QDM2Context *q, int duration, + GetBitContext *gb, int b) { int channel, stereo, phase, exp; - int local_int_4, local_int_8, stereo_phase, local_int_10; + int local_int_4, local_int_8, stereo_phase, local_int_10; int local_int_14, stereo_exp, local_int_20, local_int_28; int n, offset; - local_int_4 = 0; + local_int_4 = 0; local_int_28 = 0; local_int_20 = 2; - local_int_8 = (4 - duration); + local_int_8 = (4 - duration); local_int_10 = 1 << (q->group_order - duration - 1); - offset = 1; + offset = 1; while (1) { if (q->superblocktype_2_3) { while ((n = qdm2_get_vlc(gb, &vlc_tab_fft_tone_offset[local_int_8], 1, 2)) < 2) { offset = 1; if (n == 0) { - local_int_4 += local_int_10; + local_int_4 += local_int_10; local_int_28 += (1 << local_int_8); } else { - local_int_4 += 8*local_int_10; + local_int_4 += 8 * local_int_10; local_int_28 += (8 << local_int_8); } } @@ -1353,7 +1412,7 @@ static void qdm2_fft_decode_tones (QDM2Context *q, int duration, GetBitContext * } else { offset += qdm2_get_vlc(gb, &vlc_tab_fft_tone_offset[local_int_8], 1, 2); while (offset >= (local_int_10 - 1)) { - offset += (1 - (local_int_10 - 1)); + offset += (1 - (local_int_10 - 1)); local_int_4 += local_int_10; local_int_28 += (1 << local_int_8); } @@ -1368,22 +1427,22 @@ static void qdm2_fft_decode_tones (QDM2Context *q, int duration, GetBitContext * if (q->nb_channels > 1) { channel = get_bits1(gb); - stereo = get_bits1(gb); + stereo = get_bits1(gb); } else { channel = 0; - stereo = 0; + stereo = 0; } - exp = qdm2_get_vlc(gb, (b ? &fft_level_exp_vlc : &fft_level_exp_alt_vlc), 0, 2); + exp = qdm2_get_vlc(gb, (b ? &fft_level_exp_vlc : &fft_level_exp_alt_vlc), 0, 2); exp += q->fft_level_exp[fft_level_index_table[local_int_14]]; - exp = (exp < 0) ? 0 : exp; + exp = (exp < 0) ? 0 : exp; - phase = get_bits(gb, 3); - stereo_exp = 0; + phase = get_bits(gb, 3); + stereo_exp = 0; stereo_phase = 0; if (stereo) { - stereo_exp = (exp - qdm2_get_vlc(gb, &fft_stereo_exp_vlc, 0, 1)); + stereo_exp = (exp - qdm2_get_vlc(gb, &fft_stereo_exp_vlc, 0, 1)); stereo_phase = (phase - qdm2_get_vlc(gb, &fft_stereo_phase_vlc, 0, 1)); if (stereo_phase < 0) stereo_phase += 8; @@ -1392,17 +1451,18 @@ static void qdm2_fft_decode_tones (QDM2Context *q, int duration, GetBitContext * if (q->frequency_range > (local_int_14 + 1)) { int sub_packet = (local_int_20 + local_int_28); - qdm2_fft_init_coefficient(q, sub_packet, offset, duration, channel, exp, phase); + qdm2_fft_init_coefficient(q, sub_packet, offset, duration, + channel, exp, phase); if (stereo) - qdm2_fft_init_coefficient(q, sub_packet, offset, duration, (1 - channel), stereo_exp, stereo_phase); + qdm2_fft_init_coefficient(q, sub_packet, offset, duration, + 1 - channel, + stereo_exp, stereo_phase); } - offset++; } } - -static void qdm2_decode_fft_packets (QDM2Context *q) +static void qdm2_decode_fft_packets(QDM2Context *q) { int i, j, min, max, value, type, unknown_flag; GetBitContext gb; @@ -1412,18 +1472,18 @@ static void qdm2_decode_fft_packets (QDM2Context *q) /* reset minimum indexes for FFT coefficients */ q->fft_coefs_index = 0; - for (i=0; i < 5; i++) + for (i = 0; i < 5; i++) q->fft_coefs_min_index[i] = -1; /* process subpackets ordered by type, largest type first */ for (i = 0, max = 256; i < q->sub_packets_B; i++) { - QDM2SubPacket *packet= NULL; + QDM2SubPacket *packet = NULL; /* find subpacket with largest type less than max */ for (j = 0, min = 0; j < q->sub_packets_B; j++) { value = q->sub_packet_list_B[j].packet->type; if (value > min && value < max) { - min = value; + min = value; packet = q->sub_packet_list_B[j].packet; } } @@ -1434,11 +1494,13 @@ static void qdm2_decode_fft_packets (QDM2Context *q) if (!packet) return; - if (i == 0 && (packet->type < 16 || packet->type >= 48 || fft_subpackets[packet->type - 16])) + if (i == 0 && + (packet->type < 16 || packet->type >= 48 || + fft_subpackets[packet->type - 16])) return; /* decode FFT tones */ - init_get_bits (&gb, packet->data, packet->size*8); + init_get_bits(&gb, packet->data, packet->size * 8); if (packet->type >= 32 && packet->type < 48 && !fft_subpackets[packet->type - 16]) unknown_flag = 1; @@ -1453,13 +1515,13 @@ static void qdm2_decode_fft_packets (QDM2Context *q) if (duration >= 0 && duration < 4) qdm2_fft_decode_tones(q, duration, &gb, unknown_flag); } else if (type == 31) { - for (j=0; j < 4; j++) + for (j = 0; j < 4; j++) qdm2_fft_decode_tones(q, j, &gb, unknown_flag); } else if (type == 46) { - for (j=0; j < 6; j++) + for (j = 0; j < 6; j++) q->fft_level_exp[j] = get_bits(&gb, 6); - for (j=0; j < 4; j++) - qdm2_fft_decode_tones(q, j, &gb, unknown_flag); + for (j = 0; j < 4; j++) + qdm2_fft_decode_tones(q, j, &gb, unknown_flag); } } // Loop on B packets @@ -1474,20 +1536,19 @@ static void qdm2_decode_fft_packets (QDM2Context *q) q->fft_coefs_max_index[j] = q->fft_coefs_index; } - -static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone) +static void qdm2_fft_generate_tone(QDM2Context *q, FFTTone *tone) { - float level, f[6]; - int i; - QDM2Complex c; - const double iscale = 2.0*M_PI / 512.0; + float level, f[6]; + int i; + QDM2Complex c; + const double iscale = 2.0 * M_PI / 512.0; tone->phase += tone->phase_shift; /* calculate current level (maximum amplitude) of tone */ level = fft_tone_envelope_table[tone->duration][tone->time_index] * tone->level; - c.im = level * sin(tone->phase*iscale); - c.re = level * cos(tone->phase*iscale); + c.im = level * sin(tone->phase * iscale); + c.re = level * cos(tone->phase * iscale); /* generate FFT coefficients for tone */ if (tone->duration >= 3 || tone->cutoff >= 3) { @@ -1497,30 +1558,31 @@ static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone) tone->complex[1].re -= c.re; } else { f[1] = -tone->table[4]; - f[0] = tone->table[3] - tone->table[0]; - f[2] = 1.0 - tone->table[2] - tone->table[3]; - f[3] = tone->table[1] + tone->table[4] - 1.0; - f[4] = tone->table[0] - tone->table[1]; - f[5] = tone->table[2]; + f[0] = tone->table[3] - tone->table[0]; + f[2] = 1.0 - tone->table[2] - tone->table[3]; + f[3] = tone->table[1] + tone->table[4] - 1.0; + f[4] = tone->table[0] - tone->table[1]; + f[5] = tone->table[2]; for (i = 0; i < 2; i++) { - tone->complex[fft_cutoff_index_table[tone->cutoff][i]].re += c.re * f[i]; - tone->complex[fft_cutoff_index_table[tone->cutoff][i]].im += c.im *((tone->cutoff <= i) ? -f[i] : f[i]); + tone->complex[fft_cutoff_index_table[tone->cutoff][i]].re += + c.re * f[i]; + tone->complex[fft_cutoff_index_table[tone->cutoff][i]].im += + c.im * ((tone->cutoff <= i) ? -f[i] : f[i]); } for (i = 0; i < 4; i++) { - tone->complex[i].re += c.re * f[i+2]; - tone->complex[i].im += c.im * f[i+2]; + tone->complex[i].re += c.re * f[i + 2]; + tone->complex[i].im += c.im * f[i + 2]; } } /* copy the tone if it has not yet died out */ if (++tone->time_index < ((1 << (5 - tone->duration)) - 1)) { - memcpy(&q->fft_tones[q->fft_tone_end], tone, sizeof(FFTTone)); - q->fft_tone_end = (q->fft_tone_end + 1) % 1000; + memcpy(&q->fft_tones[q->fft_tone_end], tone, sizeof(FFTTone)); + q->fft_tone_end = (q->fft_tone_end + 1) % 1000; } } - -static void qdm2_fft_tone_synthesizer (QDM2Context *q, int sub_packet) +static void qdm2_fft_tone_synthesizer(QDM2Context *q, int sub_packet) { int i, j, ch; const double iscale = 0.25 * M_PI; @@ -1591,29 +1653,27 @@ static void qdm2_fft_tone_synthesizer (QDM2Context *q, int sub_packet) } } - -static void qdm2_calculate_fft (QDM2Context *q, int channel, int sub_packet) +static void qdm2_calculate_fft(QDM2Context *q, int channel, int sub_packet) { const float gain = (q->channels == 1 && q->nb_channels == 2) ? 0.5f : 1.0f; - float *out = q->output_buffer + channel; + float *out = q->output_buffer + channel; int i; q->fft.complex[channel][0].re *= 2.0f; - q->fft.complex[channel][0].im = 0.0f; + q->fft.complex[channel][0].im = 0.0f; q->rdft_ctx.rdft_calc(&q->rdft_ctx, (FFTSample *)q->fft.complex[channel]); /* add samples to output buffer */ for (i = 0; i < FFALIGN(q->fft_size, 8); i++) { out[0] += q->fft.complex[channel][i].re * gain; out[q->channels] += q->fft.complex[channel][i].im * gain; - out += 2 * q->channels; + out += 2 * q->channels; } } - /** * @param q context * @param index subpacket number */ -static void qdm2_synthesis_filter (QDM2Context *q, int index) +static void qdm2_synthesis_filter(QDM2Context *q, int index) { int i, k, ch, sb_used, sub_sampling, dither_state = 0; @@ -1622,7 +1682,7 @@ static void qdm2_synthesis_filter (QDM2Context *q, int index) for (ch = 0; ch < q->channels; ch++) for (i = 0; i < 8; i++) - for (k=sb_used; k < SBLIMIT; k++) + for (k = sb_used; k < SBLIMIT; k++) q->sb_samples[ch][(8 * index) + i][k] = 0; for (ch = 0; ch < q->nb_channels; ch++) { @@ -1630,10 +1690,10 @@ static void qdm2_synthesis_filter (QDM2Context *q, int index) for (i = 0; i < 8; i++) { ff_mpa_synth_filter_float(&q->mpadsp, - q->synth_buf[ch], &(q->synth_buf_offset[ch]), - ff_mpa_synth_window_float, &dither_state, - samples_ptr, q->nb_channels, - q->sb_samples[ch][(8 * index) + i]); + q->synth_buf[ch], &(q->synth_buf_offset[ch]), + ff_mpa_synth_window_float, &dither_state, + samples_ptr, q->nb_channels, + q->sb_samples[ch][(8 * index) + i]); samples_ptr += 32 * q->nb_channels; } } @@ -1646,29 +1706,19 @@ static void qdm2_synthesis_filter (QDM2Context *q, int index) q->output_buffer[q->channels * i + ch] += (1 << 23) * q->samples[q->nb_channels * sub_sampling * i + ch]; } - /** * Init static data (does not depend on specific file) * * @param q context */ -static av_cold void qdm2_init(QDM2Context *q) { - static int initialized = 0; - - if (initialized != 0) - return; - initialized = 1; - +static av_cold void qdm2_init_static_data(AVCodec *codec) { qdm2_init_vlc(); ff_mpa_synth_init_float(ff_mpa_synth_window_float); softclip_table_init(); rnd_table_init(); init_noise_samples(); - - av_log(NULL, AV_LOG_DEBUG, "init done\n"); } - /** * Init parameters from codec extradata */ @@ -1718,7 +1768,7 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx) return -1; } - extradata = avctx->extradata; + extradata = avctx->extradata; extradata_size = avctx->extradata_size; while (extradata_size > 7) { @@ -1846,8 +1896,6 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx) ff_rdft_init(&s->rdft_ctx, s->fft_order, IDFT_C2R); ff_mpadsp_init(&s->mpadsp); - qdm2_init(s); - avctx->sample_fmt = AV_SAMPLE_FMT_S16; avcodec_get_frame_defaults(&s->frame); @@ -1856,7 +1904,6 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx) return 0; } - static av_cold int qdm2_decode_close(AVCodecContext *avctx) { QDM2Context *s = avctx->priv_data; @@ -1866,8 +1913,7 @@ static av_cold int qdm2_decode_close(AVCodecContext *avctx) return 0; } - -static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out) +static int qdm2_decode(QDM2Context *q, const uint8_t *in, int16_t *out) { int ch, i; const int frame_size = (q->frame_size * q->channels); @@ -1926,7 +1972,6 @@ static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out) return 0; } - static int qdm2_decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr, AVPacket *avpkt) { @@ -1961,15 +2006,15 @@ static int qdm2_decode_frame(AVCodecContext *avctx, void *data, return s->checksum_size; } -AVCodec ff_qdm2_decoder = -{ - .name = "qdm2", - .type = AVMEDIA_TYPE_AUDIO, - .id = AV_CODEC_ID_QDM2, - .priv_data_size = sizeof(QDM2Context), - .init = qdm2_decode_init, - .close = qdm2_decode_close, - .decode = qdm2_decode_frame, - .capabilities = CODEC_CAP_DR1, - .long_name = NULL_IF_CONFIG_SMALL("QDesign Music Codec 2"), +AVCodec ff_qdm2_decoder = { + .name = "qdm2", + .type = AVMEDIA_TYPE_AUDIO, + .id = AV_CODEC_ID_QDM2, + .priv_data_size = sizeof(QDM2Context), + .init = qdm2_decode_init, + .init_static_data = qdm2_init_static_data, + .close = qdm2_decode_close, + .decode = qdm2_decode_frame, + .capabilities = CODEC_CAP_DR1, + .long_name = NULL_IF_CONFIG_SMALL("QDesign Music Codec 2"), }; diff --git a/gst-libs/ext/libav/libavcodec/rtjpeg.c b/gst-libs/ext/libav/libavcodec/rtjpeg.c index 3604585..77baa5b 100644 --- a/gst-libs/ext/libav/libavcodec/rtjpeg.c +++ b/gst-libs/ext/libav/libavcodec/rtjpeg.c @@ -108,10 +108,13 @@ int ff_rtjpeg_decode_frame_yuv420(RTJpegContext *c, AVFrame *f, const uint8_t *buf, int buf_size) { GetBitContext gb; int w = c->w / 16, h = c->h / 16; - int x, y; + int x, y, ret; uint8_t *y1 = f->data[0], *y2 = f->data[0] + 8 * f->linesize[0]; uint8_t *u = f->data[1], *v = f->data[2]; - init_get_bits(&gb, buf, buf_size * 8); + + if ((ret = init_get_bits8(&gb, buf, buf_size)) < 0) + return ret; + for (y = 0; y < h; y++) { for (x = 0; x < w; x++) { #define BLOCK(quant, dst, stride) do { \ diff --git a/gst-libs/ext/libav/libavcodec/vc1dec.c b/gst-libs/ext/libav/libavcodec/vc1dec.c index c29f91c..bafd6a2 100644 --- a/gst-libs/ext/libav/libavcodec/vc1dec.c +++ b/gst-libs/ext/libav/libavcodec/vc1dec.c @@ -394,6 +394,11 @@ static void vc1_mc_1mv(VC1Context *v, int dir) } } + if (!srcY || !srcU) { + av_log(v->s.avctx, AV_LOG_ERROR, "Referenced frame missing.\n"); + return; + } + src_x = s->mb_x * 16 + (mx >> 2); src_y = s->mb_y * 16 + (my >> 2); uvsrc_x = s->mb_x * 8 + (uvmx >> 2); @@ -569,6 +574,11 @@ static void vc1_mc_4mv_luma(VC1Context *v, int n, int dir) } else srcY = s->next_picture.f.data[0]; + if (!srcY) { + av_log(v->s.avctx, AV_LOG_ERROR, "Referenced frame missing.\n"); + return; + } + if (v->field_mode) { if (v->cur_field_type != v->ref_field_type[dir]) my = my - 2 + 4 * v->cur_field_type; @@ -856,6 +866,11 @@ static void vc1_mc_4mv_chroma(VC1Context *v, int dir) srcV = s->next_picture.f.data[2] + uvsrc_y * s->uvlinesize + uvsrc_x; } + if (!srcU) { + av_log(v->s.avctx, AV_LOG_ERROR, "Referenced frame missing.\n"); + return; + } + if (v->field_mode) { if (chroma_ref_type) { srcU += s->current_picture_ptr->f.linesize[1]; @@ -5579,6 +5594,12 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, v->mv_f[1] = tmp[1]; } mb_height = s->mb_height >> v->field_mode; + + if (!mb_height) { + av_log(v->s.avctx, AV_LOG_ERROR, "Invalid mb_height.\n"); + goto err; + } + for (i = 0; i <= n_slices; i++) { if (i > 0 && slices[i - 1].mby_start >= mb_height) { if (v->field_mode <= 0) { diff --git a/gst-libs/ext/libav/libavcodec/vcr1.c b/gst-libs/ext/libav/libavcodec/vcr1.c index d0805a3..42ba787 100644 --- a/gst-libs/ext/libav/libavcodec/vcr1.c +++ b/gst-libs/ext/libav/libavcodec/vcr1.c @@ -50,6 +50,11 @@ static av_cold int vcr1_decode_init(AVCodecContext *avctx) avctx->pix_fmt = AV_PIX_FMT_YUV410P; + if (avctx->width & 7) { + av_log(avctx, AV_LOG_ERROR, "Width %d is not divisble by 8.\n", avctx->width); + return AVERROR_INVALIDDATA; + } + return 0; } @@ -85,9 +90,13 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, p->pict_type = AV_PICTURE_TYPE_I; p->key_frame = 1; + if (buf_size < 32) + goto packet_small; + for (i = 0; i < 16; i++) { a->delta[i] = *bytestream++; bytestream++; + buf_size--; } for (y = 0; y < avctx->height; y++) { @@ -98,8 +107,12 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, uint8_t *cb = &a->picture.data[1][(y >> 2) * a->picture.linesize[1]]; uint8_t *cr = &a->picture.data[2][(y >> 2) * a->picture.linesize[2]]; + if (buf_size < 4 + avctx->width) + goto packet_small; + for (i = 0; i < 4; i++) a->offset[i] = *bytestream++; + buf_size -= 4; offset = a->offset[0] - a->delta[bytestream[2] & 0xF]; for (x = 0; x < avctx->width; x += 4) { @@ -113,8 +126,12 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, *cr++ = bytestream[1]; bytestream += 4; + buf_size -= 4; } } else { + if (buf_size < avctx->width / 2) + goto packet_small; + offset = a->offset[y & 3] - a->delta[bytestream[2] & 0xF]; for (x = 0; x < avctx->width; x += 8) { @@ -128,6 +145,7 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, luma[7] = offset += a->delta[bytestream[1] >> 4]; luma += 8; bytestream += 4; + buf_size -= 4; } } } @@ -136,6 +154,9 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data, *got_frame = 1; return buf_size; +packet_small: + av_log(avctx, AV_LOG_ERROR, "Input packet too small.\n"); + return AVERROR_INVALIDDATA; } AVCodec ff_vcr1_decoder = { diff --git a/gst-libs/ext/libav/libavcodec/vqavideo.c b/gst-libs/ext/libav/libavcodec/vqavideo.c index 841210c..b4656b8 100644 --- a/gst-libs/ext/libav/libavcodec/vqavideo.c +++ b/gst-libs/ext/libav/libavcodec/vqavideo.c @@ -135,6 +135,17 @@ static av_cold int vqa_decode_init(AVCodecContext *avctx) /* load up the VQA parameters from the header */ s->vqa_version = s->avctx->extradata[0]; + switch (s->vqa_version) { + case 1: + case 2: + break; + case 3: + av_log_missing_feature(avctx, "VQA Version 3", 0); + return AVERROR_PATCHWELCOME; + default: + av_log_missing_feature(avctx, "VQA Version", 1); + return AVERROR_PATCHWELCOME; + } s->width = AV_RL16(&s->avctx->extradata[6]); s->height = AV_RL16(&s->avctx->extradata[8]); if(av_image_check_size(s->width, s->height, 0, avctx)){ diff --git a/gst-libs/ext/libav/libavcodec/wmavoice.c b/gst-libs/ext/libav/libavcodec/wmavoice.c index 08d0600..e0b7f5b 100644 --- a/gst-libs/ext/libav/libavcodec/wmavoice.c +++ b/gst-libs/ext/libav/libavcodec/wmavoice.c @@ -1050,9 +1050,10 @@ static void aw_parse_coords(WMAVoiceContext *s, GetBitContext *gb, * @param gb bit I/O context * @param block_idx block index in frame [0, 1] * @param fcb structure containing fixed codebook vector info + * @return -1 on error, 0 otherwise */ -static void aw_pulse_set2(WMAVoiceContext *s, GetBitContext *gb, - int block_idx, AMRFixed *fcb) +static int aw_pulse_set2(WMAVoiceContext *s, GetBitContext *gb, + int block_idx, AMRFixed *fcb) { uint16_t use_mask_mem[9]; // only 5 are used, rest is padding uint16_t *use_mask = use_mask_mem + 2; @@ -1114,7 +1115,7 @@ static void aw_pulse_set2(WMAVoiceContext *s, GetBitContext *gb, else if (use_mask[2]) idx = 0x2F; else if (use_mask[3]) idx = 0x3F; else if (use_mask[4]) idx = 0x4F; - else return; + else return -1; idx -= av_log2_16bit(use_mask[idx >> 4]); } if (use_mask[idx >> 4] & (0x8000 >> (idx & 15))) { @@ -1131,6 +1132,7 @@ static void aw_pulse_set2(WMAVoiceContext *s, GetBitContext *gb, /* set offset for next block, relative to start of that block */ n = (MAX_FRAMESIZE / 2 - start_off) % fcb->pitch_lag; s->aw_next_pulse_off_cache = n ? fcb->pitch_lag - n : 0; + return 0; } /** @@ -1293,7 +1295,18 @@ static void synth_block_fcb_acb(WMAVoiceContext *s, GetBitContext *gb, * (fixed) codebook pulses of the speech signal. */ if (frame_desc->fcb_type == FCB_TYPE_AW_PULSES) { aw_pulse_set1(s, gb, block_idx, &fcb); - aw_pulse_set2(s, gb, block_idx, &fcb); + if (aw_pulse_set2(s, gb, block_idx, &fcb)) { + /* Conceal the block with silence and return. + * Skip the correct amount of bits to read the next + * block from the correct offset. */ + int r_idx = pRNG(s->frame_cntr, block_idx, size); + + for (n = 0; n < size; n++) + excitation[n] = + wmavoice_std_codebook[r_idx + n] * s->silence_gain; + skip_bits(gb, 7 + 1); + return; + } } else /* FCB_TYPE_EXC_PULSES */ { int offset_nbits = 5 - frame_desc->log_n_blocks; diff --git a/gst-libs/ext/libav/libavcodec/xl.c b/gst-libs/ext/libav/libavcodec/xl.c index 1cadeab..240339e 100644 --- a/gst-libs/ext/libav/libavcodec/xl.c +++ b/gst-libs/ext/libav/libavcodec/xl.c @@ -71,6 +71,11 @@ static int decode_frame(AVCodecContext *avctx, stride = avctx->width - 4; + if (avctx->width % 4) { + av_log(avctx, AV_LOG_ERROR, "Width not a multiple of 4.\n"); + return AVERROR_INVALIDDATA; + } + if (buf_size < avctx->width * avctx->height) { av_log(avctx, AV_LOG_ERROR, "Packet is too small\n"); return AVERROR_INVALIDDATA; |