@@ -24,6 +24,7 @@
#include "libavutil/avassert.h"
#include "libavutil/bprint.h"
#include "libavutil/imgutils.h"
+#include "libavutil/intreadwrite.h"
#include "libavutil/stereo3d.h"
#include "libavutil/mastering_display_metadata.h"
@@ -1367,15 +1368,35 @@ exit_loop:
for (y = 0; y < s->height; ++y) {
uint8_t *row = &s->image_buf[s->image_linesize * y];
- /* since we're updating in-place, we have to go from right to left */
- for (x = s->width; x > 0; --x) {
- uint8_t *pixel = &row[s->bpp * (x - 1)];
- memmove(pixel, &row[raw_bpp * (x - 1)], raw_bpp);
+ if (s->bpp == 2 && byte_depth == 1) {
+ uint8_t *pixel = &row[2 * s->width - 1];
+ uint8_t *rowp = &row[1 * s->width - 1];
+ int tcolor = s->transparent_color_be[0];
+ for (x = s->width; x > 0; --x) {
+ *pixel-- = *rowp == tcolor ? 0 : 0xff;
+ *pixel-- = *rowp--;
+ }
+ } else if (s->bpp == 4 && byte_depth == 1) {
+ uint8_t *pixel = &row[4 * s->width - 1];
+ uint8_t *rowp = &row[3 * s->width - 1];
+ int tcolor = AV_RL24(s->transparent_color_be);
+ for (x = s->width; x > 0; --x) {
+ *pixel-- = AV_RL24(rowp-2) == tcolor ? 0 : 0xff;
+ *pixel-- = *rowp--;
+ *pixel-- = *rowp--;
+ *pixel-- = *rowp--;
+ }
+ } else {
+ /* since we're updating in-place, we have to go from right to left */
+ for (x = s->width; x > 0; --x) {
+ uint8_t *pixel = &row[s->bpp * (x - 1)];
+ memmove(pixel, &row[raw_bpp * (x - 1)], raw_bpp);
- if (!memcmp(pixel, s->transparent_color_be, raw_bpp)) {
- memset(&pixel[raw_bpp], 0, byte_depth);
- } else {
- memset(&pixel[raw_bpp], 0xff, byte_depth);
+ if (!memcmp(pixel, s->transparent_color_be, raw_bpp)) {
+ memset(&pixel[raw_bpp], 0, byte_depth);
+ } else {
+ memset(&pixel[raw_bpp], 0xff, byte_depth);
+ }
}
}
}
add inner loop specialisations for 2 bpp and 4 bpp These are all cases for which i found testsamples. 30M cycles -> 5M cycles Testcase: fate-rgbapng-4816 Testcase: 16097/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5664690889293824 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/pngdec.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-)