@@ -148,9 +148,11 @@ static int zmbv_decode_xor_8(ZmbvContext *c)
output += c->width * c->bh;
prev += c->width * c->bh;
}
- if (src - c->decomp_buf != c->decomp_len)
+ if (src - c->decomp_buf != c->decomp_len) {
av_log(c->avctx, AV_LOG_ERROR, "Used %"PTRDIFF_SPECIFIER" of %i bytes\n",
src-c->decomp_buf, c->decomp_len);
+ return AVERROR_INVALIDDATA;
+ }
return 0;
}
@@ -224,9 +226,11 @@ static int zmbv_decode_xor_16(ZmbvContext *c)
output += c->width * c->bh;
prev += c->width * c->bh;
}
- if (src - c->decomp_buf != c->decomp_len)
+ if (src - c->decomp_buf != c->decomp_len) {
av_log(c->avctx, AV_LOG_ERROR, "Used %"PTRDIFF_SPECIFIER" of %i bytes\n",
src-c->decomp_buf, c->decomp_len);
+ return AVERROR_INVALIDDATA;
+ }
return 0;
}
@@ -309,9 +313,11 @@ static int zmbv_decode_xor_24(ZmbvContext *c)
output += stride * c->bh;
prev += stride * c->bh;
}
- if (src - c->decomp_buf != c->decomp_len)
+ if (src - c->decomp_buf != c->decomp_len) {
av_log(c->avctx, AV_LOG_ERROR, "Used %"PTRDIFF_SPECIFIER" of %i bytes\n",
src-c->decomp_buf, c->decomp_len);
+ return AVERROR_INVALIDDATA;
+ }
return 0;
}
#endif //ZMBV_ENABLE_24BPP
@@ -386,9 +392,11 @@ static int zmbv_decode_xor_32(ZmbvContext *c)
output += c->width * c->bh;
prev += c->width * c->bh;
}
- if (src - c->decomp_buf != c->decomp_len)
+ if (src - c->decomp_buf != c->decomp_len) {
av_log(c->avctx, AV_LOG_ERROR, "Used %"PTRDIFF_SPECIFIER" of %i bytes\n",
src-c->decomp_buf, c->decomp_len);
+ return AVERROR_INVALIDDATA;
+ }
return 0;
}
@@ -567,8 +575,14 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
frame->pict_type = AV_PICTURE_TYPE_P;
if (c->decomp_len < 2LL * ((c->width + c->bw - 1) / c->bw) * ((c->height + c->bh - 1) / c->bh))
return AVERROR_INVALIDDATA;
- if (c->decomp_len)
- c->decode_xor(c);
+ if (c->decomp_len) {
+ if (c->decode_xor(c) < 0) {
+ if (avctx->flags & AV_CODEC_FLAG_OUTPUT_CORRUPT)
+ frame->flags |= AV_FRAME_FLAG_CORRUPT;
+ else
+ return buf_size;
+ }
+ }
}
/* update frames */
@@ -278,4 +278,3 @@
0, 272, 272, 1, 192000, 0xd08e49d1
0, 273, 273, 1, 192000, 0xd08e49d1
0, 274, 274, 1, 192000, 0xd08e49d1
-0, 275, 275, 1, 192000, 0x1f34135f
From: Zhao Zhili <zhilizhao@tencent.com> Mark the frame as corrupt when AV_CODEC_FLAG_OUTPUT_CORRUPT is set, drop the frame otherwise. --- libavcodec/zmbv.c | 26 ++++++++++++++++++++------ tests/ref/fate/zmbv-8bit | 1 - 2 files changed, 20 insertions(+), 7 deletions(-)