avidec: avoid infinite loop due to negative ast->sample_size
[ffmpeg.git] / libavcodec / intelh263dec.c
1 /*
2  * H.263i decoder
3  *
4  * This file is part of FFmpeg.
5  *
6  * FFmpeg is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * FFmpeg is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with FFmpeg; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19  */
20
21 #include "mpegvideo.h"
22 #include "h263.h"
23
24 /* don't understand why they choose a different header ! */
25 int ff_intel_h263_decode_picture_header(MpegEncContext *s)
26 {
27     int format;
28
29     if (get_bits_left(&s->gb) == 64) { /* special dummy frames */
30         return FRAME_SKIPPED;
31     }
32
33     /* picture header */
34     if (get_bits_long(&s->gb, 22) != 0x20) {
35         av_log(s->avctx, AV_LOG_ERROR, "Bad picture start code\n");
36         return -1;
37     }
38     s->picture_number = get_bits(&s->gb, 8); /* picture timestamp */
39
40     if (check_marker(&s->gb, "after picture_number") != 1) {
41         return -1;      /* marker */
42     }
43     if (get_bits1(&s->gb) != 0) {
44         av_log(s->avctx, AV_LOG_ERROR, "Bad H263 id\n");
45         return -1;      /* h263 id */
46     }
47     skip_bits1(&s->gb);         /* split screen off */
48     skip_bits1(&s->gb);         /* camera  off */
49     skip_bits1(&s->gb);         /* freeze picture release off */
50
51     format = get_bits(&s->gb, 3);
52     if (format == 0 || format == 6) {
53         av_log(s->avctx, AV_LOG_ERROR, "Intel H263 free format not supported\n");
54         return -1;
55     }
56     s->h263_plus = 0;
57
58     s->pict_type = AV_PICTURE_TYPE_I + get_bits1(&s->gb);
59
60     s->h263_long_vectors = get_bits1(&s->gb);
61
62     if (get_bits1(&s->gb) != 0) {
63         av_log(s->avctx, AV_LOG_ERROR, "SAC not supported\n");
64         return -1;      /* SAC: off */
65     }
66     s->obmc= get_bits1(&s->gb);
67     s->unrestricted_mv = s->obmc || s->h263_long_vectors;
68     s->pb_frame = get_bits1(&s->gb);
69
70     if (format < 6) {
71         s->width = ff_h263_format[format][0];
72         s->height = ff_h263_format[format][1];
73         s->avctx->sample_aspect_ratio.num = 12;
74         s->avctx->sample_aspect_ratio.den = 11;
75     } else {
76         format = get_bits(&s->gb, 3);
77         if(format == 0 || format == 7){
78             av_log(s->avctx, AV_LOG_ERROR, "Wrong Intel H263 format\n");
79             return -1;
80         }
81         if(get_bits(&s->gb, 2))
82             av_log(s->avctx, AV_LOG_ERROR, "Bad value for reserved field\n");
83         s->loop_filter = get_bits1(&s->gb) * !s->avctx->lowres;
84         if(get_bits1(&s->gb))
85             av_log(s->avctx, AV_LOG_ERROR, "Bad value for reserved field\n");
86         if(get_bits1(&s->gb))
87             s->pb_frame = 2;
88         if(get_bits(&s->gb, 5))
89             av_log(s->avctx, AV_LOG_ERROR, "Bad value for reserved field\n");
90         if(get_bits(&s->gb, 5) != 1)
91             av_log(s->avctx, AV_LOG_ERROR, "Invalid marker\n");
92     }
93     if(format == 6){
94         int ar = get_bits(&s->gb, 4);
95         skip_bits(&s->gb, 9); // display width
96         check_marker(&s->gb, "in dimensions");
97         skip_bits(&s->gb, 9); // display height
98         if(ar == 15){
99             s->avctx->sample_aspect_ratio.num = get_bits(&s->gb, 8); // aspect ratio - width
100             s->avctx->sample_aspect_ratio.den = get_bits(&s->gb, 8); // aspect ratio - height
101         } else {
102             s->avctx->sample_aspect_ratio = ff_h263_pixel_aspect[ar];
103         }
104         if (s->avctx->sample_aspect_ratio.num == 0)
105             av_log(s->avctx, AV_LOG_ERROR, "Invalid aspect ratio.\n");
106     }
107
108     s->chroma_qscale= s->qscale = get_bits(&s->gb, 5);
109     skip_bits1(&s->gb); /* Continuous Presence Multipoint mode: off */
110
111     if(s->pb_frame){
112         skip_bits(&s->gb, 3); //temporal reference for B-frame
113         skip_bits(&s->gb, 2); //dbquant
114     }
115
116     /* PEI */
117     if (skip_1stop_8data_bits(&s->gb) < 0)
118         return AVERROR_INVALIDDATA;
119     s->f_code = 1;
120
121     s->y_dc_scale_table=
122     s->c_dc_scale_table= ff_mpeg1_dc_scale_table;
123
124     ff_h263_show_pict_info(s);
125
126     return 0;
127 }
128
129 AVCodec ff_h263i_decoder = {
130     .name           = "h263i",
131     .long_name      = NULL_IF_CONFIG_SMALL("Intel H.263"),
132     .type           = AVMEDIA_TYPE_VIDEO,
133     .id             = AV_CODEC_ID_H263I,
134     .priv_data_size = sizeof(MpegEncContext),
135     .init           = ff_h263_decode_init,
136     .close          = ff_h263_decode_end,
137     .decode         = ff_h263_decode_frame,
138     .capabilities   = CODEC_CAP_DRAW_HORIZ_BAND | CODEC_CAP_DR1,
139     .pix_fmts       = (const enum AVPixelFormat[]) {
140         AV_PIX_FMT_YUV420P,
141         AV_PIX_FMT_NONE
142     },
143 };