avcodec/qtrle: Check how much of the chunk is available before decoding
[ffmpeg.git] / libavcodec / qtrle.c
index a744d7b..2c29547 100644 (file)
@@ -325,7 +325,7 @@ static void qtrle_decode_24bpp(QtrleContext *s, int row_ptr, int lines_to_change
                 CHECK_PIXEL_PTR(rle_code * 3);
 
                 while (rle_code--) {
-                    AV_WN16A(rgb + pixel_ptr, rg);
+                    AV_WN16(rgb + pixel_ptr, rg);
                     rgb[pixel_ptr + 2] = b;
                     pixel_ptr += 3;
                 }
@@ -335,13 +335,13 @@ static void qtrle_decode_24bpp(QtrleContext *s, int row_ptr, int lines_to_change
                 rle_code_half = rle_code / 2;
 
                 while (rle_code_half--) { /* copy 2 raw rgb value at the same time */
-                    AV_WN32A(rgb + pixel_ptr, bytestream2_get_ne32(&s->g)); /* rgbr */
-                    AV_WN16A(rgb + pixel_ptr + 4, bytestream2_get_ne16(&s->g)); /* rgbr */
+                    AV_WN32(rgb + pixel_ptr, bytestream2_get_ne32(&s->g)); /* rgbr */
+                    AV_WN16(rgb + pixel_ptr + 4, bytestream2_get_ne16(&s->g)); /* rgbr */
                     pixel_ptr += 6;
                 }
 
                 if (rle_code % 2 != 0){ /* not even raw value */
-                    AV_WN16A(rgb + pixel_ptr, bytestream2_get_ne16(&s->g));
+                    AV_WN16(rgb + pixel_ptr, bytestream2_get_ne16(&s->g));
                     rgb[pixel_ptr + 2] = bytestream2_get_byte(&s->g);
                     pixel_ptr += 3;
                 }
@@ -388,7 +388,7 @@ static void qtrle_decode_32bpp(QtrleContext *s, int row_ptr, int lines_to_change
                 /* copy pixels directly to output */
                 rle_code_half = rle_code / 2;
                 while (rle_code_half--) { /* copy 2 argb raw value at the same time */
-                    AV_WN64A(rgb + pixel_ptr, bytestream2_get_ne64(&s->g));
+                    AV_WN64(rgb + pixel_ptr, bytestream2_get_ne64(&s->g));
                     pixel_ptr += 8;
                 }
 
@@ -452,7 +452,7 @@ static int qtrle_decode_frame(AVCodecContext *avctx,
     int header, start_line;
     int height, row_ptr;
     int has_palette = 0;
-    int ret;
+    int ret, size;
 
     bytestream2_init(&s->g, avpkt->data, avpkt->size);
 
@@ -461,7 +461,10 @@ static int qtrle_decode_frame(AVCodecContext *avctx,
         return avpkt->size;
 
     /* start after the chunk size */
-    bytestream2_seek(&s->g, 4, SEEK_SET);
+    size = bytestream2_get_be32(&s->g) & 0x3FFFFFFF;
+    if (size - avpkt->size >  size * (int64_t)avctx->discard_damaged_percentage / 100)
+        return AVERROR_INVALIDDATA;
+
 
     /* fetch the header */
     header = bytestream2_get_be16(&s->g);