FFmpeg coverage

Line	Branch	Exec	Source
1			/*
2			* LucasArts Smush video decoder
3			* Copyright (c) 2006 Cyril Zorin
4			* Copyright (c) 2011 Konstantin Shishkov
5			*
6			* This file is part of FFmpeg.
7			*
8			* FFmpeg is free software; you can redistribute it and/or
9			* modify it under the terms of the GNU Lesser General Public
10			* License as published by the Free Software Foundation; either
11			* version 2.1 of the License, or (at your option) any later version.
12			*
13			* FFmpeg is distributed in the hope that it will be useful,
14			* but WITHOUT ANY WARRANTY; without even the implied warranty of
15			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16			* Lesser General Public License for more details.
17			*
18			* You should have received a copy of the GNU Lesser General Public
19			* License along with FFmpeg; if not, write to the Free Software
20			* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
21			*/
22
23			#include "libavutil/avassert.h"
24			#include "libavutil/mem.h"
25
26			#include "avcodec.h"
27			#include "bytestream.h"
28			#include "copy_block.h"
29			#include "codec_internal.h"
30			#include "decode.h"
31
32			#define NGLYPHS 256
33			#define GLYPH_COORD_VECT_SIZE 16
34			#define PALETTE_SIZE 256
35			#define PALETTE_DELTA 768
36
37			static const int8_t glyph4_x[GLYPH_COORD_VECT_SIZE] = {
38			0, 1, 2, 3, 3, 3, 3, 2, 1, 0, 0, 0, 1, 2, 2, 1
39			};
40
41			static const int8_t glyph4_y[GLYPH_COORD_VECT_SIZE] = {
42			0, 0, 0, 0, 1, 2, 3, 3, 3, 3, 2, 1, 1, 1, 2, 2
43			};
44
45			static const int8_t glyph8_x[GLYPH_COORD_VECT_SIZE] = {
46			0, 2, 5, 7, 7, 7, 7, 7, 7, 5, 2, 0, 0, 0, 0, 0
47			};
48
49			static const int8_t glyph8_y[GLYPH_COORD_VECT_SIZE] = {
50			0, 0, 0, 0, 1, 3, 4, 6, 7, 7, 7, 7, 6, 4, 3, 1
51			};
52
53			/* codec47/bl16 motion vectors */
54			static const int8_t c47_mv[256][2] = {
55			{ 0, 0 }, { -1, -43 }, { 6, -43 }, { -9, -42 }, { 13, -41 },
56			{ -16, -40 }, { 19, -39 }, { -23, -36 }, { 26, -34 }, { -2, -33 },
57			{ 4, -33 }, { -29, -32 }, { -9, -32 }, { 11, -31 }, { -16, -29 },
58			{ 32, -29 }, { 18, -28 }, { -34, -26 }, { -22, -25 }, { -1, -25 },
59			{ 3, -25 }, { -7, -24 }, { 8, -24 }, { 24, -23 }, { 36, -23 },
60			{ -12, -22 }, { 13, -21 }, { -38, -20 }, { 0, -20 }, { -27, -19 },
61			{ -4, -19 }, { 4, -19 }, { -17, -18 }, { -8, -17 }, { 8, -17 },
62			{ 18, -17 }, { 28, -17 }, { 39, -17 }, { -12, -15 }, { 12, -15 },
63			{ -21, -14 }, { -1, -14 }, { 1, -14 }, { -41, -13 }, { -5, -13 },
64			{ 5, -13 }, { 21, -13 }, { -31, -12 }, { -15, -11 }, { -8, -11 },
65			{ 8, -11 }, { 15, -11 }, { -2, -10 }, { 1, -10 }, { 31, -10 },
66			{ -23, -9 }, { -11, -9 }, { -5, -9 }, { 4, -9 }, { 11, -9 },
67			{ 42, -9 }, { 6, -8 }, { 24, -8 }, { -18, -7 }, { -7, -7 },
68			{ -3, -7 }, { -1, -7 }, { 2, -7 }, { 18, -7 }, { -43, -6 },
69			{ -13, -6 }, { -4, -6 }, { 4, -6 }, { 8, -6 }, { -33, -5 },
70			{ -9, -5 }, { -2, -5 }, { 0, -5 }, { 2, -5 }, { 5, -5 },
71			{ 13, -5 }, { -25, -4 }, { -6, -4 }, { -3, -4 }, { 3, -4 },
72			{ 9, -4 }, { -19, -3 }, { -7, -3 }, { -4, -3 }, { -2, -3 },
73			{ -1, -3 }, { 0, -3 }, { 1, -3 }, { 2, -3 }, { 4, -3 },
74			{ 6, -3 }, { 33, -3 }, { -14, -2 }, { -10, -2 }, { -5, -2 },
75			{ -3, -2 }, { -2, -2 }, { -1, -2 }, { 0, -2 }, { 1, -2 },
76			{ 2, -2 }, { 3, -2 }, { 5, -2 }, { 7, -2 }, { 14, -2 },
77			{ 19, -2 }, { 25, -2 }, { 43, -2 }, { -7, -1 }, { -3, -1 },
78			{ -2, -1 }, { -1, -1 }, { 0, -1 }, { 1, -1 }, { 2, -1 },
79			{ 3, -1 }, { 10, -1 }, { -5, 0 }, { -3, 0 }, { -2, 0 },
80			{ -1, 0 }, { 1, 0 }, { 2, 0 }, { 3, 0 }, { 5, 0 },
81			{ 7, 0 }, { -10, 1 }, { -7, 1 }, { -3, 1 }, { -2, 1 },
82			{ -1, 1 }, { 0, 1 }, { 1, 1 }, { 2, 1 }, { 3, 1 },
83			{ -43, 2 }, { -25, 2 }, { -19, 2 }, { -14, 2 }, { -5, 2 },
84			{ -3, 2 }, { -2, 2 }, { -1, 2 }, { 0, 2 }, { 1, 2 },
85			{ 2, 2 }, { 3, 2 }, { 5, 2 }, { 7, 2 }, { 10, 2 },
86			{ 14, 2 }, { -33, 3 }, { -6, 3 }, { -4, 3 }, { -2, 3 },
87			{ -1, 3 }, { 0, 3 }, { 1, 3 }, { 2, 3 }, { 4, 3 },
88			{ 19, 3 }, { -9, 4 }, { -3, 4 }, { 3, 4 }, { 7, 4 },
89			{ 25, 4 }, { -13, 5 }, { -5, 5 }, { -2, 5 }, { 0, 5 },
90			{ 2, 5 }, { 5, 5 }, { 9, 5 }, { 33, 5 }, { -8, 6 },
91			{ -4, 6 }, { 4, 6 }, { 13, 6 }, { 43, 6 }, { -18, 7 },
92			{ -2, 7 }, { 0, 7 }, { 2, 7 }, { 7, 7 }, { 18, 7 },
93			{ -24, 8 }, { -6, 8 }, { -42, 9 }, { -11, 9 }, { -4, 9 },
94			{ 5, 9 }, { 11, 9 }, { 23, 9 }, { -31, 10 }, { -1, 10 },
95			{ 2, 10 }, { -15, 11 }, { -8, 11 }, { 8, 11 }, { 15, 11 },
96			{ 31, 12 }, { -21, 13 }, { -5, 13 }, { 5, 13 }, { 41, 13 },
97			{ -1, 14 }, { 1, 14 }, { 21, 14 }, { -12, 15 }, { 12, 15 },
98			{ -39, 17 }, { -28, 17 }, { -18, 17 }, { -8, 17 }, { 8, 17 },
99			{ 17, 18 }, { -4, 19 }, { 0, 19 }, { 4, 19 }, { 27, 19 },
100			{ 38, 20 }, { -13, 21 }, { 12, 22 }, { -36, 23 }, { -24, 23 },
101			{ -8, 24 }, { 7, 24 }, { -3, 25 }, { 1, 25 }, { 22, 25 },
102			{ 34, 26 }, { -18, 28 }, { -32, 29 }, { 16, 29 }, { -11, 31 },
103			{ 9, 32 }, { 29, 32 }, { -4, 33 }, { 2, 33 }, { -26, 34 },
104			{ 23, 36 }, { -19, 39 }, { 16, 40 }, { -13, 41 }, { 9, 42 },
105			{ -6, 43 }, { 1, 43 }, { 0, 0 }, { 0, 0 }, { 0, 0 },
106			};
107
108			/* codec37/48 motion vector tables: 3x 512 bytes/256 x-y pairs */
109			static const int8_t c37_mv[] = {
110			0, 0, 1, 0, 2, 0, 3, 0, 5, 0,
111			8, 0, 13, 0, 21, 0, -1, 0, -2, 0,
112			-3, 0, -5, 0, -8, 0, -13, 0, -17, 0,
113			-21, 0, 0, 1, 1, 1, 2, 1, 3, 1,
114			5, 1, 8, 1, 13, 1, 21, 1, -1, 1,
115			-2, 1, -3, 1, -5, 1, -8, 1, -13, 1,
116			-17, 1, -21, 1, 0, 2, 1, 2, 2, 2,
117			3, 2, 5, 2, 8, 2, 13, 2, 21, 2,
118			-1, 2, -2, 2, -3, 2, -5, 2, -8, 2,
119			-13, 2, -17, 2, -21, 2, 0, 3, 1, 3,
120			2, 3, 3, 3, 5, 3, 8, 3, 13, 3,
121			21, 3, -1, 3, -2, 3, -3, 3, -5, 3,
122			-8, 3, -13, 3, -17, 3, -21, 3, 0, 5,
123			1, 5, 2, 5, 3, 5, 5, 5, 8, 5,
124			13, 5, 21, 5, -1, 5, -2, 5, -3, 5,
125			-5, 5, -8, 5, -13, 5, -17, 5, -21, 5,
126			0, 8, 1, 8, 2, 8, 3, 8, 5, 8,
127			8, 8, 13, 8, 21, 8, -1, 8, -2, 8,
128			-3, 8, -5, 8, -8, 8, -13, 8, -17, 8,
129			-21, 8, 0, 13, 1, 13, 2, 13, 3, 13,
130			5, 13, 8, 13, 13, 13, 21, 13, -1, 13,
131			-2, 13, -3, 13, -5, 13, -8, 13, -13, 13,
132			-17, 13, -21, 13, 0, 21, 1, 21, 2, 21,
133			3, 21, 5, 21, 8, 21, 13, 21, 21, 21,
134			-1, 21, -2, 21, -3, 21, -5, 21, -8, 21,
135			-13, 21, -17, 21, -21, 21, 0, -1, 1, -1,
136			2, -1, 3, -1, 5, -1, 8, -1, 13, -1,
137			21, -1, -1, -1, -2, -1, -3, -1, -5, -1,
138			-8, -1, -13, -1, -17, -1, -21, -1, 0, -2,
139			1, -2, 2, -2, 3, -2, 5, -2, 8, -2,
140			13, -2, 21, -2, -1, -2, -2, -2, -3, -2,
141			-5, -2, -8, -2, -13, -2, -17, -2, -21, -2,
142			0, -3, 1, -3, 2, -3, 3, -3, 5, -3,
143			8, -3, 13, -3, 21, -3, -1, -3, -2, -3,
144			-3, -3, -5, -3, -8, -3, -13, -3, -17, -3,
145			-21, -3, 0, -5, 1, -5, 2, -5, 3, -5,
146			5, -5, 8, -5, 13, -5, 21, -5, -1, -5,
147			-2, -5, -3, -5, -5, -5, -8, -5, -13, -5,
148			-17, -5, -21, -5, 0, -8, 1, -8, 2, -8,
149			3, -8, 5, -8, 8, -8, 13, -8, 21, -8,
150			-1, -8, -2, -8, -3, -8, -5, -8, -8, -8,
151			-13, -8, -17, -8, -21, -8, 0, -13, 1, -13,
152			2, -13, 3, -13, 5, -13, 8, -13, 13, -13,
153			21, -13, -1, -13, -2, -13, -3, -13, -5, -13,
154			-8, -13, -13, -13, -17, -13, -21, -13, 0, -17,
155			1, -17, 2, -17, 3, -17, 5, -17, 8, -17,
156			13, -17, 21, -17, -1, -17, -2, -17, -3, -17,
157			-5, -17, -8, -17, -13, -17, -17, -17, -21, -17,
158			0, -21, 1, -21, 2, -21, 3, -21, 5, -21,
159			8, -21, 13, -21, 21, -21, -1, -21, -2, -21,
160			-3, -21, -5, -21, -8, -21, -13, -21, -17, -21,
161			0, 0,
162			0, 0, -8, -29, 8, -29, -18, -25, 17, -25,
163			0, -23, -6, -22, 6, -22, -13, -19, 12, -19,
164			0, -18, 25, -18, -25, -17, -5, -17, 5, -17,
165			-10, -15, 10, -15, 0, -14, -4, -13, 4, -13,
166			19, -13, -19, -12, -8, -11, -2, -11, 0, -11,
167			2, -11, 8, -11, -15, -10, -4, -10, 4, -10,
168			15, -10, -6, -9, -1, -9, 1, -9, 6, -9,
169			-29, -8, -11, -8, -8, -8, -3, -8, 3, -8,
170			8, -8, 11, -8, 29, -8, -5, -7, -2, -7,
171			0, -7, 2, -7, 5, -7, -22, -6, -9, -6,
172			-6, -6, -3, -6, -1, -6, 1, -6, 3, -6,
173			6, -6, 9, -6, 22, -6, -17, -5, -7, -5,
174			-4, -5, -2, -5, 0, -5, 2, -5, 4, -5,
175			7, -5, 17, -5, -13, -4, -10, -4, -5, -4,
176			-3, -4, -1, -4, 0, -4, 1, -4, 3, -4,
177			5, -4, 10, -4, 13, -4, -8, -3, -6, -3,
178			-4, -3, -3, -3, -2, -3, -1, -3, 0, -3,
179			1, -3, 2, -3, 4, -3, 6, -3, 8, -3,
180			-11, -2, -7, -2, -5, -2, -3, -2, -2, -2,
181			-1, -2, 0, -2, 1, -2, 2, -2, 3, -2,
182			5, -2, 7, -2, 11, -2, -9, -1, -6, -1,
183			-4, -1, -3, -1, -2, -1, -1, -1, 0, -1,
184			1, -1, 2, -1, 3, -1, 4, -1, 6, -1,
185			9, -1, -31, 0, -23, 0, -18, 0, -14, 0,
186			-11, 0, -7, 0, -5, 0, -4, 0, -3, 0,
187			-2, 0, -1, 0, 0, -31, 1, 0, 2, 0,
188			3, 0, 4, 0, 5, 0, 7, 0, 11, 0,
189			14, 0, 18, 0, 23, 0, 31, 0, -9, 1,
190			-6, 1, -4, 1, -3, 1, -2, 1, -1, 1,
191			0, 1, 1, 1, 2, 1, 3, 1, 4, 1,
192			6, 1, 9, 1, -11, 2, -7, 2, -5, 2,
193			-3, 2, -2, 2, -1, 2, 0, 2, 1, 2,
194			2, 2, 3, 2, 5, 2, 7, 2, 11, 2,
195			-8, 3, -6, 3, -4, 3, -2, 3, -1, 3,
196			0, 3, 1, 3, 2, 3, 3, 3, 4, 3,
197			6, 3, 8, 3, -13, 4, -10, 4, -5, 4,
198			-3, 4, -1, 4, 0, 4, 1, 4, 3, 4,
199			5, 4, 10, 4, 13, 4, -17, 5, -7, 5,
200			-4, 5, -2, 5, 0, 5, 2, 5, 4, 5,
201			7, 5, 17, 5, -22, 6, -9, 6, -6, 6,
202			-3, 6, -1, 6, 1, 6, 3, 6, 6, 6,
203			9, 6, 22, 6, -5, 7, -2, 7, 0, 7,
204			2, 7, 5, 7, -29, 8, -11, 8, -8, 8,
205			-3, 8, 3, 8, 8, 8, 11, 8, 29, 8,
206			-6, 9, -1, 9, 1, 9, 6, 9, -15, 10,
207			-4, 10, 4, 10, 15, 10, -8, 11, -2, 11,
208			0, 11, 2, 11, 8, 11, 19, 12, -19, 13,
209			-4, 13, 4, 13, 0, 14, -10, 15, 10, 15,
210			-5, 17, 5, 17, 25, 17, -25, 18, 0, 18,
211			-12, 19, 13, 19, -6, 22, 6, 22, 0, 23,
212			-17, 25, 18, 25, -8, 29, 8, 29, 0, 31,
213			0, 0,
214			0, 0, -6, -22, 6, -22, -13, -19, 12, -19,
215			0, -18, -5, -17, 5, -17, -10, -15, 10, -15,
216			0, -14, -4, -13, 4, -13, 19, -13, -19, -12,
217			-8, -11, -2, -11, 0, -11, 2, -11, 8, -11,
218			-15, -10, -4, -10, 4, -10, 15, -10, -6, -9,
219			-1, -9, 1, -9, 6, -9, -11, -8, -8, -8,
220			-3, -8, 0, -8, 3, -8, 8, -8, 11, -8,
221			-5, -7, -2, -7, 0, -7, 2, -7, 5, -7,
222			-22, -6, -9, -6, -6, -6, -3, -6, -1, -6,
223			1, -6, 3, -6, 6, -6, 9, -6, 22, -6,
224			-17, -5, -7, -5, -4, -5, -2, -5, -1, -5,
225			0, -5, 1, -5, 2, -5, 4, -5, 7, -5,
226			17, -5, -13, -4, -10, -4, -5, -4, -3, -4,
227			-2, -4, -1, -4, 0, -4, 1, -4, 2, -4,
228			3, -4, 5, -4, 10, -4, 13, -4, -8, -3,
229			-6, -3, -4, -3, -3, -3, -2, -3, -1, -3,
230			0, -3, 1, -3, 2, -3, 3, -3, 4, -3,
231			6, -3, 8, -3, -11, -2, -7, -2, -5, -2,
232			-4, -2, -3, -2, -2, -2, -1, -2, 0, -2,
233			1, -2, 2, -2, 3, -2, 4, -2, 5, -2,
234			7, -2, 11, -2, -9, -1, -6, -1, -5, -1,
235			-4, -1, -3, -1, -2, -1, -1, -1, 0, -1,
236			1, -1, 2, -1, 3, -1, 4, -1, 5, -1,
237			6, -1, 9, -1, -23, 0, -18, 0, -14, 0,
238			-11, 0, -7, 0, -5, 0, -4, 0, -3, 0,
239			-2, 0, -1, 0, 0, -23, 1, 0, 2, 0,
240			3, 0, 4, 0, 5, 0, 7, 0, 11, 0,
241			14, 0, 18, 0, 23, 0, -9, 1, -6, 1,
242			-5, 1, -4, 1, -3, 1, -2, 1, -1, 1,
243			0, 1, 1, 1, 2, 1, 3, 1, 4, 1,
244			5, 1, 6, 1, 9, 1, -11, 2, -7, 2,
245			-5, 2, -4, 2, -3, 2, -2, 2, -1, 2,
246			0, 2, 1, 2, 2, 2, 3, 2, 4, 2,
247			5, 2, 7, 2, 11, 2, -8, 3, -6, 3,
248			-4, 3, -3, 3, -2, 3, -1, 3, 0, 3,
249			1, 3, 2, 3, 3, 3, 4, 3, 6, 3,
250			8, 3, -13, 4, -10, 4, -5, 4, -3, 4,
251			-2, 4, -1, 4, 0, 4, 1, 4, 2, 4,
252			3, 4, 5, 4, 10, 4, 13, 4, -17, 5,
253			-7, 5, -4, 5, -2, 5, -1, 5, 0, 5,
254			1, 5, 2, 5, 4, 5, 7, 5, 17, 5,
255			-22, 6, -9, 6, -6, 6, -3, 6, -1, 6,
256			1, 6, 3, 6, 6, 6, 9, 6, 22, 6,
257			-5, 7, -2, 7, 0, 7, 2, 7, 5, 7,
258			-11, 8, -8, 8, -3, 8, 0, 8, 3, 8,
259			8, 8, 11, 8, -6, 9, -1, 9, 1, 9,
260			6, 9, -15, 10, -4, 10, 4, 10, 15, 10,
261			-8, 11, -2, 11, 0, 11, 2, 11, 8, 11,
262			19, 12, -19, 13, -4, 13, 4, 13, 0, 14,
263			-10, 15, 10, 15, -5, 17, 5, 17, 0, 18,
264			-12, 19, 13, 19, -6, 22, 6, 22, 0, 23,
265			0, 0
266			};
267
268			typedef struct SANMVideoContext {
269			AVCodecContext *avctx;
270			GetByteContext gb;
271
272			int version, subversion, have_dimensions, first_fob;
273			uint32_t pal[PALETTE_SIZE];
274			int16_t delta_pal[PALETTE_DELTA], shift_pal[PALETTE_DELTA];
275
276			ptrdiff_t pitch;
277			int width, height;
278			int aligned_width, aligned_height;
279			int prev_seq;
280
281			AVFrame *frame;
282			uint16_t *fbuf, *frm0, *frm1, *frm2;
283			uint8_t *stored_frame;
284			uint32_t fbuf_size, frm0_size, frm1_size, frm2_size;
285			uint32_t stor_size;
286			uint32_t stored_frame_size;
287
288			uint8_t *rle_buf;
289			unsigned int rle_buf_size;
290
291			long npixels, buf_size;
292
293			uint16_t codebook[256];
294			uint16_t small_codebook[4];
295
296			int8_t p4x4glyphs[NGLYPHS][16];
297			int8_t p8x8glyphs[NGLYPHS][64];
298			uint8_t c47itbl[0x10000];
299			uint8_t c23lut[256];
300			uint8_t c4tbl[2][256][16];
301			uint16_t c4param;
302			uint8_t c47cb[4];
303			uint8_t c45tbl1[0x300];
304			uint8_t c45tbl2[0x8000];
305			} SANMVideoContext;
306
307			enum GlyphEdge {
308			LEFT_EDGE,
309			TOP_EDGE,
310			RIGHT_EDGE,
311			BOTTOM_EDGE,
312			NO_EDGE
313			};
314
315			enum GlyphDir {
316			DIR_LEFT,
317			DIR_UP,
318			DIR_RIGHT,
319			DIR_DOWN,
320			NO_DIR
321			};
322
323			/**
324			* Return enum GlyphEdge of box where point (x, y) lies.
325			*
326			* @param x x point coordinate
327			* @param y y point coordinate
328			* @param edge_size box width/height.
329			*/
330		1632	static enum GlyphEdge which_edge(int x, int y, int edge_size)
331			{
332		1632	const int edge_max = edge_size - 1;
333
334	2/2 ✓ Branch 0 taken 408 times. ✓ Branch 1 taken 1224 times.	1632	if (!y)
335		408	return BOTTOM_EDGE;
336	2/2 ✓ Branch 0 taken 408 times. ✓ Branch 1 taken 816 times.	1224	else if (y == edge_max)
337		408	return TOP_EDGE;
338	2/2 ✓ Branch 0 taken 306 times. ✓ Branch 1 taken 510 times.	816	else if (!x)
339		306	return LEFT_EDGE;
340	2/2 ✓ Branch 0 taken 306 times. ✓ Branch 1 taken 204 times.	510	else if (x == edge_max)
341		306	return RIGHT_EDGE;
342			else
343		204	return NO_EDGE;
344			}
345
346		1536	static enum GlyphDir which_direction(enum GlyphEdge edge0, enum GlyphEdge edge1)
347			{
348	6/6 ✓ Branch 0 taken 288 times. ✓ Branch 1 taken 1248 times. ✓ Branch 2 taken 228 times. ✓ Branch 3 taken 60 times. ✓ Branch 4 taken 288 times. ✓ Branch 5 taken 1188 times.	1536	if ((edge0 == LEFT_EDGE && edge1 == RIGHT_EDGE) ||
349	4/4 ✓ Branch 0 taken 228 times. ✓ Branch 1 taken 60 times. ✓ Branch 2 taken 384 times. ✓ Branch 3 taken 1032 times.	1476	(edge1 == LEFT_EDGE && edge0 == RIGHT_EDGE) ||
350	4/4 ✓ Branch 0 taken 96 times. ✓ Branch 1 taken 288 times. ✓ Branch 2 taken 288 times. ✓ Branch 3 taken 840 times.	1416	(edge0 == BOTTOM_EDGE && edge1 != TOP_EDGE) ||
351	2/2 ✓ Branch 0 taken 192 times. ✓ Branch 1 taken 96 times.	288	(edge1 == BOTTOM_EDGE && edge0 != TOP_EDGE))
352		600	return DIR_UP;
353	6/6 ✓ Branch 0 taken 384 times. ✓ Branch 1 taken 552 times. ✓ Branch 2 taken 96 times. ✓ Branch 3 taken 288 times. ✓ Branch 4 taken 288 times. ✓ Branch 5 taken 360 times.	936	else if ((edge0 == TOP_EDGE && edge1 != BOTTOM_EDGE) ||
354	2/2 ✓ Branch 0 taken 192 times. ✓ Branch 1 taken 96 times.	288	(edge1 == TOP_EDGE && edge0 != BOTTOM_EDGE))
355		480	return DIR_DOWN;
356	5/6 ✓ Branch 0 taken 84 times. ✓ Branch 1 taken 372 times. ✗ Branch 2 not taken. ✓ Branch 3 taken 84 times. ✓ Branch 4 taken 24 times. ✓ Branch 5 taken 348 times.	456	else if ((edge0 == LEFT_EDGE && edge1 != RIGHT_EDGE) ||
357	1/2 ✓ Branch 0 taken 24 times. ✗ Branch 1 not taken.	24	(edge1 == LEFT_EDGE && edge0 != RIGHT_EDGE))
358		108	return DIR_LEFT;
359	5/6 ✓ Branch 0 taken 96 times. ✓ Branch 1 taken 252 times. ✗ Branch 2 not taken. ✓ Branch 3 taken 96 times. ✓ Branch 4 taken 96 times. ✓ Branch 5 taken 156 times.	348	else if ((edge0 == TOP_EDGE && edge1 == BOTTOM_EDGE) ||
360	3/4 ✗ Branch 0 not taken. ✓ Branch 1 taken 96 times. ✓ Branch 2 taken 84 times. ✓ Branch 3 taken 72 times.	252	(edge1 == TOP_EDGE && edge0 == BOTTOM_EDGE) ||
361	3/4 ✗ Branch 0 not taken. ✓ Branch 1 taken 84 times. ✓ Branch 2 taken 24 times. ✓ Branch 3 taken 48 times.	156	(edge0 == RIGHT_EDGE && edge1 != LEFT_EDGE) ||
362	1/2 ✓ Branch 0 taken 24 times. ✗ Branch 1 not taken.	24	(edge1 == RIGHT_EDGE && edge0 != LEFT_EDGE))
363		300	return DIR_RIGHT;
364
365		48	return NO_DIR;
366			}
367
368			/* Interpolate two points. */
369		6600	static void interp_point(int8_t *points, int x0, int y0, int x1, int y1,
370			int pos, int npoints)
371			{
372	2/2 ✓ Branch 0 taken 6504 times. ✓ Branch 1 taken 96 times.	6600	if (npoints) {
373		6504	points[0] = (x0 * pos + x1 * (npoints - pos) + (npoints >> 1)) / npoints;
374		6504	points[1] = (y0 * pos + y1 * (npoints - pos) + (npoints >> 1)) / npoints;
375			} else {
376		96	points[0] = x0;
377		96	points[1] = y0;
378			}
379		6600	}
380
381			/**
382			* Construct glyphs by iterating through vector coordinates.
383			*
384			* @param pglyphs pointer to table where glyphs are stored
385			* @param xvec pointer to x component of vector coordinates
386			* @param yvec pointer to y component of vector coordinates
387			* @param side_length glyph width/height.
388			*/
389		6	static void make_glyphs(int8_t *pglyphs, const int8_t *xvec, const int8_t *yvec,
390			const int side_length)
391			{
392		6	const int glyph_size = side_length * side_length;
393		6	int8_t *pglyph = pglyphs;
394
395			int i, j;
396	2/2 ✓ Branch 0 taken 96 times. ✓ Branch 1 taken 6 times.	102	for (i = 0; i < GLYPH_COORD_VECT_SIZE; i++) {
397		96	int x0 = xvec[i];
398		96	int y0 = yvec[i];
399		96	enum GlyphEdge edge0 = which_edge(x0, y0, side_length);
400
401	2/2 ✓ Branch 0 taken 1536 times. ✓ Branch 1 taken 96 times.	1632	for (j = 0; j < GLYPH_COORD_VECT_SIZE; j++, pglyph += glyph_size) {
402		1536	int x1 = xvec[j];
403		1536	int y1 = yvec[j];
404		1536	enum GlyphEdge edge1 = which_edge(x1, y1, side_length);
405		1536	enum GlyphDir dir = which_direction(edge0, edge1);
406		1536	int npoints = FFMAX(FFABS(x1 - x0), FFABS(y1 - y0));
407			int ipoint;
408
409	2/2 ✓ Branch 0 taken 6600 times. ✓ Branch 1 taken 1536 times.	8136	for (ipoint = 0; ipoint <= npoints; ipoint++) {
410			int8_t point[2];
411			int irow, icol;
412
413		6600	interp_point(point, x0, y0, x1, y1, ipoint, npoints);
414
415	5/5 ✓ Branch 0 taken 2832 times. ✓ Branch 1 taken 1968 times. ✓ Branch 2 taken 282 times. ✓ Branch 3 taken 1434 times. ✓ Branch 4 taken 84 times.	6600	switch (dir) {
416		2832	case DIR_UP:
417	2/2 ✓ Branch 0 taken 8232 times. ✓ Branch 1 taken 2832 times.	11064	for (irow = point[1]; irow >= 0; irow--)
418		8232	pglyph[point[0] + irow * side_length] = 1;
419		2832	break;
420
421		1968	case DIR_DOWN:
422	2/2 ✓ Branch 0 taken 4500 times. ✓ Branch 1 taken 1968 times.	6468	for (irow = point[1]; irow < side_length; irow++)
423		4500	pglyph[point[0] + irow * side_length] = 1;
424		1968	break;
425
426		282	case DIR_LEFT:
427	2/2 ✓ Branch 0 taken 378 times. ✓ Branch 1 taken 282 times.	660	for (icol = point[0]; icol >= 0; icol--)
428		378	pglyph[icol + point[1] * side_length] = 1;
429		282	break;
430
431		1434	case DIR_RIGHT:
432	2/2 ✓ Branch 0 taken 4794 times. ✓ Branch 1 taken 1434 times.	6228	for (icol = point[0]; icol < side_length; icol++)
433		4794	pglyph[icol + point[1] * side_length] = 1;
434		1434	break;
435			}
436			}
437			}
438			}
439		6	}
440
441		6	static void init_sizes(SANMVideoContext *ctx, int width, int height)
442			{
443		6	ctx->width = width;
444		6	ctx->height = height;
445		6	ctx->npixels = width * height;
446
447		6	ctx->aligned_width = FFALIGN(width, 8);
448		6	ctx->aligned_height = FFALIGN(height, 8);
449
450		6	ctx->buf_size = ctx->aligned_width * ctx->aligned_height * sizeof(ctx->frm0[0]);
451		6	ctx->pitch = width;
452		6	}
453
454		3	static void destroy_buffers(SANMVideoContext *ctx)
455			{
456		3	av_freep(&ctx->fbuf);
457		3	av_freep(&ctx->frm0);
458		3	av_freep(&ctx->frm1);
459		3	av_freep(&ctx->frm2);
460		3	av_freep(&ctx->stored_frame);
461		3	av_freep(&ctx->rle_buf);
462		3	ctx->frm0_size =
463		3	ctx->frm1_size =
464		3	ctx->frm2_size = 0;
465		3	init_sizes(ctx, 0, 0);
466		3	}
467
468		3	static av_cold int init_buffers(SANMVideoContext *ctx)
469			{
470		3	av_fast_padded_mallocz(&ctx->fbuf, &ctx->fbuf_size, ctx->buf_size);
471		3	av_fast_padded_mallocz(&ctx->frm0, &ctx->frm0_size, ctx->buf_size);
472		3	av_fast_padded_mallocz(&ctx->frm1, &ctx->frm1_size, ctx->buf_size);
473		3	av_fast_padded_mallocz(&ctx->frm2, &ctx->frm2_size, ctx->buf_size);
474	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 3 times.	3	if (!ctx->version) {
475		✗	av_fast_padded_mallocz(&ctx->stored_frame,
476		✗	&ctx->stored_frame_size, ctx->buf_size);
477		✗	ctx->stor_size = 0;
478			}
479
480	3/6 ✓ Branch 0 taken 3 times. ✗ Branch 1 not taken. ✓ Branch 2 taken 3 times. ✗ Branch 3 not taken. ✓ Branch 4 taken 3 times. ✗ Branch 5 not taken.	3	if (!ctx->frm0 || !ctx->frm1 || !ctx->frm2 ||
481	2/4 ✓ Branch 0 taken 3 times. ✗ Branch 1 not taken. ✗ Branch 2 not taken. ✓ Branch 3 taken 3 times.	3	(!ctx->stored_frame && !ctx->version)) {
482		✗	destroy_buffers(ctx);
483		✗	return AVERROR(ENOMEM);
484			}
485
486		3	return 0;
487			}
488
489		✗	static void codec33_gen_tiles(SANMVideoContext *ctx, int8_t param1)
490			{
491		✗	uint8_t *dst = &(ctx->c4tbl[0][0][0]);
492			int i, j, k, l, m, n, o, p;
493
494		✗	for (i = 0; i < 8; i++) {
495		✗	for (k = 0; k < 8; k++) {
496		✗	j = i + param1;
497		✗	l = k + param1;
498		✗	p = (j + l) >> 1;
499		✗	n = (j + p) >> 1;
500		✗	m = (p + l) >> 1;
501
502		✗	*dst++ = p; *dst++ = p; *dst++ = n; *dst++ = j;
503		✗	*dst++ = p; *dst++ = p; *dst++ = n; *dst++ = j;
504		✗	*dst++ = m; *dst++ = m; *dst++ = p; *dst++ = j;
505		✗	*dst++ = l; *dst++ = l; *dst++ = m; *dst++ = p;
506			}
507			}
508
509		✗	for (i = 0; i < 8; i++) {
510		✗	for (k = 0; k < 8; k++) {
511		✗	j = i + param1;
512		✗	l = k + param1;
513		✗	n = (j + l) >> 1;
514		✗	m = (l + n) >> 1;
515
516		✗	*dst++ = j; *dst++ = j; *dst++ = j; *dst++ = j;
517		✗	*dst++ = n; *dst++ = n; *dst++ = n; *dst++ = n;
518		✗	*dst++ = m; *dst++ = m; *dst++ = m; *dst++ = m;
519		✗	*dst++ = l; *dst++ = l; *dst++ = l; *dst++ = l;
520			}
521			}
522
523		✗	for (i = 0; i < 8; i++) {
524		✗	for (k = 0; k < 8; k++) {
525		✗	j = i + param1;
526		✗	l = k + param1;
527		✗	m = (j + l) >> 1;
528		✗	n = (j + m) >> 1;
529		✗	o = (l + m) >> 1;
530
531		✗	*dst++ = j; *dst++ = j; *dst++ = n; *dst++ = m;
532		✗	*dst++ = j; *dst++ = j; *dst++ = n; *dst++ = m;
533		✗	*dst++ = n; *dst++ = n; *dst++ = m; *dst++ = o;
534		✗	*dst++ = m; *dst++ = m; *dst++ = o; *dst++ = l;
535			}
536			}
537
538		✗	for (i = 0; i < 8; i++) {
539		✗	for (k = 0; k < 8; k++) {
540		✗	j = i + param1;
541		✗	l = k + param1;
542		✗	m = (j + l) >> 1;
543		✗	n = (l + m) >> 1;
544
545		✗	*dst++ = j; *dst++ = m; *dst++ = n; *dst++ = l;
546		✗	*dst++ = j; *dst++ = m; *dst++ = n; *dst++ = l;
547		✗	*dst++ = j; *dst++ = m; *dst++ = n; *dst++ = l;
548		✗	*dst++ = j; *dst++ = m; *dst++ = n; *dst++ = l;
549			}
550			}
551		✗	}
552
553		✗	static void codec4_gen_tiles(SANMVideoContext *ctx, uint16_t param1)
554			{
555		✗	uint8_t *dst = &(ctx->c4tbl[0][0][0]);
556			int i, j, k, l, m, n, o;
557
558		✗	for (i = 1; i < 16; i += 2) {
559		✗	for (k = 0; k < 16; k++) {
560		✗	j = i + param1;
561		✗	l = k + param1;
562		✗	m = (j + l) / 2;
563		✗	n = (j + m) / 2;
564		✗	o = (l + m) / 2;
565		✗	if (j == m || l == m) {
566		✗	*dst++ = l; *dst++ = j; *dst++ = l; *dst++ = j;
567		✗	*dst++ = j; *dst++ = l; *dst++ = j; *dst++ = j;
568		✗	*dst++ = l; *dst++ = j; *dst++ = l; *dst++ = j;
569		✗	*dst++ = l; *dst++ = l; *dst++ = j; *dst++ = l;
570			} else {
571		✗	*dst++ = m; *dst++ = m; *dst++ = n; *dst++ = j;
572		✗	*dst++ = m; *dst++ = m; *dst++ = n; *dst++ = j;
573		✗	*dst++ = o; *dst++ = o; *dst++ = m; *dst++ = n;
574		✗	*dst++ = l; *dst++ = l; *dst++ = o; *dst++ = m;
575			}
576			}
577			}
578
579		✗	for (i = 0; i < 16; i += 2) {
580		✗	for (k = 0; k < 16; k++) {
581		✗	j = i + param1;
582		✗	l = k + param1;
583		✗	m = (j + l) / 2;
584		✗	n = (j + m) / 2;
585		✗	o = (l + m) / 2;
586		✗	if (m == j || m == l) {
587		✗	*dst++ = j; *dst++ = j; *dst++ = l; *dst++ = j;
588		✗	*dst++ = j; *dst++ = j; *dst++ = j; *dst++ = l;
589		✗	*dst++ = l; *dst++ = j; *dst++ = l; *dst++ = l;
590		✗	*dst++ = j; *dst++ = l; *dst++ = j; *dst++ = l;
591			} else {
592		✗	*dst++ = j; *dst++ = j; *dst++ = n; *dst++ = m;
593		✗	*dst++ = j; *dst++ = j; *dst++ = n; *dst++ = m;
594		✗	*dst++ = n; *dst++ = n; *dst++ = m; *dst++ = o;
595		✗	*dst++ = m; *dst++ = m; *dst++ = o; *dst++ = l;
596			}
597			}
598			}
599		✗	}
600
601
602		✗	static int codec4_load_tiles(SANMVideoContext *ctx, GetByteContext *gb,
603			uint16_t param2, uint8_t clr)
604			{
605		✗	uint8_t c, *dst = (uint8_t *)&(ctx->c4tbl[1][0][0]);
606		✗	uint32_t loop = param2 * 8;
607
608		✗	if ((param2 > 256) || (bytestream2_get_bytes_left(gb) < loop))
609		✗	return AVERROR_INVALIDDATA;
610
611		✗	while (loop--) {
612		✗	c = bytestream2_get_byteu(gb);
613		✗	*dst++ = (c >> 4) + clr;
614		✗	*dst++ = (c & 0xf) + clr;
615			}
616
617		✗	return 0;
618			}
619
620		9	static void rotate_bufs(SANMVideoContext *ctx, int rotate_code)
621			{
622	2/2 ✓ Branch 0 taken 1 times. ✓ Branch 1 taken 8 times.	9	if (rotate_code == 2)
623		1	FFSWAP(uint16_t*, ctx->frm1, ctx->frm2);
624		9	FFSWAP(uint16_t*, ctx->frm2, ctx->frm0);
625		9	}
626
627		3	static av_cold int decode_init(AVCodecContext *avctx)
628			{
629		3	SANMVideoContext *ctx = avctx->priv_data;
630
631		3	ctx->avctx = avctx;
632		3	ctx->version = !avctx->extradata_size;
633			// early sanity check before allocations to avoid need for deallocation code.
634	1/4 ✗ Branch 0 not taken. ✓ Branch 1 taken 3 times. ✗ Branch 2 not taken. ✗ Branch 3 not taken.	3	if (!ctx->version && avctx->extradata_size < 1026) {
635		✗	av_log(avctx, AV_LOG_ERROR, "Not enough extradata.\n");
636		✗	return AVERROR_INVALIDDATA;
637			}
638
639	1/2 ✓ Branch 0 taken 3 times. ✗ Branch 1 not taken.	3	avctx->pix_fmt = ctx->version ? AV_PIX_FMT_RGB565 : AV_PIX_FMT_PAL8;
640
641	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 3 times.	3	if (!ctx->version) {
642			// ANIM valid range is 2x2 up to 640x480. If the given
643			// width/height are within that range, lock the dimensions
644			// and forego future changes in process_frame_obj().
645			// NOTE: the smush demuxer passes 0/0 since ANM/SAN files
646			// have no dimension information in their header.
647		✗	if (avctx->width != 0 || avctx->height != 0) {
648		✗	if ((avctx->width < 2) || (avctx->height < 2))
649		✗	return AVERROR_INVALIDDATA;
650		✗	if ((avctx->width <= 640) && (avctx->height <= 480))
651		✗	ctx->have_dimensions = 1;
652			else
653		✗	return AVERROR_INVALIDDATA;
654			}
655	2/4 ✓ Branch 0 taken 3 times. ✗ Branch 1 not taken. ✓ Branch 2 taken 3 times. ✗ Branch 3 not taken.	3	} else if (avctx->width > 800 || avctx->height > 600 ||
656	2/4 ✓ Branch 0 taken 3 times. ✗ Branch 1 not taken. ✗ Branch 2 not taken. ✓ Branch 3 taken 3 times.	3	avctx->width < 8 || avctx->height < 8) {
657			// BL16 valid range is 8x8 - 800x600
658		✗	return AVERROR_INVALIDDATA;
659			}
660		3	init_sizes(ctx, avctx->width, avctx->height);
661	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 3 times.	3	if (init_buffers(ctx)) {
662		✗	av_log(avctx, AV_LOG_ERROR, "Error allocating buffers.\n");
663		✗	return AVERROR(ENOMEM);
664			}
665
666		3	make_glyphs(ctx->p4x4glyphs[0], glyph4_x, glyph4_y, 4);
667		3	make_glyphs(ctx->p8x8glyphs[0], glyph8_x, glyph8_y, 8);
668
669	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 3 times.	3	if (!ctx->version) {
670			int i;
671
672		✗	ctx->subversion = AV_RL16(avctx->extradata);
673		✗	for (i = 0; i < PALETTE_SIZE; i++)
674		✗	ctx->pal[i] = 0xFFU << 24 | AV_RL32(avctx->extradata + 2 + i * 4);
675		✗	if (ctx->subversion < 2)
676		✗	ctx->pal[0] = 0xFFU << 24;
677			}
678		3	ctx->c4param = 0xffff;
679
680		3	return 0;
681			}
682
683		3	static av_cold int decode_end(AVCodecContext *avctx)
684			{
685		3	SANMVideoContext *ctx = avctx->priv_data;
686
687		3	destroy_buffers(ctx);
688
689		3	return 0;
690			}
691
692		✗	static int old_codec4(SANMVideoContext *ctx, GetByteContext *gb, int top, int left,
693			int w, int h, uint8_t param, uint16_t param2, int codec)
694			{
695		✗	const uint16_t mx = ctx->width, my = ctx->height, p = ctx->pitch;
696		✗	uint8_t mask, bits, idx, *gs, *dst = (uint8_t *)ctx->fbuf;
697			int i, j, k, l, bit, ret, x, y;
698
699		✗	if (ctx->c4param != param) {
700		✗	if (codec > 32)
701		✗	codec33_gen_tiles(ctx, param);
702			else
703		✗	codec4_gen_tiles(ctx, param);
704		✗	ctx->c4param = param;
705			}
706		✗	if (param2 > 0) {
707		✗	ret = codec4_load_tiles(ctx, gb, param2, param);
708		✗	if (ret)
709		✗	return ret;
710			}
711
712		✗	if (codec > 32)
713		✗	codec -= 29;
714
715		✗	for (j = 0; j < w; j += 4) {
716		✗	mask = bits = 0;
717		✗	x = left + j;
718		✗	for (i = 0; i < h; i += 4) {
719		✗	y = top + i;
720		✗	if (param2 > 0) {
721		✗	if (bits == 0) {
722		✗	if (bytestream2_get_bytes_left(gb) < 1)
723		✗	return AVERROR_INVALIDDATA;
724		✗	mask = bytestream2_get_byteu(gb);
725		✗	bits = 8;
726			}
727		✗	bit = !!(mask & 0x80);
728		✗	mask <<= 1;
729		✗	bits--;
730			} else {
731		✗	bit = 0;
732			}
733
734		✗	if (bytestream2_get_bytes_left(gb) < 1)
735		✗	return AVERROR_INVALIDDATA;
736		✗	idx = bytestream2_get_byteu(gb);
737		✗	if ((bit == 0) && (idx == 0x80) && (codec != 5))
738		✗	continue;
739		✗	if ((y >= my) || ((y + 4) < 0) || ((x + 4) < 0) || (x >= mx))
740		✗	continue;
741		✗	gs = &(ctx->c4tbl[bit][idx][0]);
742		✗	if ((y >= 0) && (x >= 0) && ((y + 4) < my) && ((x + 4) < mx)) {
743		✗	for (k = 0; k < 4; k++, gs += 4)
744		✗	memcpy(dst + x + (y + k) * p, gs, 4);
745			} else {
746		✗	for (k = 0; k < 4; k++) {
747		✗	for (l = 0; l < 4; l++, gs++) {
748		✗	const int yo = y + k, xo = x + l;
749		✗	if ((yo >= 0) && (yo < my) && (xo >= 0) && (xo < mx))
750		✗	*(dst + yo * p + xo) = *gs;
751			}
752			}
753			}
754			}
755			}
756		✗	return 0;
757			}
758
759		1	static int rle_decode(SANMVideoContext *ctx, GetByteContext *gb, uint8_t *dst, const int out_size)
760			{
761		1	int opcode, color, run_len, left = out_size;
762
763	2/2 ✓ Branch 0 taken 4800 times. ✓ Branch 1 taken 1 times.	4801	while (left > 0) {
764		4800	opcode = bytestream2_get_byte(gb);
765		4800	run_len = (opcode >> 1) + 1;
766	2/4 ✓ Branch 0 taken 4800 times. ✗ Branch 1 not taken. ✗ Branch 3 not taken. ✓ Branch 4 taken 4800 times.	4800	if (run_len > left || bytestream2_get_bytes_left(gb) <= 0)
767		✗	return AVERROR_INVALIDDATA;
768
769	1/2 ✓ Branch 0 taken 4800 times. ✗ Branch 1 not taken.	4800	if (opcode & 1) {
770		4800	color = bytestream2_get_byte(gb);
771		4800	memset(dst, color, run_len);
772			} else {
773		✗	if (bytestream2_get_bytes_left(gb) < run_len)
774		✗	return AVERROR_INVALIDDATA;
775		✗	bytestream2_get_bufferu(gb, dst, run_len);
776			}
777
778		4800	dst += run_len;
779		4800	left -= run_len;
780			}
781
782		1	return 0;
783			}
784
785		✗	static int old_codec23(SANMVideoContext *ctx, GetByteContext *gb, int top, int left,
786			int width, int height, uint8_t param, uint16_t param2)
787			{
788		✗	const uint16_t mx = ctx->width, my = ctx->height, p = ctx->pitch;
789		✗	uint8_t c, lut[256], *dst = (uint8_t *)ctx->fbuf;
790			int sk, i, j, ls, pc, y;
791
792		✗	if (ctx->subversion < 2) {
793			/* Rebel Assault 1: constant offset + 0xd0 */
794		✗	for (i = 0; i < 256; i++)
795		✗	lut[i] = (i + param + 0xd0) & 0xff;
796		✗	} else if (param2 == 256) {
797		✗	if (bytestream2_get_bytes_left(gb) < 256)
798		✗	return AVERROR_INVALIDDATA;
799		✗	bytestream2_get_bufferu(gb, ctx->c23lut, 256);
800		✗	} else if (param2 < 256) {
801		✗	for (i = 0; i < 256; i++)
802		✗	lut[i] = (i + param2) & 0xff;
803			} else {
804		✗	memcpy(lut, ctx->c23lut, 256);
805			}
806		✗	if (bytestream2_get_bytes_left(gb) < 1)
807		✗	return 0; /* some c23 frames just set up the LUT */
808
809		✗	if (((top + height) < 0) || (top >= my) || (left + width < 0) || (left >= mx))
810		✗	return 0;
811
812		✗	if (top < 0) {
813		✗	y = -top;
814		✗	while (y-- && bytestream2_get_bytes_left(gb) > 1) {
815		✗	ls = bytestream2_get_le16u(gb);
816		✗	if (bytestream2_get_bytes_left(gb) < ls)
817		✗	return AVERROR_INVALIDDATA;
818		✗	bytestream2_skip(gb, ls);
819			}
820		✗	height += top;
821		✗	top = 0;
822			}
823
824		✗	y = top;
825		✗	for (; (bytestream2_get_bytes_left(gb) > 1) && (height > 0) && (y < my); height--, y++) {
826		✗	ls = bytestream2_get_le16u(gb);
827		✗	sk = 1;
828		✗	pc = left;
829		✗	while ((bytestream2_get_bytes_left(gb) > 0) && (ls > 0) && (pc <= (width + left))) {
830		✗	j = bytestream2_get_byteu(gb);
831		✗	ls--;
832		✗	if (!sk) {
833		✗	while (j--) {
834		✗	if ((pc >= 0) && (pc < mx)) {
835		✗	c = *(dst + (y * p) + pc);
836		✗	*(dst + (y * p) + pc) = lut[c];
837			}
838		✗	if (pc < mx)
839		✗	pc++;
840			}
841			} else {
842		✗	if (pc < mx)
843		✗	pc += j;
844			}
845		✗	sk ^= 1;
846			}
847			}
848		✗	return 0;
849			}
850
851		✗	static int old_codec21(SANMVideoContext *ctx, GetByteContext *gb, int top, int left,
852			int width, int height)
853			{
854		✗	const uint16_t mx = ctx->width, my = ctx->height, p = ctx->pitch;
855		✗	uint8_t *dst = (uint8_t *)ctx->fbuf, c;
856			int j, y, pc, sk, ls;
857
858		✗	if (((top + height) < 0) || (top >= my) || (left + width < 0) || (left >= mx))
859		✗	return 0;
860
861		✗	y = top;
862		✗	for (; (bytestream2_get_bytes_left(gb) > 2) && (height > 0) && (y < my); height--, y++) {
863		✗	ls = bytestream2_get_le16u(gb);
864		✗	if (y < 0) {
865		✗	if (ls >= bytestream2_get_bytes_left(gb))
866		✗	return 0;
867		✗	bytestream2_skip(gb, ls);
868		✗	continue;
869			}
870		✗	sk = 1;
871		✗	pc = left;
872		✗	while ((bytestream2_get_bytes_left(gb) > 1) && (ls > 1) && (pc <= (width + left))) {
873		✗	j = bytestream2_get_le16u(gb);
874		✗	ls -= 2;
875		✗	if (sk) {
876		✗	if (pc < mx)
877		✗	pc += j;
878			} else {
879		✗	while ((bytestream2_get_bytes_left(gb) > 0) && (ls > 0) && (j >= 0)) {
880		✗	c = bytestream2_get_byteu(gb);
881		✗	if ((pc >= 0) && (pc < mx)) {
882		✗	*(dst + (y * p) + pc) = c;
883			}
884		✗	ls--;
885		✗	j--;
886		✗	if (pc < mx)
887		✗	pc++;
888			}
889			}
890		✗	sk ^= 1;
891			}
892			}
893		✗	return 0;
894			}
895
896		✗	static int old_codec1(SANMVideoContext *ctx, GetByteContext *gb, int top,
897			int left, int width, int height, int opaque)
898			{
899		✗	const uint16_t mx = ctx->width, my = ctx->height, p = ctx->pitch;
900		✗	uint8_t *dst = (uint8_t *)ctx->fbuf, code, c;
901			int j, x, y, flag, dlen;
902
903		✗	if (((top + height) < 0) || (top >= my) || (left + width < 0) || (left >= mx))
904		✗	return 0;
905
906		✗	if (top < 0) {
907		✗	y = -top;
908		✗	while (y-- && bytestream2_get_bytes_left(gb) > 1) {
909		✗	dlen = bytestream2_get_le16u(gb);
910		✗	if (bytestream2_get_bytes_left(gb) <= dlen)
911		✗	return AVERROR_INVALIDDATA;
912		✗	bytestream2_skip(gb, dlen);
913			}
914		✗	height += top;
915		✗	top = 0;
916			}
917
918		✗	y = top;
919		✗	for (; (bytestream2_get_bytes_left(gb) > 1) && (height > 0) && (y < my); height--, y++) {
920		✗	dlen = bytestream2_get_le16u(gb);
921		✗	x = left;
922		✗	while (bytestream2_get_bytes_left(gb) > 1 && dlen) {
923		✗	code = bytestream2_get_byteu(gb);
924		✗	dlen--;
925		✗	flag = code & 1;
926		✗	code = (code >> 1) + 1;
927		✗	if (flag) {
928		✗	c = bytestream2_get_byteu(gb);
929		✗	dlen--;
930		✗	if (x >= mx)
931		✗	continue;
932		✗	if (x < 0) {
933		✗	int dff = FFMIN(-x, code);
934		✗	code -= dff;
935		✗	x += dff;
936			}
937		✗	if (x + code >= mx)
938		✗	code = mx - x;
939		✗	if (code < 1)
940		✗	continue;
941		✗	for (j = 0; (j < code) && (c || opaque); j++) {
942		✗	*(dst + (y * p) + x + j) = c;
943			}
944		✗	x += code;
945			} else {
946		✗	if (bytestream2_get_bytes_left(gb) < code)
947		✗	return AVERROR_INVALIDDATA;
948		✗	for (j = 0; j < code; j++) {
949		✗	c = bytestream2_get_byteu(gb);
950		✗	if ((x >= 0) && (x < mx) && (c || opaque))
951		✗	*(dst + (y * p) + x) = c;
952		✗	if (x < mx)
953		✗	x++;
954			}
955		✗	dlen -= code;
956			}
957			}
958			}
959
960		✗	return 0;
961			}
962
963		✗	static int old_codec31(SANMVideoContext *ctx, GetByteContext *gb, int top,
964			int left, int width, int height, int p1, int opaque)
965			{
966		✗	const uint16_t mx = ctx->width, my = ctx->height, p = ctx->pitch;
967		✗	uint8_t *dst = (uint8_t *)ctx->fbuf, c;
968			int j, x, y, flag, dlen, code;
969
970		✗	if (((top + height) < 0) || (top >= my) || (left + width < 0) || (left >= mx))
971		✗	return 0;
972
973		✗	if (top < 0) {
974		✗	y = -top;
975		✗	while (y-- && bytestream2_get_bytes_left(gb) > 1) {
976		✗	dlen = bytestream2_get_le16u(gb);
977		✗	if (bytestream2_get_bytes_left(gb) <= dlen)
978		✗	return AVERROR_INVALIDDATA;
979		✗	bytestream2_skip(gb, dlen);
980			}
981		✗	height += top;
982		✗	top = 0;
983			}
984
985		✗	y = top;
986		✗	for (; (bytestream2_get_bytes_left(gb) > 1) && (height > 0) && (y < my); height--, y++) {
987		✗	dlen = bytestream2_get_le16u(gb);
988		✗	x = left;
989		✗	while (bytestream2_get_bytes_left(gb) > 1 && dlen) {
990		✗	code = bytestream2_get_byteu(gb);
991		✗	dlen--;
992		✗	flag = code & 1;
993		✗	code = (code >> 1) + 1;
994		✗	if (flag) {
995		✗	c = bytestream2_get_byteu(gb);
996		✗	dlen--;
997		✗	for (j = 0; (j < code); j++) {
998		✗	if ((opaque || (c & 0xf)) && (x >= 0) && (x < mx))
999		✗	*(dst + (y * p) + x) = p1 + (c & 0xf);
1000		✗	if (x < mx)
1001		✗	x++;
1002		✗	if ((opaque || (c >> 4)) && (x >= 0) && (x < mx))
1003		✗	*(dst + (y * p) + x) = p1 + (c >> 4);
1004		✗	if (x < mx)
1005		✗	x++;
1006			}
1007			} else {
1008		✗	if (bytestream2_get_bytes_left(gb) < code)
1009		✗	return AVERROR_INVALIDDATA;
1010		✗	for (j = 0; j < code; j++) {
1011		✗	c = bytestream2_get_byteu(gb);
1012		✗	if ((opaque || (c & 0xf)) && (x >= 0) && (x < mx))
1013		✗	*(dst + (y * p) + x) = p1 + (c & 0xf);
1014		✗	if (x < mx)
1015		✗	x++;
1016		✗	if ((opaque || (c >> 4)) && (x >= 0) && (x < mx))
1017		✗	*(dst + (y * p) + x) = p1 + (c >> 4);
1018		✗	if (x < mx)
1019		✗	x++;
1020			}
1021		✗	dlen -= code;
1022			}
1023			}
1024			}
1025
1026		✗	return 0;
1027			}
1028
1029		✗	static int old_codec2(SANMVideoContext *ctx, GetByteContext *gb, int top,
1030			int left, int width, int height)
1031			{
1032		✗	uint8_t *dst = (uint8_t *)ctx->fbuf, col;
1033		✗	int16_t xpos = left, ypos = top;
1034
1035		✗	while (bytestream2_get_bytes_left(gb) > 3) {
1036		✗	xpos += bytestream2_get_le16u(gb);
1037		✗	ypos += bytestream2_get_byteu(gb);
1038		✗	col = bytestream2_get_byteu(gb);
1039		✗	if (xpos >= 0 && ypos >= 0 &&
1040		✗	xpos < ctx->width && ypos < ctx->height) {
1041		✗	*(dst + xpos + ypos * ctx->pitch) = col;
1042			}
1043			}
1044		✗	return 0;
1045			}
1046
1047		✗	static void blt_solid(uint8_t *dst, const uint8_t *src, int16_t left, int16_t top,
1048			uint16_t srcxoff, uint16_t srcyoff, uint16_t srcwidth,
1049			uint16_t srcheight, const uint16_t srcpitch, const uint16_t dstpitch,
1050			const uint16_t dstheight, int32_t size)
1051			{
1052		✗	if ((srcwidth < 1) || (srcheight < 1) || (size < 1))
1053		✗	return;
1054
1055		✗	if (top < 0) {
1056		✗	if (-top >= srcheight)
1057		✗	return;
1058		✗	srcyoff -= top;
1059		✗	srcheight += top;
1060		✗	size += (srcpitch * top);
1061		✗	top = 0;
1062			}
1063
1064		✗	if ((top + srcheight) > dstheight) {
1065		✗	int clip = (top + srcheight) - dstheight;
1066		✗	if (clip >= srcheight)
1067		✗	return;
1068		✗	srcheight -= clip;
1069			}
1070
1071		✗	if (left < 0) {
1072		✗	if (-left >= srcwidth)
1073		✗	return;
1074		✗	srcxoff -= left;
1075		✗	srcwidth += left;
1076		✗	size += left;
1077		✗	left = 0;
1078			}
1079
1080		✗	if (left + srcwidth > dstpitch) {
1081		✗	int clip = (left + srcwidth) - dstpitch;
1082		✗	if (clip >= srcwidth)
1083		✗	return;
1084		✗	srcwidth -= clip;
1085			}
1086
1087		✗	src += ((uintptr_t)srcyoff * srcpitch) + srcxoff;
1088		✗	dst += ((uintptr_t)top * dstpitch) + left;
1089		✗	while ((srcheight--) && (size >= srcwidth)) {
1090		✗	memcpy(dst, src, srcwidth);
1091		✗	src += srcpitch;
1092		✗	dst += dstpitch;
1093		✗	size -= srcpitch;
1094			}
1095		✗	if ((size > 0) && (size < srcwidth) && (srcheight > 0))
1096		✗	memcpy(dst, src, size);
1097			}
1098
1099		✗	static void blt_mask(uint8_t *dst, const uint8_t *src, int16_t left, int16_t top,
1100			uint16_t srcxoff, uint16_t srcyoff, uint16_t srcwidth,
1101			uint16_t srcheight, const uint16_t srcpitch, const uint16_t dstpitch,
1102			const uint16_t dstheight, int32_t size, const uint8_t skipcolor)
1103			{
1104		✗	if ((srcwidth < 1) || (srcheight < 1) || (size < 1))
1105		✗	return;
1106
1107		✗	if (top < 0) {
1108		✗	if (-top >= srcheight)
1109		✗	return;
1110		✗	srcyoff -= top;
1111		✗	srcheight += top;
1112		✗	size += (srcpitch * top);
1113		✗	top = 0;
1114			}
1115
1116		✗	if ((top + srcheight) > dstheight) {
1117		✗	int clip = (top + srcheight) - dstheight;
1118		✗	if (clip >= srcheight)
1119		✗	return;
1120		✗	srcheight -= clip;
1121			}
1122
1123		✗	if (left < 0) {
1124		✗	if (-left >= srcwidth)
1125		✗	return;
1126		✗	srcxoff -= left;
1127		✗	srcwidth += left;
1128		✗	size += left;
1129		✗	left = 0;
1130			}
1131
1132		✗	if (left + srcwidth > dstpitch) {
1133		✗	int clip = (left + srcwidth) - dstpitch;
1134		✗	if (clip >= srcwidth)
1135		✗	return;
1136		✗	srcwidth -= clip;
1137			}
1138
1139		✗	src += ((uintptr_t)srcyoff * srcpitch) + srcxoff;
1140		✗	dst += ((uintptr_t)top * dstpitch) + left;
1141		✗	for (int i = 0; (size > 0) && (i < srcheight); i++) {
1142		✗	for (int j = 0; (size > 0) && (j < srcwidth); j++, size--) {
1143		✗	if (src[j] != skipcolor)
1144		✗	dst[j] = src[j];
1145			}
1146		✗	src += srcpitch;
1147		✗	dst += dstpitch;
1148			}
1149			}
1150
1151		✗	static void blt_ipol(uint8_t *dst, const uint8_t *src1, const uint8_t *src2,
1152			int16_t left, int16_t top, uint16_t srcxoff, uint16_t srcyoff,
1153			uint16_t srcwidth, uint16_t srcheight, const uint16_t srcpitch,
1154			const uint16_t dstpitch, const uint16_t dstheight, int32_t size,
1155			const uint8_t *itbl)
1156			{
1157		✗	if ((srcwidth < 1) || (srcheight < 1) || (size < 1))
1158		✗	return;
1159
1160		✗	if (top < 0) {
1161		✗	if (-top >= srcheight)
1162		✗	return;
1163		✗	srcyoff -= top;
1164		✗	srcheight += top;
1165		✗	size += (srcpitch * top);
1166		✗	top = 0;
1167			}
1168
1169		✗	if ((top + srcheight) > dstheight) {
1170		✗	int clip = (top + srcheight) - dstheight;
1171		✗	if (clip >= srcheight)
1172		✗	return;
1173		✗	srcheight -= clip;
1174			}
1175
1176		✗	if (left < 0) {
1177		✗	if (-left >= srcwidth)
1178		✗	return;
1179		✗	srcxoff -= left;
1180		✗	srcwidth += left;
1181		✗	size += left;
1182		✗	left = 0;
1183			}
1184
1185		✗	if (left + srcwidth > dstpitch) {
1186		✗	int clip = (left + srcwidth) - dstpitch;
1187		✗	if (clip >= srcwidth)
1188		✗	return;
1189		✗	srcwidth -= clip;
1190			}
1191
1192		✗	src1 += ((uintptr_t)srcyoff * srcpitch) + srcxoff;
1193		✗	src2 += ((uintptr_t)srcyoff * srcpitch) + srcxoff;
1194		✗	dst += ((uintptr_t)top * dstpitch) + left;
1195		✗	for (int i = 0; (size > 0) && (i < srcheight); i++) {
1196		✗	for (int j = 0; (size > 0) && (j < srcwidth); j++, size--) {
1197		✗	dst[j] = itbl[(src1[j] << 8) | src2[j]];
1198			}
1199		✗	src1 += srcpitch;
1200		✗	src2 += srcpitch;
1201		✗	dst += dstpitch;
1202			}
1203			}
1204
1205		✗	static int old_codec20(SANMVideoContext *ctx, GetByteContext *gb, int top, int left,
1206			const int w, const int h)
1207			{
1208		✗	blt_solid((uint8_t*)ctx->fbuf, gb->buffer, left, top, 0, 0, w, h, w, ctx->pitch,
1209		✗	ctx->height, FFMIN(bytestream2_get_bytes_left(gb), w * h));
1210
1211		✗	return 0;
1212			}
1213
1214		✗	static inline void codec37_mv(uint8_t *dst, const uint8_t *src,
1215			int height, int stride, int x, int y)
1216			{
1217			int pos, i, j;
1218
1219		✗	pos = x + y * stride;
1220		✗	for (j = 0; j < 4; j++) {
1221		✗	for (i = 0; i < 4; i++) {
1222		✗	if ((pos + i) < 0 || (pos + i) >= height * stride)
1223		✗	dst[i] = 0;
1224			else
1225		✗	dst[i] = src[i];
1226			}
1227		✗	dst += stride;
1228		✗	src += stride;
1229		✗	pos += stride;
1230			}
1231		✗	}
1232
1233		✗	static int old_codec37(SANMVideoContext *ctx, GetByteContext *gb, int top, int left,
1234			int width, int height)
1235			{
1236			int i, j, k, l, t, run, len, code, skip, mx, my;
1237			uint8_t *dst, *prev;
1238		✗	int skip_run = 0;
1239
1240		✗	width = FFALIGN(width, 4);
1241		✗	if (width > ctx->aligned_width)
1242		✗	return AVERROR_INVALIDDATA;
1243
1244		✗	if (FFALIGN(height, 4) > ctx->aligned_height)
1245		✗	return AVERROR_INVALIDDATA;
1246
1247		✗	if (bytestream2_get_bytes_left(gb) < 16)
1248		✗	return AVERROR_INVALIDDATA;
1249
1250		✗	int compr = bytestream2_get_byteu(gb);
1251		✗	int mvoff = bytestream2_get_byteu(gb);
1252		✗	int seq = bytestream2_get_le16u(gb);
1253		✗	uint32_t decoded_size = bytestream2_get_le32u(gb);
1254			int flags;
1255
1256		✗	bytestream2_skip(gb, 4);
1257		✗	flags = bytestream2_get_byteu(gb);
1258		✗	bytestream2_skip(gb, 3);
1259
1260		✗	if (decoded_size > height * width) {
1261		✗	decoded_size = height * width;
1262		✗	av_log(ctx->avctx, AV_LOG_WARNING, "Decoded size is too large.\n");
1263			}
1264
1265		✗	if (((seq & 1) || !(flags & 1)) && (compr && compr != 2)) {
1266		✗	FFSWAP(uint16_t*, ctx->frm0, ctx->frm2);
1267			}
1268
1269		✗	dst = ((uint8_t*)ctx->frm0);
1270		✗	prev = ((uint8_t*)ctx->frm2);
1271
1272		✗	if (mvoff > 2) {
1273		✗	av_log(ctx->avctx, AV_LOG_ERROR, "Invalid motion base value %d.\n", mvoff);
1274		✗	return AVERROR_INVALIDDATA;
1275			}
1276
1277		✗	switch (compr) {
1278		✗	case 0:
1279		✗	if (bytestream2_get_bytes_left(gb) < width * height)
1280		✗	return AVERROR_INVALIDDATA;
1281		✗	bytestream2_get_bufferu(gb, dst, width * height);
1282		✗	memset(ctx->frm2, 0, ctx->frm2_size);
1283		✗	break;
1284		✗	case 1:
1285		✗	run = 0;
1286		✗	len = -1;
1287		✗	code = 0;
1288
1289		✗	for (j = 0; j < height; j += 4) {
1290		✗	for (i = 0; i < width; i += 4) {
1291		✗	if (len < 0) {
1292		✗	if (bytestream2_get_bytes_left(gb) < 1)
1293		✗	return AVERROR_INVALIDDATA;
1294		✗	code = bytestream2_get_byte(gb);
1295		✗	len = code >> 1;
1296		✗	run = code & 1;
1297		✗	skip = 0;
1298			} else {
1299		✗	skip = run;
1300			}
1301
1302		✗	if (!skip) {
1303		✗	if (bytestream2_get_bytes_left(gb) < 1)
1304		✗	return AVERROR_INVALIDDATA;
1305		✗	code = bytestream2_get_byte(gb);
1306		✗	if (code == 0xff) {
1307		✗	len--;
1308		✗	for (k = 0; k < 4; k++) {
1309		✗	for (l = 0; l < 4; l++) {
1310		✗	if (len < 0) {
1311		✗	if (bytestream2_get_bytes_left(gb) < 1)
1312		✗	return AVERROR_INVALIDDATA;
1313		✗	code = bytestream2_get_byte(gb);
1314		✗	len = code >> 1;
1315		✗	run = code & 1;
1316		✗	if (run) {
1317		✗	if (bytestream2_get_bytes_left(gb) < 1)
1318		✗	return AVERROR_INVALIDDATA;
1319		✗	code = bytestream2_get_byte(gb);
1320			}
1321			}
1322		✗	if (!run) {
1323		✗	if (bytestream2_get_bytes_left(gb) < 1)
1324		✗	return AVERROR_INVALIDDATA;
1325		✗	code = bytestream2_get_byte(gb);
1326			}
1327		✗	*(dst + i + (k * width) + l) = code;
1328		✗	len--;
1329			}
1330			}
1331		✗	continue;
1332			}
1333			}
1334			/* 4x4 block copy from prev with MV */
1335		✗	mx = c37_mv[(mvoff * 256 + code) * 2];
1336		✗	my = c37_mv[(mvoff * 256 + code) * 2 + 1];
1337		✗	codec37_mv(dst + i, prev + i + mx + my * width,
1338			height, width, i + mx, j + my);
1339		✗	len--;
1340			}
1341		✗	dst += width * 4;
1342		✗	prev += width * 4;
1343			}
1344		✗	break;
1345		✗	case 2:
1346		✗	if (rle_decode(ctx, gb, dst, decoded_size))
1347		✗	return AVERROR_INVALIDDATA;
1348		✗	memset(ctx->frm2, 0, ctx->frm2_size);
1349		✗	break;
1350		✗	case 3:
1351			case 4:
1352		✗	for (j = 0; j < height; j += 4) {
1353		✗	for (i = 0; i < width; i += 4) {
1354			int code;
1355		✗	if (skip_run) {
1356		✗	skip_run--;
1357		✗	copy_block4(dst + i, prev + i, width, width, 4);
1358		✗	continue;
1359			}
1360		✗	if (bytestream2_get_bytes_left(gb) < 1)
1361		✗	return AVERROR_INVALIDDATA;
1362		✗	code = bytestream2_get_byteu(gb);
1363		✗	if (code == 0xFF) {
1364		✗	if (bytestream2_get_bytes_left(gb) < 16)
1365		✗	return AVERROR_INVALIDDATA;
1366		✗	for (k = 0; k < 4; k++)
1367		✗	bytestream2_get_bufferu(gb, dst + i + k * width, 4);
1368		✗	} else if ((flags & 4) && (code == 0xFE)) {
1369		✗	if (bytestream2_get_bytes_left(gb) < 4)
1370		✗	return AVERROR_INVALIDDATA;
1371		✗	for (k = 0; k < 4; k += 2) {
1372		✗	uint8_t c1 = bytestream2_get_byteu(gb);
1373		✗	uint8_t c2 = bytestream2_get_byteu(gb);
1374		✗	for (l = 0; l < 2; l++) {
1375		✗	*(dst + i + ((k + l) * width) + 0) = c1;
1376		✗	*(dst + i + ((k + l) * width) + 1) = c1;
1377		✗	*(dst + i + ((k + l) * width) + 2) = c2;
1378		✗	*(dst + i + ((k + l) * width) + 3) = c2;
1379			}
1380			}
1381		✗	} else if ((flags & 4) && (code == 0xFD)) {
1382		✗	if (bytestream2_get_bytes_left(gb) < 1)
1383		✗	return AVERROR_INVALIDDATA;
1384		✗	t = bytestream2_get_byteu(gb);
1385		✗	for (k = 0; k < 4; k++)
1386		✗	memset(dst + i + k * width, t, 4);
1387			} else {
1388		✗	mx = c37_mv[(mvoff * 256 + code) * 2];
1389		✗	my = c37_mv[(mvoff * 256 + code) * 2 + 1];
1390		✗	codec37_mv(dst + i, prev + i + mx + my * width,
1391			height, width, i + mx, j + my);
1392
1393		✗	if ((compr == 4) && (code == 0)) {
1394		✗	if (bytestream2_get_bytes_left(gb) < 1)
1395		✗	return AVERROR_INVALIDDATA;
1396		✗	skip_run = bytestream2_get_byteu(gb);
1397			}
1398			}
1399			}
1400		✗	dst += width * 4;
1401		✗	prev += width * 4;
1402			}
1403		✗	break;
1404		✗	default:
1405		✗	avpriv_report_missing_feature(ctx->avctx,
1406			"Subcodec 37 compression %d", compr);
1407		✗	return AVERROR_PATCHWELCOME;
1408			}
1409
1410		✗	if ((flags & 2) == 0) {
1411		✗	blt_solid((uint8_t*)ctx->fbuf, (uint8_t*)ctx->frm0, left, top, 0, 0, width,
1412		✗	height, width, ctx->pitch, ctx->height, width * height);
1413			} else {
1414		✗	blt_mask((uint8_t*)ctx->fbuf, (uint8_t*)ctx->frm0, left, top, 0, 0, width,
1415		✗	height, width, ctx->pitch, ctx->height, width * height, 0);
1416			}
1417		✗	return 0;
1418			}
1419
1420		✗	static int codec47_block(SANMVideoContext *ctx, GetByteContext *gb,uint8_t *dst,
1421			uint8_t *prev1, uint8_t *prev2, int stride, int size)
1422			{
1423			int code, k, t;
1424			uint8_t colors[2];
1425			int8_t *pglyph;
1426
1427		✗	if (bytestream2_get_bytes_left(gb) < 1)
1428		✗	return AVERROR_INVALIDDATA;
1429
1430		✗	code = bytestream2_get_byteu(gb);
1431		✗	if (code >= 0xF8) {
1432		✗	switch (code) {
1433		✗	case 0xFF:
1434		✗	if (size == 2) {
1435		✗	if (bytestream2_get_bytes_left(gb) < 4)
1436		✗	return AVERROR_INVALIDDATA;
1437		✗	dst[0] = bytestream2_get_byteu(gb);
1438		✗	dst[1] = bytestream2_get_byteu(gb);
1439		✗	dst[0 + stride] = bytestream2_get_byteu(gb);
1440		✗	dst[1 + stride] = bytestream2_get_byteu(gb);
1441			} else {
1442		✗	size >>= 1;
1443		✗	if (codec47_block(ctx, gb, dst, prev1, prev2, stride, size))
1444		✗	return AVERROR_INVALIDDATA;
1445		✗	if (codec47_block(ctx, gb, dst + size, prev1 + size, prev2 + size,
1446			stride, size))
1447		✗	return AVERROR_INVALIDDATA;
1448		✗	dst += size * stride;
1449		✗	prev1 += size * stride;
1450		✗	prev2 += size * stride;
1451		✗	if (codec47_block(ctx, gb, dst, prev1, prev2, stride, size))
1452		✗	return AVERROR_INVALIDDATA;
1453		✗	if (codec47_block(ctx, gb, dst + size, prev1 + size, prev2 + size,
1454			stride, size))
1455		✗	return AVERROR_INVALIDDATA;
1456			}
1457		✗	break;
1458		✗	case 0xFE:
1459		✗	if (bytestream2_get_bytes_left(gb) < 1)
1460		✗	return AVERROR_INVALIDDATA;
1461
1462		✗	t = bytestream2_get_byteu(gb);
1463		✗	for (k = 0; k < size; k++)
1464		✗	memset(dst + k * stride, t, size);
1465		✗	break;
1466		✗	case 0xFD:
1467		✗	if (bytestream2_get_bytes_left(gb) < 3)
1468		✗	return AVERROR_INVALIDDATA;
1469
1470		✗	code = bytestream2_get_byteu(gb);
1471		✗	pglyph = (size == 8) ? ctx->p8x8glyphs[code] : ctx->p4x4glyphs[code];
1472		✗	bytestream2_get_bufferu(gb, colors, 2);
1473
1474		✗	for (k = 0; k < size; k++)
1475		✗	for (t = 0; t < size; t++)
1476		✗	dst[t + k * stride] = colors[!*pglyph++];
1477		✗	break;
1478		✗	case 0xFC:
1479		✗	for (k = 0; k < size; k++)
1480		✗	memcpy(dst + k * stride, prev1 + k * stride, size);
1481		✗	break;
1482		✗	default:
1483		✗	for (k = 0; k < size; k++)
1484		✗	memset(dst + k * stride, ctx->c47cb[code & 3], size);
1485			}
1486			} else {
1487		✗	int mx = c47_mv[code][0];
1488		✗	int my = c47_mv[code][1];
1489		✗	int index = prev2 - (const uint8_t *)ctx->frm2;
1490
1491			av_assert2(index >= 0 && index < (ctx->buf_size >> 1));
1492
1493		✗	if (index < -mx - my * stride ||
1494		✗	(ctx->buf_size >> 1) - index < mx + size + (my + size - 1) * stride) {
1495		✗	av_log(ctx->avctx, AV_LOG_ERROR, "MV is invalid.\n");
1496		✗	return AVERROR_INVALIDDATA;
1497			}
1498
1499		✗	for (k = 0; k < size; k++)
1500		✗	memcpy(dst + k * stride, prev2 + mx + (my + k) * stride, size);
1501			}
1502
1503		✗	return 0;
1504			}
1505
1506		✗	static void codec47_read_interptable(GetByteContext *gb, uint8_t *itbl)
1507			{
1508			uint8_t *p1, *p2;
1509			int i, j;
1510
1511		✗	for (i = 0; i < 256; i++) {
1512		✗	p1 = p2 = itbl + i;
1513		✗	for (j = 256 - i; j; j--) {
1514		✗	*p1 = *p2 = bytestream2_get_byte(gb);
1515		✗	p1 += 1;
1516		✗	p2 += 256;
1517			}
1518		✗	itbl += 256;
1519			}
1520		✗	}
1521
1522		✗	static void codec47_comp1(GetByteContext *gb, uint8_t *dst_in, int width,
1523			const int height, const ptrdiff_t stride, const uint8_t *itbl)
1524			{
1525			uint8_t p1, *dst;
1526			uint16_t px;
1527			int i, j;
1528
1529		✗	dst = dst_in + stride;
1530		✗	for (i = 0; i < height; i += 2) {
1531		✗	p1 = bytestream2_get_byte(gb);
1532		✗	*dst++ = p1;
1533		✗	*dst++ = p1;
1534		✗	px = p1;
1535		✗	for (j = 2; j < width; j += 2) {
1536		✗	p1 = bytestream2_get_byte(gb);
1537		✗	px = (px << 8) | p1;
1538		✗	*dst++ = itbl[px];
1539		✗	*dst++ = p1;
1540			}
1541		✗	dst += stride;
1542			}
1543
1544		✗	memcpy(dst_in, dst_in + stride, width);
1545		✗	dst = dst_in + stride + stride;
1546		✗	for (i = 2; i < height - 1; i += 2) {
1547		✗	for (j = 0; j < width; j++) {
1548		✗	px = (*(dst - stride) << 8) | *(dst + stride);
1549		✗	*dst++ = itbl[px];
1550			}
1551		✗	dst += stride;
1552			}
1553		✗	}
1554
1555		✗	static int old_codec47(SANMVideoContext *ctx, GetByteContext *gb, int top, int left,
1556			int width, int height)
1557			{
1558			uint32_t decoded_size;
1559			int i, j;
1560		✗	uint8_t *dst = (uint8_t *)ctx->frm0;
1561		✗	uint8_t *prev1 = (uint8_t *)ctx->frm1;
1562		✗	uint8_t *prev2 = (uint8_t *)ctx->frm2;
1563			uint8_t auxcol[2];
1564
1565		✗	width = FFALIGN(width, 8);
1566		✗	if (width > ctx->aligned_width)
1567		✗	return AVERROR_INVALIDDATA;
1568
1569		✗	if (FFALIGN(height, 8) > ctx->aligned_height)
1570		✗	return AVERROR_INVALIDDATA;
1571
1572		✗	if (bytestream2_get_bytes_left(gb) < 26)
1573		✗	return AVERROR_INVALIDDATA;
1574
1575		✗	int seq = bytestream2_get_le16u(gb);
1576		✗	int compr = bytestream2_get_byteu(gb);
1577		✗	int new_rot = bytestream2_get_byteu(gb);
1578		✗	int skip = bytestream2_get_byteu(gb);
1579
1580		✗	bytestream2_skip(gb, 3);
1581		✗	bytestream2_get_bufferu(gb, ctx->c47cb, 4);
1582		✗	auxcol[0] = bytestream2_get_byteu(gb);
1583		✗	auxcol[1] = bytestream2_get_byteu(gb);
1584		✗	decoded_size = bytestream2_get_le32u(gb);
1585		✗	bytestream2_skip(gb, 8);
1586
1587		✗	if (decoded_size > ctx->aligned_height * width) {
1588		✗	decoded_size = height * width;
1589		✗	av_log(ctx->avctx, AV_LOG_WARNING, "Decoded size is too large.\n");
1590			}
1591
1592		✗	if (skip & 1) {
1593		✗	if (bytestream2_get_bytes_left(gb) < 0x8080)
1594		✗	return AVERROR_INVALIDDATA;
1595		✗	codec47_read_interptable(gb, ctx->c47itbl);
1596			}
1597		✗	if (!seq) {
1598		✗	ctx->prev_seq = -1;
1599		✗	memset(prev1, auxcol[0], ctx->frm0_size);
1600		✗	memset(prev2, auxcol[1], ctx->frm0_size);
1601			}
1602
1603		✗	switch (compr) {
1604		✗	case 0:
1605		✗	if (bytestream2_get_bytes_left(gb) < width * height)
1606		✗	return AVERROR_INVALIDDATA;
1607		✗	bytestream2_get_bufferu(gb, dst, width * height);
1608		✗	break;
1609		✗	case 1:
1610		✗	if (bytestream2_get_bytes_left(gb) < ((width + 1) >> 1) * ((height + 1) >> 1))
1611		✗	return AVERROR_INVALIDDATA;
1612		✗	codec47_comp1(gb, dst, width, height, width, ctx->c47itbl);
1613		✗	break;
1614		✗	case 2:
1615		✗	if (seq == ctx->prev_seq + 1) {
1616		✗	for (j = 0; j < height; j += 8) {
1617		✗	for (i = 0; i < width; i += 8)
1618		✗	if (codec47_block(ctx, gb, dst + i, prev1 + i, prev2 + i, width, 8))
1619		✗	return AVERROR_INVALIDDATA;
1620		✗	dst += width * 8;
1621		✗	prev1 += width * 8;
1622		✗	prev2 += width * 8;
1623			}
1624			}
1625		✗	break;
1626		✗	case 3:
1627		✗	memcpy(ctx->frm0, ctx->frm2, ctx->frm0_size);
1628		✗	break;
1629		✗	case 4:
1630		✗	memcpy(ctx->frm0, ctx->frm1, ctx->frm0_size);
1631		✗	break;
1632		✗	case 5:
1633		✗	if (rle_decode(ctx, gb, dst, decoded_size))
1634		✗	return AVERROR_INVALIDDATA;
1635		✗	break;
1636		✗	default:
1637		✗	avpriv_report_missing_feature(ctx->avctx,
1638			"Subcodec 47 compression %d", compr);
1639		✗	return AVERROR_PATCHWELCOME;
1640			}
1641
1642		✗	blt_solid((uint8_t*)ctx->fbuf, (uint8_t*)ctx->frm0, left, top, 0, 0, width,
1643		✗	height, width, ctx->pitch, ctx->height, width * height);
1644
1645		✗	if ((seq == ctx->prev_seq + 1) && new_rot)
1646		✗	rotate_bufs(ctx, new_rot);
1647
1648		✗	ctx->prev_seq = seq;
1649
1650		✗	return 0;
1651			}
1652
1653			// scale 4x4 input block to an 8x8 output block
1654		✗	static void c48_4to8(uint8_t *dst, const uint8_t *src, const uint16_t w)
1655			{
1656			uint16_t p;
1657			// dst is always at least 16bit aligned
1658		✗	for (int i = 0; i < 4; i++) {
1659		✗	for (int j = 0; j < 8; j += 2) {
1660		✗	p = *src++;
1661		✗	p = (p << 8) | p;
1662		✗	*((uint16_t *)(dst + w * 0 + j)) = p;
1663		✗	*((uint16_t *)(dst + w * 1 + j)) = p;
1664			}
1665		✗	dst += w * 2;
1666			}
1667		✗	}
1668
1669		✗	static int c48_invalid_mv(int x, int y, const uint16_t w, int h, int blocksize, int mvofs) {
1670		✗	if (mvofs < -x + -y*w)
1671		✗	return AVERROR_INVALIDDATA;
1672
1673		✗	if (mvofs > w-x-blocksize + w*(h-y-blocksize))
1674		✗	return AVERROR_INVALIDDATA;
1675
1676		✗	return 0;
1677			}
1678
1679		✗	static int codec48_block(GetByteContext *gb, uint8_t *dst, uint8_t *db, int x, int y,
1680			const uint16_t w, const int aligned_height, const uint8_t *itbl)
1681			{
1682			uint8_t opc, sb[16];
1683			int i, j, k, l;
1684			int16_t mvofs;
1685			uint32_t ofs;
1686
1687		✗	if (bytestream2_get_bytes_left(gb) < 1)
1688		✗	return 1;
1689
1690		✗	opc = bytestream2_get_byteu(gb);
1691		✗	switch (opc) {
1692		✗	case 0xFF: // 1x1 -> 8x8 block scale
1693		✗	if (bytestream2_get_bytes_left(gb) < 1)
1694		✗	return 1;
1695
1696		✗	if (y > 0 && x > 0) {
1697		✗	sb[15] = bytestream2_get_byteu(gb);
1698		✗	sb[ 7] = itbl[(*(dst - 1*w + 7) << 8) | sb[15]];
1699		✗	sb[ 3] = itbl[(*(dst - 1*w + 7) << 8) | sb[ 7]];
1700		✗	sb[11] = itbl[(sb[15] << 8) | sb[ 7]];
1701		✗	sb[ 1] = itbl[(*(dst + 0*w - 1) << 8) | sb[ 3]];
1702		✗	sb[ 0] = itbl[(*(dst + 0*w - 1) << 8) | sb[ 1]];
1703		✗	sb[ 2] = itbl[(sb[ 3] << 8) | sb[ 1]];
1704		✗	sb[ 5] = itbl[(*(dst + 2*w - 1) << 8) | sb[ 7]];
1705		✗	sb[ 4] = itbl[(*(dst + 2*w - 1) << 8) | sb[ 5]];
1706		✗	sb[ 6] = itbl[(sb[ 7] << 8) | sb[ 5]];
1707		✗	sb[ 9] = itbl[(*(dst + 3*w - 1) << 8) | sb[11]];
1708		✗	sb[ 8] = itbl[(*(dst + 3*w - 1) << 8) | sb[ 9]];
1709		✗	sb[10] = itbl[(sb[11] << 8) | sb[ 9]];
1710		✗	sb[13] = itbl[(*(dst + 4*w - 1) << 8) | sb[15]];
1711		✗	sb[12] = itbl[(*(dst + 4*w - 1) << 8) | sb[13]];
1712		✗	sb[14] = itbl[(sb[15] << 8) | sb[13]];
1713			} else {
1714		✗	opc = bytestream2_get_byteu(gb);
1715		✗	for (i = 0; i < 16; i++)
1716		✗	sb[i] = opc;
1717			}
1718		✗	c48_4to8(dst, sb, w);
1719		✗	break;
1720		✗	case 0xFE: // 1x 8x8 copy from deltabuf, 16bit mv from source
1721		✗	if (bytestream2_get_bytes_left(gb) < 2)
1722		✗	return 1;
1723		✗	mvofs = bytestream2_get_le16(gb);
1724		✗	if (c48_invalid_mv(x, y, w, aligned_height, 8, mvofs))
1725		✗	break;
1726		✗	for (i = 0; i < 8; i++) {
1727		✗	ofs = w * i;
1728		✗	for (k = 0; k < 8; k++)
1729		✗	*(dst + ofs + k) = *(db + ofs + k + mvofs);
1730			}
1731		✗	break;
1732		✗	case 0xFD: // 2x2 -> 8x8 block scale
1733		✗	if (bytestream2_get_bytes_left(gb) < 4)
1734		✗	return 1;
1735		✗	sb[ 5] = bytestream2_get_byteu(gb);
1736		✗	sb[ 7] = bytestream2_get_byteu(gb);
1737		✗	sb[13] = bytestream2_get_byteu(gb);
1738		✗	sb[15] = bytestream2_get_byteu(gb);
1739
1740		✗	if (y > 0 && x >0) {
1741		✗	sb[ 1] = itbl[(*(dst - 1*w + 3) << 8) | sb[ 5]];
1742		✗	sb[ 3] = itbl[(*(dst - 1*w + 7) << 8) | sb[ 7]];
1743		✗	sb[ 9] = itbl[(sb[13] << 8) | sb[ 5]];
1744		✗	sb[11] = itbl[(sb[15] << 8) | sb[ 7]];
1745		✗	sb[ 0] = itbl[(*(dst + 0*w - 1) << 8) | sb[ 1]];
1746		✗	sb[ 2] = itbl[(sb[ 3] << 8) | sb[ 1]];
1747		✗	sb[ 4] = itbl[(*(dst + 2*w - 1) << 8) | sb[ 5]];
1748		✗	sb[ 6] = itbl[(sb[ 7] << 8) | sb[ 5]];
1749		✗	sb[ 8] = itbl[(*(dst + 3*w - 1) << 8) | sb[ 9]];
1750		✗	sb[10] = itbl[(sb[11] << 8) | sb[ 9]];
1751		✗	sb[12] = itbl[(*(dst + 4*w - 1) << 8) | sb[13]];
1752		✗	sb[14] = itbl[(sb[15] << 8) | sb[13]];
1753			} else {
1754		✗	sb[ 0] = sb[ 1] = sb[ 4] = sb[ 5];
1755		✗	sb[ 2] = sb[ 3] = sb[ 6] = sb[ 7];
1756		✗	sb[ 8] = sb[ 9] = sb[12] = sb[13];
1757		✗	sb[10] = sb[11] = sb[14] = sb[15];
1758			}
1759		✗	c48_4to8(dst, sb, w);
1760		✗	break;
1761		✗	case 0xFC: // 4x copy 4x4 block, per-block c37_mv from source
1762		✗	if (bytestream2_get_bytes_left(gb) < 4)
1763		✗	return 1;
1764		✗	for (i = 0; i < 8; i += 4) {
1765		✗	for (k = 0; k < 8; k += 4) {
1766		✗	opc = bytestream2_get_byteu(gb);
1767		✗	mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w);
1768		✗	if (c48_invalid_mv(x+k, y+i, w, aligned_height, 4, mvofs))
1769		✗	continue;
1770		✗	for (j = 0; j < 4; j++) {
1771		✗	ofs = (w * (j + i)) + k;
1772		✗	for (l = 0; l < 4; l++)
1773		✗	*(dst + ofs + l) = *(db + ofs + l + mvofs);
1774			}
1775			}
1776			}
1777		✗	break;
1778		✗	case 0xFB: // Copy 4x 4x4 blocks, per-block mv from source
1779		✗	if (bytestream2_get_bytes_left(gb) < 8)
1780		✗	return 1;
1781		✗	for (i = 0; i < 8; i += 4) {
1782		✗	for (k = 0; k < 8; k += 4) {
1783		✗	mvofs = bytestream2_get_le16(gb);
1784		✗	if (c48_invalid_mv(x+k, y+i, w, aligned_height, 4, mvofs))
1785		✗	continue;
1786		✗	for (j = 0; j < 4; j++) {
1787		✗	ofs = (w * (j + i)) + k;
1788		✗	for (l = 0; l < 4; l++)
1789		✗	*(dst + ofs + l) = *(db + ofs + l + mvofs);
1790			}
1791			}
1792			}
1793		✗	break;
1794		✗	case 0xFA: // scale 4x4 input block to 8x8 dest block
1795		✗	if (bytestream2_get_bytes_left(gb) < 16)
1796		✗	return 1;
1797		✗	bytestream2_get_bufferu(gb, sb, 16);
1798		✗	c48_4to8(dst, sb, w);
1799		✗	break;
1800		✗	case 0xF9: // 16x 2x2 copy from delta, per-block c37_mv from source
1801		✗	if (bytestream2_get_bytes_left(gb) < 16)
1802		✗	return 1;
1803		✗	for (i = 0; i < 8; i += 2) {
1804		✗	for (j = 0; j < 8; j += 2) {
1805		✗	ofs = (w * i) + j;
1806		✗	opc = bytestream2_get_byteu(gb);
1807		✗	mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w);
1808		✗	if (c48_invalid_mv(x+j, y+i, w, aligned_height, 2, mvofs))
1809		✗	continue;
1810		✗	for (l = 0; l < 2; l++) {
1811		✗	*(dst + ofs + l + 0) = *(db + ofs + l + 0 + mvofs);
1812		✗	*(dst + ofs + l + w) = *(db + ofs + l + w + mvofs);
1813			}
1814			}
1815			}
1816		✗	break;
1817		✗	case 0xF8: // 16x 2x2 blocks copy, 16bit mv from source
1818		✗	if (bytestream2_get_bytes_left(gb) < 32)
1819		✗	return 1;
1820		✗	for (i = 0; i < 8; i += 2) {
1821		✗	for (j = 0; j < 8; j += 2) {
1822		✗	ofs = w * i + j;
1823		✗	mvofs = bytestream2_get_le16(gb);
1824		✗	if (c48_invalid_mv(x+j, y+i, w, aligned_height, 2, mvofs))
1825		✗	continue;
1826		✗	for (l = 0; l < 2; l++) {
1827		✗	*(dst + ofs + l + 0) = *(db + ofs + l + 0 + mvofs);
1828		✗	*(dst + ofs + l + w) = *(db + ofs + l + w + mvofs);
1829			}
1830			}
1831			}
1832		✗	break;
1833		✗	case 0xF7: // copy 8x8 block from src to dest
1834		✗	if (bytestream2_get_bytes_left(gb) < 64)
1835		✗	return 1;
1836		✗	for (i = 0; i < 8; i++) {
1837		✗	ofs = i * w;
1838		✗	for (l = 0; l < 8; l++)
1839		✗	*(dst + ofs + l) = bytestream2_get_byteu(gb);
1840			}
1841		✗	break;
1842		✗	default: // copy 8x8 block from prev, c37_mv from source
1843		✗	mvofs = c37_mv[opc * 2] + (c37_mv[opc * 2 + 1] * w);
1844		✗	if (c48_invalid_mv(x, y, w, aligned_height, 8, mvofs))
1845		✗	break;
1846		✗	for (i = 0; i < 8; i++) {
1847		✗	ofs = i * w;
1848		✗	for (l = 0; l < 8; l++)
1849		✗	*(dst + ofs + l) = *(db + ofs + l + mvofs);
1850			}
1851		✗	break;
1852			}
1853		✗	return 0;
1854			}
1855
1856		✗	static int old_codec48(SANMVideoContext *ctx, GetByteContext *gb, int top, int left,
1857			int width, int height)
1858			{
1859			uint8_t *dst, *prev;
1860			int i, j, flags, ah;
1861
1862		✗	width = FFALIGN(width, 8);
1863		✗	if (width > ctx->aligned_width)
1864		✗	return AVERROR_INVALIDDATA;
1865
1866		✗	ah = FFALIGN(height, 8);
1867		✗	if (ah > ctx->aligned_height)
1868		✗	return AVERROR_INVALIDDATA;
1869
1870		✗	if (bytestream2_get_bytes_left(gb) < 16)
1871		✗	return AVERROR_INVALIDDATA;
1872
1873		✗	int compr = bytestream2_get_byteu(gb);
1874		✗	int mvidx = bytestream2_get_byteu(gb);
1875		✗	int seq = bytestream2_get_le16u(gb);
1876		✗	uint32_t decoded_size = bytestream2_get_le32u(gb);
1877
1878			// all codec48 videos use 1, but just to be safe...
1879		✗	if (mvidx != 1) {
1880		✗	av_log(ctx->avctx, AV_LOG_ERROR, "Invalid motion base value %d.\n", mvidx);
1881		✗	return AVERROR_INVALIDDATA;
1882			}
1883
1884		✗	bytestream2_skip(gb, 4);
1885		✗	flags = bytestream2_get_byteu(gb);
1886		✗	bytestream2_skip(gb, 3);
1887
1888		✗	if (flags & 8) {
1889		✗	if (bytestream2_get_bytes_left(gb) < 0x8080)
1890		✗	return AVERROR_INVALIDDATA;
1891		✗	codec47_read_interptable(gb, ctx->c47itbl);
1892			}
1893
1894		✗	dst = (uint8_t*)ctx->frm0;
1895		✗	prev = (uint8_t*)ctx->frm2;
1896
1897		✗	if (seq == 0)
1898		✗	memset(ctx->frm2, 0, ctx->frm2_size);
1899
1900		✗	switch (compr) {
1901		✗	case 0:
1902		✗	if (bytestream2_get_bytes_left(gb) < width * height)
1903		✗	return AVERROR_INVALIDDATA;
1904		✗	bytestream2_get_bufferu(gb, dst, width * height);
1905		✗	break;
1906		✗	case 2:
1907		✗	if (decoded_size > width * height) {
1908		✗	av_log(ctx->avctx, AV_LOG_ERROR, "Decoded size %u is too large.\n", decoded_size);
1909		✗	decoded_size = width * height;
1910			}
1911
1912		✗	if (rle_decode(ctx, gb, dst, decoded_size))
1913		✗	return AVERROR_INVALIDDATA;
1914		✗	break;
1915		✗	case 3:
1916		✗	if ((seq == 0) || (seq == ctx->prev_seq + 1)) {
1917		✗	if ((seq & 1) || ((flags & 1) == 0) || (flags & 0x10)) {
1918		✗	FFSWAP(uint16_t*, ctx->frm0, ctx->frm2);
1919		✗	dst = (uint8_t*)ctx->frm0;
1920		✗	prev = (uint8_t*)ctx->frm2;
1921			}
1922		✗	for (j = 0; j < height; j += 8) {
1923		✗	for (i = 0; i < width; i += 8) {
1924		✗	if (codec48_block(gb, dst + i, prev + i, i, j, width,
1925		✗	ah, ctx->c47itbl))
1926		✗	return AVERROR_INVALIDDATA;
1927			}
1928		✗	dst += width * 8;
1929		✗	prev += width * 8;
1930			}
1931			}
1932		✗	break;
1933		✗	case 5:
1934		✗	if (bytestream2_get_bytes_left(gb) < ((width + 1) >> 1) * ((height + 1) >> 1))
1935		✗	return AVERROR_INVALIDDATA;
1936		✗	codec47_comp1(gb, dst, width, height, width, ctx->c47itbl);
1937		✗	break;
1938		✗	case 6: /* this is a "stub" frame that follows a frame with flag 0x10 set. */
1939		✗	break;
1940		✗	default:
1941		✗	avpriv_report_missing_feature(ctx->avctx,
1942			"Subcodec 48 compression %d", compr);
1943		✗	return AVERROR_PATCHWELCOME;
1944			}
1945
1946		✗	ctx->prev_seq = seq;
1947		✗	if ((flags & 2) == 0) {
1948		✗	if (flags & 0x10) {
1949			/* generate an artificial frame from the 2 buffers. This will be
1950			* followed up immediately with a codec48 compression 6 frame, which
1951			* will then blit the actual decoding result (frm0) to the main buffer.
1952			*/
1953		✗	blt_ipol((uint8_t*)ctx->fbuf, (uint8_t*)ctx->frm0, (uint8_t*)ctx->frm2,
1954		✗	left, top, 0, 0, width, height, width, ctx->pitch, ctx->height,
1955		✗	width * height, ctx->c47itbl);
1956		✗	return 0;
1957			}
1958		✗	blt_solid((uint8_t*)ctx->fbuf, (uint8_t*)ctx->frm0, left, top, 0, 0, width,
1959		✗	height, width, ctx->pitch, ctx->height, width * height);
1960			} else {
1961		✗	blt_mask((uint8_t*)ctx->fbuf, (uint8_t*)ctx->frm0, left, top, 0, 0, width,
1962		✗	height, width, ctx->pitch, ctx->height, width * height, 0);
1963			}
1964		✗	return 0;
1965			}
1966
1967		✗	static void old_codec45(SANMVideoContext *ctx, GetByteContext *gb, int top, int left, int flag)
1968			{
1969			int t1, t2, i;
1970
1971		✗	if (bytestream2_get_bytes_left(gb) < 6)
1972		✗	return;
1973
1974		✗	bytestream2_skip(gb, 2);
1975		✗	t1 = bytestream2_get_le16u(gb);
1976		✗	t2 = bytestream2_get_byteu(gb);
1977		✗	bytestream2_skip(gb, 1);
1978		✗	if (t2 != 1)
1979		✗	return;
1980		✗	if (t1 == 0) {
1981		✗	if (bytestream2_get_bytes_left(gb) < 0x300)
1982		✗	return;
1983		✗	bytestream2_get_bufferu(gb, ctx->c45tbl1, 0x300);
1984		✗	i = 0;
1985		✗	while ((bytestream2_get_bytes_left(gb) > 1) && (i < 0x8000)) {
1986		✗	uint8_t len = bytestream2_get_byteu(gb);
1987		✗	uint8_t val = bytestream2_get_byteu(gb);
1988		✗	if ((i + len) > 0x8000)
1989		✗	len = 0x8000 - i;
1990		✗	memset(ctx->c45tbl2 + i, val, len);
1991		✗	i += len;
1992			}
1993			}
1994
1995		✗	if (flag)
1996		✗	return;
1997
1998		✗	while (bytestream2_get_bytes_left(gb) > 3) {
1999		✗	left += (int16_t)bytestream2_get_le16u(gb);
2000		✗	top += bytestream2_get_byteu(gb);
2001		✗	int len = bytestream2_get_byteu(gb);
2002		✗	while (len >= 0) {
2003		✗	if ((left > 0) && (top > 0) && (left < (ctx->width - 1))) {
2004		✗	if (top >= (ctx->height - 1))
2005		✗	return;
2006
2007		✗	uint8_t *dst = (uint8_t *)ctx->fbuf + left + top * ctx->pitch;
2008		✗	unsigned int c1 = *(dst - 1) * 3;
2009		✗	unsigned int c2 = *(dst + 1) * 3;
2010		✗	unsigned int r = ctx->c45tbl1[c1 + 0] + ctx->c45tbl1[c2 + 0];
2011		✗	unsigned int g = ctx->c45tbl1[c1 + 1] + ctx->c45tbl1[c2 + 1];
2012		✗	unsigned int b = ctx->c45tbl1[c1 + 2] + ctx->c45tbl1[c2 + 2];
2013		✗	c1 = *(dst - ctx->pitch) * 3;
2014		✗	c2 = *(dst + ctx->pitch) * 3;
2015		✗	r += ctx->c45tbl1[c1 + 0] + ctx->c45tbl1[c2 + 0];
2016		✗	g += ctx->c45tbl1[c1 + 1] + ctx->c45tbl1[c2 + 1];
2017		✗	b += ctx->c45tbl1[c1 + 2] + ctx->c45tbl1[c2 + 2];
2018		✗	*dst = ctx->c45tbl2[((r << 5) & 0x7c00) | (g & 0x3e0) | (b >> 5)];
2019			}
2020		✗	left++;
2021		✗	len--;
2022			}
2023		✗	left--;
2024			}
2025			}
2026
2027		✗	static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb,
2028			int xoff, int yoff)
2029			{
2030			uint16_t w, h, parm2;
2031			uint8_t codec, param;
2032			int16_t left, top;
2033			int fsc;
2034
2035		✗	codec = bytestream2_get_byteu(gb);
2036		✗	param = bytestream2_get_byteu(gb);
2037		✗	left = bytestream2_get_le16u(gb);
2038		✗	top = bytestream2_get_le16u(gb);
2039		✗	w = bytestream2_get_le16u(gb);
2040		✗	h = bytestream2_get_le16u(gb);
2041		✗	bytestream2_skip(gb, 2);
2042		✗	parm2 = bytestream2_get_le16u(gb);
2043
2044		✗	if (w < 1 || h < 1 || w > 640 || h > 480 || left > 640 || top > 480 || left + w <= 0 || top + h <= 0) {
2045			/* codec45 frames with data for the 2 tables have nonsensical dimensions */
2046		✗	if (codec == 45) {
2047		✗	old_codec45(ctx, gb, 0, 0, 1);
2048		✗	return 0;
2049			}
2050
2051		✗	av_log(ctx->avctx, AV_LOG_WARNING,
2052			"ignoring invalid fobj dimensions: c%d %d %d @ %d %d\n",
2053			codec, w, h, left, top);
2054		✗	return 0;
2055			}
2056
2057			/* codecs with their own buffers */
2058		✗	fsc = (codec == 37 || codec == 47 || codec == 48);
2059
2060			/* special case for "Shadows of the Empire" videos: they have top=60
2061			* at all frames to vertically center the video in the 640x480 game
2062			* window, but we don't need that.
2063			*/
2064		✗	if ((w == 640) && (h == 272) && (top == 60) && (codec == 47))
2065		✗	left = top = 0;
2066
2067		✗	if (!ctx->have_dimensions && (codec != 45)) {
2068			int xres, yres;
2069		✗	if (ctx->subversion < 2) {
2070			/* Rebel Assault 1: 384x242 internal size */
2071		✗	xres = 384;
2072		✗	yres = 242;
2073		✗	if (w > xres || h > yres)
2074		✗	return AVERROR_INVALIDDATA;
2075		✗	ctx->have_dimensions = 1;
2076			} else {
2077			/* detect common sizes */
2078		✗	xres = w + left;
2079		✗	yres = h + top;
2080		✗	if (((xres == 424) && (yres == 260)) || /* RA2 */
2081		✗	((xres == 320) && (yres == 200)) || /* FT/Dig */
2082		✗	((xres == 640) && (yres == 272)) || /* SotE */
2083		✗	((xres == 640) && (yres == 350)) || /* MotS */
2084		✗	((xres == 640) && (yres == 480))) {
2085		✗	ctx->have_dimensions = 1;
2086			}
2087
2088		✗	xres = FFMAX(xres, ctx->width);
2089		✗	yres = FFMAX(yres, ctx->height);
2090			}
2091
2092		✗	if ((xres < (fsc ? 8 : 1)) || (yres < (fsc ? 8 : 1)) || (xres > 640) || (yres > 480))
2093		✗	return AVERROR_INVALIDDATA;
2094
2095		✗	if (ctx->width < xres || ctx->height < yres) {
2096		✗	int ret = ff_set_dimensions(ctx->avctx, xres, yres);
2097		✗	if (ret < 0)
2098		✗	return ret;
2099		✗	init_sizes(ctx, xres, yres);
2100		✗	if (init_buffers(ctx)) {
2101		✗	av_log(ctx->avctx, AV_LOG_ERROR, "Error resizing buffers.\n");
2102		✗	return AVERROR(ENOMEM);
2103			}
2104			}
2105			} else {
2106			/* for codec37/47/48, return error for frames larger than the canvas, it's also
2107			* what the DOS engines do.
2108			*/
2109		✗	if (((w > ctx->width) || (h > ctx->height) || (w * h > ctx->buf_size)) && fsc)
2110		✗	return AVERROR_INVALIDDATA;
2111			}
2112
2113			/* users of codecs>=37 are subversion 2, enforce that for STOR/FTCH */
2114		✗	if (fsc && ctx->subversion < 2) {
2115		✗	ctx->subversion = 2;
2116		✗	ctx->stor_size = 0; /* invalidate existing data */
2117			}
2118
2119			/* clear the main buffer on the first fob */
2120		✗	if (ctx->first_fob) {
2121		✗	ctx->first_fob = 0;
2122		✗	if (!fsc)
2123		✗	memset(ctx->fbuf, 0, ctx->frm0_size);
2124			}
2125
2126		✗	left += xoff;
2127		✗	top += yoff;
2128
2129		✗	switch (codec) {
2130		✗	case 1:
2131			case 3:
2132		✗	return old_codec1(ctx, gb, top, left, w, h, codec == 3);
2133		✗	case 2:
2134		✗	return old_codec2(ctx, gb, top, left, w, h);
2135		✗	case 4:
2136			case 5:
2137			case 33:
2138			case 34:
2139		✗	return old_codec4(ctx, gb, top, left, w, h, param, parm2, codec);
2140		✗	case 20:
2141		✗	return old_codec20(ctx, gb, top, left, w, h);
2142		✗	case 21:
2143		✗	return old_codec21(ctx, gb, top, left, w, h);
2144		✗	case 23:
2145		✗	return old_codec23(ctx, gb, top, left, w, h, param, parm2);
2146		✗	case 31:
2147			case 32:
2148		✗	return old_codec31(ctx, gb, top, left, w, h, param, (codec == 32));
2149		✗	case 37:
2150		✗	return old_codec37(ctx, gb, top, left, w, h); break;
2151		✗	case 45:
2152		✗	old_codec45(ctx, gb, top, left, 0); break;
2153		✗	case 47:
2154		✗	return old_codec47(ctx, gb, top, left, w, h); break;
2155		✗	case 48:
2156		✗	return old_codec48(ctx, gb, top, left, w, h); break;
2157		✗	default:
2158		✗	avpriv_request_sample(ctx->avctx, "Subcodec %d", codec);
2159		✗	ctx->frame->flags |= AV_FRAME_FLAG_CORRUPT;
2160		✗	break;
2161			}
2162		✗	return 0;
2163			}
2164
2165		✗	static int process_ftch(SANMVideoContext *ctx, int size)
2166			{
2167			int xoff, yoff, ret;
2168			GetByteContext gb;
2169
2170			/* FTCH defines additional x/y offsets */
2171		✗	if (size == 6) {
2172		✗	bytestream2_skip(&ctx->gb, 2);
2173		✗	xoff = bytestream2_get_le16u(&ctx->gb);
2174		✗	yoff = bytestream2_get_le16u(&ctx->gb);
2175		✗	} else if (size == 12) {
2176		✗	av_assert0(bytestream2_get_bytes_left(&ctx->gb) >= 12);
2177		✗	bytestream2_skip(&ctx->gb, 4);
2178		✗	xoff = bytestream2_get_be32u(&ctx->gb);
2179		✗	yoff = bytestream2_get_be32u(&ctx->gb);
2180			} else
2181		✗	return 1;
2182
2183		✗	if (ctx->stor_size > 0) {
2184			/* decode the stored FOBJ */
2185		✗	uint8_t *bitstream = av_malloc(ctx->stor_size + AV_INPUT_BUFFER_PADDING_SIZE);
2186		✗	if (!bitstream)
2187		✗	return AVERROR(ENOMEM);
2188		✗	memcpy(bitstream, ctx->stored_frame, ctx->stor_size);
2189		✗	bytestream2_init(&gb, bitstream, ctx->stor_size);
2190		✗	ret = process_frame_obj(ctx, &gb, xoff, yoff);
2191		✗	av_free(bitstream);
2192			} else {
2193			/* this happens a lot in RA1: The individual files are meant to
2194			* be played in sequence, with some referencing objects STORed
2195			* by previous files, e.g. the cockpit codec21 object in RA1 LVL8.
2196			* But spamming the log with errors is also not helpful, so
2197			* here we simply ignore this case. Return 1 to indicate that
2198			* there was no valid image fetched.
2199			*/
2200		✗	ret = 1;
2201			}
2202		✗	return ret;
2203			}
2204
2205		✗	static int process_xpal(SANMVideoContext *ctx, int size)
2206			{
2207		✗	int16_t *dp = ctx->delta_pal;
2208		✗	uint32_t *pal = ctx->pal;
2209			uint16_t cmd;
2210			uint8_t c[3];
2211			int i, j;
2212
2213		✗	if (size < 4)
2214		✗	return AVERROR_INVALIDDATA;
2215		✗	bytestream2_skip(&ctx->gb, 2);
2216		✗	cmd = bytestream2_get_be16(&ctx->gb);
2217		✗	size -= 4;
2218
2219		✗	if (cmd == 1) {
2220		✗	for (i = 0; i < PALETTE_DELTA; i += 3) {
2221		✗	for (j = 0; j < 3; j++) {
2222		✗	ctx->shift_pal[i + j] += dp[i + j];
2223		✗	c[j] = av_clip_uint8(ctx->shift_pal[i + j] >> 7) & 0xFFU;
2224			}
2225		✗	*pal++ = 0xFFU << 24 | c[0] << 16 | c[1] << 8 | c[2];
2226			}
2227		✗	} else if (cmd == 0 || cmd == 2) {
2228		✗	if (size < PALETTE_DELTA * 2) {
2229		✗	av_log(ctx->avctx, AV_LOG_ERROR,
2230			"Incorrect palette change block size %"PRIu32".\n", size);
2231		✗	return AVERROR_INVALIDDATA;
2232			}
2233		✗	for (i = 0; i < PALETTE_DELTA; i++)
2234		✗	dp[i] = bytestream2_get_le16u(&ctx->gb);
2235		✗	size -= PALETTE_DELTA * 2;
2236
2237		✗	if (size >= PALETTE_SIZE * 3) {
2238		✗	for (i = 0; i < PALETTE_SIZE; i++)
2239		✗	ctx->pal[i] = 0xFFU << 24 | bytestream2_get_be24u(&ctx->gb);
2240		✗	if (ctx->subversion < 2)
2241		✗	ctx->pal[0] = 0xFFU << 24;
2242			}
2243		✗	for (i = 0, j = 0; i < PALETTE_DELTA; i += 3, j++) {
2244		✗	ctx->shift_pal[i + 0] = (((ctx->pal[j]) >> 16) & 0xFFU) << 7;
2245		✗	ctx->shift_pal[i + 1] = (((ctx->pal[j]) >> 8) & 0xFFU) << 7;
2246		✗	ctx->shift_pal[i + 2] = (((ctx->pal[j]) >> 0) & 0xFFU) << 7;
2247			}
2248			}
2249		✗	return 0;
2250			}
2251
2252		✗	static int bl16_decode_0(SANMVideoContext *ctx)
2253			{
2254		✗	uint16_t *frm = ctx->frm0;
2255			int x, y;
2256
2257		✗	if (bytestream2_get_bytes_left(&ctx->gb) < ctx->width * ctx->height * 2) {
2258		✗	av_log(ctx->avctx, AV_LOG_ERROR, "Insufficient data for raw frame.\n");
2259		✗	return AVERROR_INVALIDDATA;
2260			}
2261		✗	for (y = 0; y < ctx->height; y++) {
2262		✗	for (x = 0; x < ctx->width; x++)
2263		✗	frm[x] = bytestream2_get_le16u(&ctx->gb);
2264		✗	frm += ctx->pitch;
2265			}
2266		✗	return 0;
2267			}
2268
2269			/* BL16 pixel interpolation function, see tgsmush.dll c690 */
2270		✗	static inline uint16_t bl16_c1_avg_col(uint16_t c1, uint16_t c2)
2271			{
2272		✗	return (((c2 & 0x07e0) + (c1 & 0x07e0)) & 0x00fc0) |
2273		✗	(((c2 & 0xf800) + (c1 & 0xf800)) & 0x1f000) |
2274		✗	(((c2 & 0x001f) + (c1 & 0x001f))) >> 1;
2275			}
2276
2277			/* Quarter-sized keyframe encoded as stream of 16bit pixel values. Interpolate
2278			* missing pixels by averaging the colors of immediate neighbours.
2279			* Identical to codec47_comp1() but with 16bit-pixels. tgsmush.dll c6f0
2280			*/
2281		✗	static int bl16_decode_1(SANMVideoContext *ctx)
2282			{
2283			uint16_t hh, hw, hw1, c1, c2, *dst1, *dst2;
2284
2285		✗	hh = (ctx->height + 1) >> 1;
2286		✗	hw1 = (ctx->width - 1) >> 1;
2287		✗	if (!hw1 || (bytestream2_get_bytes_left(&ctx->gb) < (hh * hw1 * 2)))
2288		✗	return AVERROR_INVALIDDATA;
2289		✗	dst1 = (uint16_t *)ctx->frm0 + ctx->pitch; /* start with line 1 */
2290		✗	while (hh--) {
2291		✗	hw = hw1;
2292		✗	c1 = bytestream2_get_le16u(&ctx->gb);
2293		✗	dst1[0] = c1;
2294		✗	dst1[1] = c1;
2295		✗	dst2 = dst1 + 2;
2296		✗	while (--hw) {
2297		✗	c2 = bytestream2_get_le16u(&ctx->gb);
2298		✗	*dst2++ = bl16_c1_avg_col(c1, c2);
2299		✗	*dst2++ = c2;
2300		✗	c1 = c2;
2301			}
2302		✗	dst1 += ctx->pitch * 2; /* skip to overnext line */
2303			}
2304			/* line 0 is a copy of line 1 */
2305		✗	memcpy(ctx->frm0, ctx->frm0 + ctx->pitch, ctx->pitch);
2306
2307			/* complete the skipped lines by averaging from the pixels in the lines
2308			* above and below
2309			*/
2310		✗	dst1 = ctx->frm0 + (ctx->pitch * 2);
2311		✗	hh = (ctx->height - 1) >> 1;
2312		✗	while (hh--) {
2313		✗	hw = ctx->width;
2314		✗	dst2 = dst1;
2315		✗	while (hw--) {
2316		✗	c1 = *(dst2 - ctx->pitch); /* pixel from line above */
2317		✗	c2 = *(dst2 + ctx->pitch); /* pixel from line below */
2318		✗	*dst2++ = bl16_c1_avg_col(c1, c2);
2319			}
2320		✗	dst1 += ctx->pitch * 2;
2321			}
2322		✗	return 0;
2323			}
2324
2325		42964	static void copy_block(uint16_t *pdest, uint16_t *psrc, int block_size, ptrdiff_t pitch)
2326			{
2327		42964	uint8_t *dst = (uint8_t *)pdest;
2328		42964	uint8_t *src = (uint8_t *)psrc;
2329		42964	ptrdiff_t stride = pitch * 2;
2330
2331	3/4 ✓ Branch 0 taken 14526 times. ✓ Branch 1 taken 12400 times. ✓ Branch 2 taken 16038 times. ✗ Branch 3 not taken.	42964	switch (block_size) {
2332		14526	case 2:
2333		14526	copy_block4(dst, src, stride, stride, 2);
2334		14526	break;
2335		12400	case 4:
2336		12400	copy_block8(dst, src, stride, stride, 4);
2337		12400	break;
2338		16038	case 8:
2339		16038	copy_block16(dst, src, stride, stride, 8);
2340		16038	break;
2341			}
2342		42964	}
2343
2344		7913	static void fill_block(uint16_t *pdest, uint16_t color, int block_size, ptrdiff_t pitch)
2345			{
2346			int x, y;
2347
2348		7913	pitch -= block_size;
2349	2/2 ✓ Branch 0 taken 30438 times. ✓ Branch 1 taken 7913 times.	38351	for (y = 0; y < block_size; y++, pdest += pitch)
2350	2/2 ✓ Branch 0 taken 149540 times. ✓ Branch 1 taken 30438 times.	179978	for (x = 0; x < block_size; x++)
2351		149540	*pdest++ = color;
2352		7913	}
2353
2354		8368	static int draw_glyph(SANMVideoContext *ctx, uint16_t *dst, int index,
2355			uint16_t fg_color, uint16_t bg_color, int block_size,
2356			ptrdiff_t pitch)
2357			{
2358			int8_t *pglyph;
2359		8368	uint16_t colors[2] = { fg_color, bg_color };
2360			int x, y;
2361
2362	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 8368 times.	8368	if (index >= NGLYPHS) {
2363		✗	av_log(ctx->avctx, AV_LOG_ERROR, "Ignoring nonexistent glyph #%u.\n", index);
2364		✗	return AVERROR_INVALIDDATA;
2365			}
2366
2367	2/2 ✓ Branch 0 taken 1158 times. ✓ Branch 1 taken 7210 times.	8368	pglyph = block_size == 8 ? ctx->p8x8glyphs[index] : ctx->p4x4glyphs[index];
2368		8368	pitch -= block_size;
2369
2370	2/2 ✓ Branch 0 taken 38104 times. ✓ Branch 1 taken 8368 times.	46472	for (y = 0; y < block_size; y++, dst += pitch)
2371	2/2 ✓ Branch 0 taken 189472 times. ✓ Branch 1 taken 38104 times.	227576	for (x = 0; x < block_size; x++)
2372		189472	*dst++ = colors[*pglyph++];
2373		8368	return 0;
2374			}
2375
2376		8029	static int opcode_0xf7(SANMVideoContext *ctx, int cx, int cy, int block_size, ptrdiff_t pitch)
2377			{
2378		8029	uint16_t *dst = ctx->frm0 + cx + cy * ctx->pitch;
2379
2380	2/2 ✓ Branch 0 taken 825 times. ✓ Branch 1 taken 7204 times.	8029	if (block_size == 2) {
2381			uint32_t indices;
2382
2383	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 825 times.	825	if (bytestream2_get_bytes_left(&ctx->gb) < 4)
2384		✗	return AVERROR_INVALIDDATA;
2385
2386		825	indices = bytestream2_get_le32u(&ctx->gb);
2387		825	dst[0] = ctx->codebook[indices & 0xFF];
2388		825	indices >>= 8;
2389		825	dst[1] = ctx->codebook[indices & 0xFF];
2390		825	indices >>= 8;
2391		825	dst[pitch] = ctx->codebook[indices & 0xFF];
2392		825	indices >>= 8;
2393		825	dst[pitch + 1] = ctx->codebook[indices & 0xFF];
2394			} else {
2395			uint16_t fgcolor, bgcolor;
2396			int glyph;
2397
2398	2/2 ✓ Branch 1 taken 1 times. ✓ Branch 2 taken 7203 times.	7204	if (bytestream2_get_bytes_left(&ctx->gb) < 3)
2399		1	return AVERROR_INVALIDDATA;
2400
2401		7203	glyph = bytestream2_get_byteu(&ctx->gb);
2402		7203	bgcolor = ctx->codebook[bytestream2_get_byteu(&ctx->gb)];
2403		7203	fgcolor = ctx->codebook[bytestream2_get_byteu(&ctx->gb)];
2404
2405		7203	draw_glyph(ctx, dst, glyph, fgcolor, bgcolor, block_size, pitch);
2406			}
2407		8028	return 0;
2408			}
2409
2410		1169	static int opcode_0xf8(SANMVideoContext *ctx, int cx, int cy, int block_size, ptrdiff_t pitch)
2411			{
2412		1169	uint16_t *dst = ctx->frm0 + cx + cy * ctx->pitch;
2413
2414	2/2 ✓ Branch 0 taken 4 times. ✓ Branch 1 taken 1165 times.	1169	if (block_size == 2) {
2415	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 4 times.	4	if (bytestream2_get_bytes_left(&ctx->gb) < 8)
2416		✗	return AVERROR_INVALIDDATA;
2417
2418		4	dst[0] = bytestream2_get_le16u(&ctx->gb);
2419		4	dst[1] = bytestream2_get_le16u(&ctx->gb);
2420		4	dst[pitch] = bytestream2_get_le16u(&ctx->gb);
2421		4	dst[pitch + 1] = bytestream2_get_le16u(&ctx->gb);
2422			} else {
2423			uint16_t fgcolor, bgcolor;
2424			int glyph;
2425
2426	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 1165 times.	1165	if (bytestream2_get_bytes_left(&ctx->gb) < 5)
2427		✗	return AVERROR_INVALIDDATA;
2428
2429		1165	glyph = bytestream2_get_byteu(&ctx->gb);
2430		1165	bgcolor = bytestream2_get_le16u(&ctx->gb);
2431		1165	fgcolor = bytestream2_get_le16u(&ctx->gb);
2432
2433		1165	draw_glyph(ctx, dst, glyph, fgcolor, bgcolor, block_size, pitch);
2434			}
2435		1169	return 0;
2436			}
2437
2438		30376	static int good_mvec(SANMVideoContext *ctx, int cx, int cy, int mx, int my,
2439			int block_size)
2440			{
2441		30376	int start_pos = cx + mx + (cy + my) * ctx->pitch;
2442		30376	int end_pos = start_pos + (block_size - 1) * (ctx->pitch + 1);
2443
2444	2/4 ✓ Branch 0 taken 30376 times. ✗ Branch 1 not taken. ✓ Branch 2 taken 30376 times. ✗ Branch 3 not taken.	30376	int good = start_pos >= 0 && end_pos < (ctx->buf_size >> 1);
2445
2446	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 30376 times.	30376	if (!good)
2447		✗	av_log(ctx->avctx, AV_LOG_ERROR,
2448			"Ignoring invalid motion vector (%i, %i)->(%u, %u), block size = %u\n",
2449			cx + mx, cy + my, cx, cy, block_size);
2450
2451		30376	return good;
2452			}
2453
2454		71636	static int bl16_block(SANMVideoContext *ctx, int cx, int cy, int blk_size)
2455			{
2456			int16_t mx, my, index;
2457			int opcode;
2458
2459	2/2 ✓ Branch 1 taken 1 times. ✓ Branch 2 taken 71635 times.	71636	if (bytestream2_get_bytes_left(&ctx->gb) < 1)
2460		1	return AVERROR_INVALIDDATA;
2461
2462		71635	opcode = bytestream2_get_byteu(&ctx->gb);
2463
2464	9/9 ✓ Branch 0 taken 28212 times. ✓ Branch 1 taken 2164 times. ✓ Branch 2 taken 12588 times. ✓ Branch 3 taken 8029 times. ✓ Branch 4 taken 1169 times. ✓ Branch 5 taken 315 times. ✓ Branch 6 taken 5496 times. ✓ Branch 7 taken 2102 times. ✓ Branch 8 taken 11560 times.	71635	switch (opcode) {
2465		28212	default:
2466		28212	mx = c47_mv[opcode][0];
2467		28212	my = c47_mv[opcode][1];
2468
2469			/* The original implementation of this codec precomputes a table
2470			* of int16_t of all motion vectors a for given image width.
2471			* For widths starting at 762 pixels, the calculation of
2472			* mv table indices 1+ and 255- overflow the int16_t, inverting the
2473			* sign of the offset. This is actively exploited in e.g. the
2474			* "jonesopn_8.snm" video of "Indiana Jones and the Infernal Machine".
2475			* Therefore let the overflow happen and extract x/y components from
2476			* the new value.
2477			*/
2478	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 28212 times.	28212	if (ctx->width > 761) {
2479		✗	index = (int16_t)(my * ctx->width + mx);
2480		✗	mx = index % ctx->width;
2481		✗	my = index / ctx->width;
2482			}
2483	1/2 ✓ Branch 1 taken 28212 times. ✗ Branch 2 not taken.	28212	if (good_mvec(ctx, cx, cy, mx, my, blk_size)) {
2484		28212	copy_block(ctx->frm0 + cx + ctx->pitch * cy,
2485		28212	ctx->frm2 + cx + mx + ctx->pitch * (cy + my),
2486			blk_size, ctx->pitch);
2487			}
2488		28212	break;
2489		2164	case 0xF5:
2490	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 2164 times.	2164	if (bytestream2_get_bytes_left(&ctx->gb) < 2)
2491		✗	return AVERROR_INVALIDDATA;
2492		2164	index = bytestream2_get_le16u(&ctx->gb);
2493
2494		2164	mx = index % ctx->width;
2495		2164	my = index / ctx->width;
2496
2497	1/2 ✓ Branch 1 taken 2164 times. ✗ Branch 2 not taken.	2164	if (good_mvec(ctx, cx, cy, mx, my, blk_size)) {
2498		2164	copy_block(ctx->frm0 + cx + ctx->pitch * cy,
2499		2164	ctx->frm2 + cx + mx + ctx->pitch * (cy + my),
2500			blk_size, ctx->pitch);
2501			}
2502		2164	break;
2503		12588	case 0xF6:
2504		12588	copy_block(ctx->frm0 + cx + ctx->pitch * cy,
2505		12588	ctx->frm1 + cx + ctx->pitch * cy,
2506			blk_size, ctx->pitch);
2507		12588	break;
2508		8029	case 0xF7:
2509		8029	opcode_0xf7(ctx, cx, cy, blk_size, ctx->pitch);
2510		8029	break;
2511
2512		1169	case 0xF8:
2513		1169	opcode_0xf8(ctx, cx, cy, blk_size, ctx->pitch);
2514		1169	break;
2515		315	case 0xF9:
2516			case 0xFA:
2517			case 0xFB:
2518			case 0xFC:
2519		315	fill_block(ctx->frm0 + cx + cy * ctx->pitch,
2520		315	ctx->small_codebook[opcode - 0xf9], blk_size, ctx->pitch);
2521		315	break;
2522		5496	case 0xFD:
2523	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 5496 times.	5496	if (bytestream2_get_bytes_left(&ctx->gb) < 1)
2524		✗	return AVERROR_INVALIDDATA;
2525		10992	fill_block(ctx->frm0 + cx + cy * ctx->pitch,
2526		5496	ctx->codebook[bytestream2_get_byteu(&ctx->gb)], blk_size, ctx->pitch);
2527		5496	break;
2528		2102	case 0xFE:
2529	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 2102 times.	2102	if (bytestream2_get_bytes_left(&ctx->gb) < 2)
2530		✗	return AVERROR_INVALIDDATA;
2531		2102	fill_block(ctx->frm0 + cx + cy * ctx->pitch,
2532		2102	bytestream2_get_le16u(&ctx->gb), blk_size, ctx->pitch);
2533		2102	break;
2534		11560	case 0xFF:
2535	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 11560 times.	11560	if (blk_size == 2) {
2536		✗	opcode_0xf8(ctx, cx, cy, blk_size, ctx->pitch);
2537			} else {
2538		11560	blk_size >>= 1;
2539	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 11560 times.	11560	if (bl16_block(ctx, cx, cy, blk_size))
2540		✗	return AVERROR_INVALIDDATA;
2541	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 11560 times.	11560	if (bl16_block(ctx, cx + blk_size, cy, blk_size))
2542		✗	return AVERROR_INVALIDDATA;
2543	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 11560 times.	11560	if (bl16_block(ctx, cx, cy + blk_size, blk_size))
2544		✗	return AVERROR_INVALIDDATA;
2545	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 11560 times.	11560	if (bl16_block(ctx, cx + blk_size, cy + blk_size, blk_size))
2546		✗	return AVERROR_INVALIDDATA;
2547			}
2548		11560	break;
2549			}
2550		71635	return 0;
2551			}
2552
2553		6	static int bl16_decode_2(SANMVideoContext *ctx)
2554			{
2555			int cx, cy, ret;
2556
2557	2/2 ✓ Branch 0 taken 318 times. ✓ Branch 1 taken 5 times.	323	for (cy = 0; cy < ctx->aligned_height; cy += 8)
2558	2/2 ✓ Branch 0 taken 25396 times. ✓ Branch 1 taken 317 times.	25713	for (cx = 0; cx < ctx->aligned_width; cx += 8)
2559	2/2 ✓ Branch 1 taken 1 times. ✓ Branch 2 taken 25395 times.	25396	if (ret = bl16_block(ctx, cx, cy, 8))
2560		1	return ret;
2561
2562		5	return 0;
2563			}
2564
2565		1	static int bl16_decode_5(SANMVideoContext *ctx, int rle_size)
2566			{
2567			#if HAVE_BIGENDIAN
2568			uint16_t *frm;
2569			int npixels;
2570			#endif
2571		1	uint8_t *dst = (uint8_t*)ctx->frm0;
2572
2573	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 1 times.	1	if (rle_decode(ctx, &ctx->gb, dst, rle_size))
2574		✗	return AVERROR_INVALIDDATA;
2575
2576			#if HAVE_BIGENDIAN
2577			npixels = ctx->npixels;
2578			frm = ctx->frm0;
2579			while (npixels--) {
2580			*frm = av_bswap16(*frm);
2581			frm++;
2582			}
2583			#endif
2584
2585		1	return 0;
2586			}
2587
2588		✗	static int bl16_decode_6(SANMVideoContext *ctx)
2589			{
2590		✗	int npixels = ctx->npixels;
2591		✗	uint16_t *frm = ctx->frm0;
2592
2593		✗	if (bytestream2_get_bytes_left(&ctx->gb) < npixels) {
2594		✗	av_log(ctx->avctx, AV_LOG_ERROR, "Insufficient data for frame.\n");
2595		✗	return AVERROR_INVALIDDATA;
2596			}
2597		✗	while (npixels--)
2598		✗	*frm++ = ctx->codebook[bytestream2_get_byteu(&ctx->gb)];
2599
2600		✗	return 0;
2601			}
2602
2603			/* Quarter-sized keyframe encoded as stream of codebook indices. Interpolate
2604			* missing pixels by averaging the colors of immediate neighbours.
2605			* Identical to codec47_comp1(), but without the interpolation table.
2606			* tgsmush.dll c6f0
2607			*/
2608		✗	static int bl16_decode_7(SANMVideoContext *ctx)
2609			{
2610			uint16_t hh, hw, hw1, c1, c2, *dst1, *dst2;
2611
2612		✗	hh = (ctx->height + 1) >> 1;
2613		✗	hw1 = (ctx->width - 1) >> 1;
2614		✗	if (!hw1 || (bytestream2_get_bytes_left(&ctx->gb) < (hh * hw1)))
2615		✗	return AVERROR_INVALIDDATA;
2616		✗	dst1 = (uint16_t *)ctx->frm0 + ctx->pitch; /* start with line 1 */
2617		✗	while (hh--) {
2618		✗	hw = hw1;
2619		✗	c1 = ctx->codebook[bytestream2_get_byteu(&ctx->gb)];
2620		✗	dst1[0] = c1; /* leftmost 2 pixels of a row are identical */
2621		✗	dst1[1] = c1;
2622		✗	dst2 = dst1 + 2;
2623		✗	while (--hw) {
2624		✗	c2 = ctx->codebook[bytestream2_get_byteu(&ctx->gb)];
2625		✗	*dst2++ = bl16_c1_avg_col(c1, c2);
2626		✗	*dst2++ = c2;
2627		✗	c1 = c2;
2628			}
2629		✗	dst1 += ctx->pitch * 2; /* skip to overnext line */
2630			}
2631			/* line 0 is a copy of line 1 */
2632		✗	memcpy(ctx->frm0, ctx->frm0 + ctx->pitch, ctx->pitch);
2633
2634			/* complete the skipped lines by averaging from the pixels in the lines
2635			* above and below.
2636			*/
2637		✗	dst1 = ctx->frm0 + (ctx->pitch * 2);
2638		✗	hh = (ctx->height - 1) >> 1;
2639		✗	while (hh--) {
2640		✗	hw = ctx->width;
2641		✗	dst2 = dst1;
2642		✗	while (hw--) {
2643		✗	c1 = *(dst2 - ctx->pitch); /* pixel from line above */
2644		✗	c2 = *(dst2 + ctx->pitch); /* pixel from line below */
2645		✗	*dst2++ = bl16_c1_avg_col(c1, c2);
2646			}
2647		✗	dst1 += ctx->pitch * 2;
2648			}
2649		✗	return 0;
2650			}
2651
2652		✗	static int bl16_decode_8(SANMVideoContext *ctx)
2653			{
2654		✗	uint16_t *pdest = ctx->frm0;
2655			uint8_t *rsrc;
2656		✗	long npixels = ctx->npixels;
2657
2658		✗	av_fast_malloc(&ctx->rle_buf, &ctx->rle_buf_size, npixels);
2659		✗	if (!ctx->rle_buf) {
2660		✗	av_log(ctx->avctx, AV_LOG_ERROR, "RLE buffer allocation failed.\n");
2661		✗	return AVERROR(ENOMEM);
2662			}
2663		✗	rsrc = ctx->rle_buf;
2664
2665		✗	if (rle_decode(ctx, &ctx->gb, rsrc, npixels))
2666		✗	return AVERROR_INVALIDDATA;
2667
2668		✗	while (npixels--)
2669		✗	*pdest++ = ctx->codebook[*rsrc++];
2670
2671		✗	return 0;
2672			}
2673
2674		2	static void fill_frame(uint16_t *pbuf, int buf_size, uint16_t color)
2675			{
2676	1/2 ✓ Branch 0 taken 2 times. ✗ Branch 1 not taken.	2	if (buf_size--) {
2677		2	*pbuf++ = color;
2678		2	av_memcpy_backptr((uint8_t*)pbuf, 2, 2*buf_size);
2679			}
2680		2	}
2681
2682		15	static int copy_output(SANMVideoContext *ctx, int sanm)
2683			{
2684			uint8_t *dst;
2685	1/2 ✓ Branch 0 taken 15 times. ✗ Branch 1 not taken.	15	const uint8_t *src = sanm ? (uint8_t *)ctx->frm0 : (uint8_t *)ctx->fbuf;
2686		15	int ret, height = ctx->height;
2687	1/2 ✓ Branch 0 taken 15 times. ✗ Branch 1 not taken.	15	ptrdiff_t dstpitch, srcpitch = ctx->pitch * (sanm ? sizeof(ctx->frm0[0]) : 1);
2688
2689	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 15 times.	15	if ((ret = ff_get_buffer(ctx->avctx, ctx->frame, 0)) < 0)
2690		✗	return ret;
2691
2692		15	dst = ctx->frame->data[0];
2693		15	dstpitch = ctx->frame->linesize[0];
2694
2695	2/2 ✓ Branch 0 taken 7200 times. ✓ Branch 1 taken 15 times.	7215	while (height--) {
2696		7200	memcpy(dst, src, srcpitch);
2697		7200	src += srcpitch;
2698		7200	dst += dstpitch;
2699			}
2700
2701		15	return 0;
2702			}
2703
2704		16	static int decode_bl16(AVCodecContext *avctx,int *got_frame_ptr)
2705			{
2706		16	SANMVideoContext *ctx = avctx->priv_data;
2707			int i, ret, w, h, seq_num, codec, bg_color, rle_output_size, rcode;
2708
2709	1/2 ✗ Branch 1 not taken. ✓ Branch 2 taken 16 times.	16	if ((ret = bytestream2_get_bytes_left(&ctx->gb)) < 560) {
2710		✗	av_log(ctx->avctx, AV_LOG_ERROR, "Input frame too short (%d bytes).\n",
2711			ret);
2712		✗	return AVERROR_INVALIDDATA;
2713			}
2714		16	bytestream2_skip(&ctx->gb, 8); // skip pad
2715
2716		16	w = bytestream2_get_le32u(&ctx->gb);
2717		16	h = bytestream2_get_le32u(&ctx->gb);
2718
2719	2/4 ✓ Branch 0 taken 16 times. ✗ Branch 1 not taken. ✗ Branch 2 not taken. ✓ Branch 3 taken 16 times.	16	if (w != ctx->width || h != ctx->height) {
2720		✗	avpriv_report_missing_feature(ctx->avctx, "Variable size frames");
2721		✗	return AVERROR_PATCHWELCOME;
2722			}
2723
2724		16	seq_num = bytestream2_get_le16u(&ctx->gb);
2725		16	codec = bytestream2_get_byteu(&ctx->gb);
2726		16	rcode = bytestream2_get_byteu(&ctx->gb);
2727
2728		16	bytestream2_skip(&ctx->gb, 4); // skip pad
2729
2730	2/2 ✓ Branch 0 taken 64 times. ✓ Branch 1 taken 16 times.	80	for (i = 0; i < 4; i++)
2731		64	ctx->small_codebook[i] = bytestream2_get_le16u(&ctx->gb);
2732		16	bg_color = bytestream2_get_le16u(&ctx->gb);
2733
2734		16	bytestream2_skip(&ctx->gb, 2); // skip pad
2735
2736		16	rle_output_size = bytestream2_get_le32u(&ctx->gb);
2737	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 16 times.	16	if (rle_output_size > w * ctx->aligned_height * 2) {
2738		✗	av_log(avctx, AV_LOG_WARNING, "bl16 rle size too large, truncated: %d\n",
2739			rle_output_size);
2740		✗	rle_output_size = w * ctx->aligned_height * 2;
2741			}
2742
2743	2/2 ✓ Branch 0 taken 4096 times. ✓ Branch 1 taken 16 times.	4112	for (i = 0; i < 256; i++)
2744		4096	ctx->codebook[i] = bytestream2_get_le16u(&ctx->gb);
2745
2746		16	bytestream2_skip(&ctx->gb, 8); // skip pad
2747
2748	2/2 ✓ Branch 0 taken 1 times. ✓ Branch 1 taken 15 times.	16	if (seq_num == 0) {
2749		1	ctx->frame->flags |= AV_FRAME_FLAG_KEY;
2750		1	ctx->frame->pict_type = AV_PICTURE_TYPE_I;
2751		1	fill_frame(ctx->frm1, ctx->npixels, bg_color);
2752		1	fill_frame(ctx->frm2, ctx->npixels, bg_color);
2753			} else {
2754		15	ctx->frame->flags &= ~AV_FRAME_FLAG_KEY;
2755		15	ctx->frame->pict_type = AV_PICTURE_TYPE_P;
2756			}
2757
2758		16	ret = 0;
2759	3/10 ✗ Branch 0 not taken. ✗ Branch 1 not taken. ✓ Branch 2 taken 6 times. ✗ Branch 3 not taken. ✓ Branch 4 taken 9 times. ✓ Branch 5 taken 1 times. ✗ Branch 6 not taken. ✗ Branch 7 not taken. ✗ Branch 8 not taken. ✗ Branch 9 not taken.	16	switch (codec) {
2760		✗	case 0: ret = bl16_decode_0(ctx); break;
2761		✗	case 1: ret = bl16_decode_1(ctx); break;
2762		6	case 2: ret = bl16_decode_2(ctx); break;
2763		✗	case 3: memcpy(ctx->frm0, ctx->frm2, ctx->frm2_size); break;
2764		9	case 4: memcpy(ctx->frm0, ctx->frm1, ctx->frm1_size); break;
2765		1	case 5: ret = bl16_decode_5(ctx, rle_output_size); break;
2766		✗	case 6: ret = bl16_decode_6(ctx); break;
2767		✗	case 7: ret = bl16_decode_7(ctx); break;
2768		✗	case 8: ret = bl16_decode_8(ctx); break;
2769		✗	default:
2770		✗	avpriv_request_sample(ctx->avctx, "Unknown/unsupported compression type %d", codec);
2771		✗	return AVERROR_PATCHWELCOME;
2772			}
2773
2774	2/2 ✓ Branch 0 taken 1 times. ✓ Branch 1 taken 15 times.	16	if (ret) {
2775		1	av_log(avctx, AV_LOG_ERROR,
2776			"Subcodec %d: error decoding frame.\n", codec);
2777		1	return ret;
2778			}
2779
2780		15	ret = copy_output(ctx, 1);
2781	2/2 ✓ Branch 0 taken 9 times. ✓ Branch 1 taken 6 times.	15	if (rcode)
2782		9	rotate_bufs(ctx, rcode);
2783	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 15 times.	15	if (ret)
2784		✗	return ret;
2785
2786		15	*got_frame_ptr = 1;
2787		15	return 0;
2788			}
2789
2790		✗	static int decode_anim(AVCodecContext *avctx, int *got_frame_ptr)
2791			{
2792		✗	SANMVideoContext *ctx = avctx->priv_data;
2793		✗	int i, ret, to_store = 0, have_img = 0;
2794
2795		✗	ctx->first_fob = 1;
2796		✗	while (bytestream2_get_bytes_left(&ctx->gb) >= 8) {
2797			uint32_t sig, size;
2798			int pos;
2799
2800		✗	sig = bytestream2_get_be32u(&ctx->gb);
2801		✗	size = bytestream2_get_be32u(&ctx->gb);
2802		✗	pos = bytestream2_tell(&ctx->gb);
2803
2804		✗	if (bytestream2_get_bytes_left(&ctx->gb) < size) {
2805		✗	av_log(avctx, AV_LOG_ERROR, "Incorrect chunk size %"PRIu32".\n", size);
2806		✗	break;
2807			}
2808		✗	switch (sig) {
2809		✗	case MKBETAG('N', 'P', 'A', 'L'):
2810		✗	if (size != PALETTE_SIZE * 3) {
2811		✗	av_log(avctx, AV_LOG_ERROR,
2812			"Incorrect palette block size %"PRIu32".\n", size);
2813		✗	return AVERROR_INVALIDDATA;
2814			}
2815		✗	for (i = 0; i < PALETTE_SIZE; i++)
2816		✗	ctx->pal[i] = 0xFFU << 24 | bytestream2_get_be24u(&ctx->gb);
2817		✗	if (ctx->subversion < 2)
2818		✗	ctx->pal[0] = 0xFFU << 24;
2819		✗	break;
2820		✗	case MKBETAG('F', 'O', 'B', 'J'):
2821		✗	if (size < 16)
2822		✗	return AVERROR_INVALIDDATA;
2823			GetByteContext fc;
2824		✗	bytestream2_init(&fc, ctx->gb.buffer, size);
2825		✗	if (ret = process_frame_obj(ctx, &fc, 0, 0)) {
2826		✗	return ret;
2827			}
2828		✗	have_img = 1;
2829
2830			/* STOR: for ANIMv0/1 store the whole FOBJ datablock, as it
2831			* needs to be replayed on FTCH, since none of the codecs
2832			* it uses work on the full buffer.
2833			* For ANIMv2, it's enough to store the current framebuffer.
2834			*/
2835		✗	if (to_store) {
2836		✗	to_store = 0;
2837		✗	if (ctx->subversion < 2) {
2838		✗	if (size <= ctx->stored_frame_size) {
2839		✗	bytestream2_seek(&fc, 0, SEEK_SET);
2840		✗	bytestream2_get_bufferu(&fc, ctx->stored_frame, size);
2841		✗	ctx->stor_size = size;
2842			} else {
2843		✗	av_log(avctx, AV_LOG_ERROR, "FOBJ too large for STOR\n");
2844		✗	ret = AVERROR(ENOMEM);
2845			}
2846			} else {
2847		✗	memcpy(ctx->stored_frame, ctx->fbuf, ctx->buf_size);
2848		✗	ctx->stor_size = ctx->buf_size;
2849			}
2850			}
2851		✗	bytestream2_skip(&ctx->gb, size);
2852		✗	break;
2853		✗	case MKBETAG('X', 'P', 'A', 'L'):
2854		✗	if (ret = process_xpal(ctx, size))
2855		✗	return ret;
2856		✗	break;
2857		✗	case MKBETAG('S', 'T', 'O', 'R'):
2858		✗	to_store = 1;
2859		✗	break;
2860		✗	case MKBETAG('F', 'T', 'C', 'H'):
2861		✗	if (ctx->subversion < 2) {
2862		✗	if ((ret = process_ftch(ctx, size)) < 0)
2863		✗	return ret;
2864		✗	have_img = (ret == 0) ? 1 : 0;
2865			} else {
2866		✗	if (ctx->stor_size > 0) {
2867		✗	memcpy(ctx->fbuf, ctx->stored_frame, ctx->buf_size);
2868		✗	have_img = 1;
2869			}
2870			}
2871		✗	break;
2872		✗	default:
2873		✗	bytestream2_skip(&ctx->gb, size);
2874		✗	av_log(avctx, AV_LOG_DEBUG,
2875			"Unknown/unsupported chunk %"PRIx32".\n", sig);
2876		✗	break;
2877			}
2878
2879			/* the sizes of chunks are usually a multiple of 2. However
2880			* there are a few unaligned FOBJs in RA1 L2PLAY.ANM only (looks
2881			* like a game bug) and IACT audio chunks which have odd sizes
2882			* but are padded with a zero byte.
2883			*/
2884		✗	bytestream2_seek(&ctx->gb, pos + size, SEEK_SET);
2885		✗	if ((pos + size) & 1) {
2886		✗	if (bytestream2_peek_byte(&ctx->gb) == 0)
2887		✗	bytestream2_skip(&ctx->gb, 1);
2888			}
2889			}
2890
2891		✗	if (have_img) {
2892		✗	if ((ret = copy_output(ctx, 0)))
2893		✗	return ret;
2894		✗	memcpy(ctx->frame->data[1], ctx->pal, 1024);
2895		✗	*got_frame_ptr = 1;
2896			}
2897		✗	return 0;
2898			}
2899
2900		16	static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
2901			int *got_frame_ptr, AVPacket *pkt)
2902			{
2903		16	SANMVideoContext *ctx = avctx->priv_data;
2904			int ret;
2905
2906		16	ctx->frame = frame;
2907		16	bytestream2_init(&ctx->gb, pkt->data, pkt->size);
2908
2909	1/2 ✗ Branch 0 not taken. ✓ Branch 1 taken 16 times.	16	if (!ctx->version) {
2910		✗	if ((ret = decode_anim(avctx, got_frame_ptr)))
2911		✗	return ret;
2912			} else {
2913	2/2 ✓ Branch 1 taken 1 times. ✓ Branch 2 taken 15 times.	16	if ((ret = decode_bl16(avctx, got_frame_ptr)))
2914		1	return ret;
2915			}
2916		15	return pkt->size;
2917			}
2918
2919			const FFCodec ff_sanm_decoder = {
2920			.p.name = "sanm",
2921			CODEC_LONG_NAME("LucasArts SANM/Smush video"),
2922			.p.type = AVMEDIA_TYPE_VIDEO,
2923			.p.id = AV_CODEC_ID_SANM,
2924			.priv_data_size = sizeof(SANMVideoContext),
2925			.init = decode_init,
2926			.close = decode_end,
2927			FF_CODEC_DECODE_CB(decode_frame),
2928			.p.capabilities = AV_CODEC_CAP_DR1,
2929			};
2930