FFmpeg coverage

GCC Code Coverage Report

Directory:	../../../ffmpeg/		Exec	Total	Coverage
File:	src/libavcodec/qtrle.c	Lines:	286	314	91.1 %
Date:	2020-08-13 15:06:06	Branches:	159	227	70.0 %


/*
 * Quicktime Animation (RLE) Video Decoder
 * Copyright (C) 2004 The FFmpeg project
 *
 * This file is part of FFmpeg.
 *
 * FFmpeg is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * FFmpeg is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with FFmpeg; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

/**
 * @file
 * QT RLE Video Decoder by Mike Melanson (melanson@pcisys.net)
 * For more information about the QT RLE format, visit:
 *   http://www.pcisys.net/~melanson/codecs/
 *
 * The QT RLE decoder has seven modes of operation:
 * 1, 2, 4, 8, 16, 24, and 32 bits per pixel. For modes 1, 2, 4, and 8
 * the decoder outputs PAL8 colorspace data. 16-bit data yields RGB555
 * data. 24-bit data is RGB24 and 32-bit data is RGB32.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "avcodec.h"
#include "bytestream.h"
#include "internal.h"

typedef struct QtrleContext {
    AVCodecContext *avctx;
    AVFrame *frame;

    GetByteContext g;
    uint32_t pal[256];
} QtrleContext;

#define CHECK_PIXEL_PTR(n)                                                            \
    if ((pixel_ptr + n > pixel_limit) || (pixel_ptr + n < 0)) {                       \
        av_log (s->avctx, AV_LOG_ERROR, "Problem: pixel_ptr = %d, pixel_limit = %d\n",\
                pixel_ptr + n, pixel_limit);                                          \
        return;                                                                       \
    }                                                                                 \

static void qtrle_decode_1bpp(QtrleContext *s, int row_ptr, int lines_to_change)
{
    int rle_code;
    int pixel_ptr;
    int row_inc = s->frame->linesize[0];
    uint8_t pi0, pi1;  /* 2 8-pixel values */
    uint8_t *rgb = s->frame->data[0];
    int pixel_limit = s->frame->linesize[0] * s->avctx->height;
    int skip;
    /* skip & 0x80 appears to mean 'start a new line', which can be interpreted
     * as 'go to next line' during the decoding of a frame but is 'go to first
     * line' at the beginning. Since we always interpret it as 'go to next line'
     * in the decoding loop (which makes code simpler/faster), the first line
     * would not be counted, so we count one more.
     * See: https://trac.ffmpeg.org/ticket/226
     * In the following decoding loop, row_ptr will be the position of the
     * current row. */

    row_ptr  -= row_inc;
    pixel_ptr = row_ptr;
    lines_to_change++;
    while (lines_to_change) {
        skip     =              bytestream2_get_byte(&s->g);
        rle_code = (int8_t)bytestream2_get_byte(&s->g);
        if (rle_code == 0)
            break;
        if(skip & 0x80) {
            lines_to_change--;
            row_ptr += row_inc;
            pixel_ptr = row_ptr + 2 * 8 * (skip & 0x7f);
        } else
            pixel_ptr += 2 * 8 * skip;
        CHECK_PIXEL_PTR(0);  /* make sure pixel_ptr is positive */

        if(rle_code == -1)
            continue;

        if (rle_code < 0) {
            /* decode the run length code */
            rle_code = -rle_code;
            /* get the next 2 bytes from the stream, treat them as groups
             * of 8 pixels, and output them rle_code times */

            pi0 = bytestream2_get_byte(&s->g);
            pi1 = bytestream2_get_byte(&s->g);
            CHECK_PIXEL_PTR(rle_code * 2 * 8);

            while (rle_code--) {
                rgb[pixel_ptr++] = (pi0 >> 7) & 0x01;
                rgb[pixel_ptr++] = (pi0 >> 6) & 0x01;
                rgb[pixel_ptr++] = (pi0 >> 5) & 0x01;
                rgb[pixel_ptr++] = (pi0 >> 4) & 0x01;
                rgb[pixel_ptr++] = (pi0 >> 3) & 0x01;
                rgb[pixel_ptr++] = (pi0 >> 2) & 0x01;
                rgb[pixel_ptr++] = (pi0 >> 1) & 0x01;
                rgb[pixel_ptr++] =  pi0       & 0x01;
                rgb[pixel_ptr++] = (pi1 >> 7) & 0x01;
                rgb[pixel_ptr++] = (pi1 >> 6) & 0x01;
                rgb[pixel_ptr++] = (pi1 >> 5) & 0x01;
                rgb[pixel_ptr++] = (pi1 >> 4) & 0x01;
                rgb[pixel_ptr++] = (pi1 >> 3) & 0x01;
                rgb[pixel_ptr++] = (pi1 >> 2) & 0x01;
                rgb[pixel_ptr++] = (pi1 >> 1) & 0x01;
                rgb[pixel_ptr++] =  pi1       & 0x01;
            }
        } else {
            /* copy the same pixel directly to output 2 times */
            rle_code *= 2;
            CHECK_PIXEL_PTR(rle_code * 8);

            while (rle_code--) {
                int x = bytestream2_get_byte(&s->g);
                rgb[pixel_ptr++] = (x >> 7) & 0x01;
                rgb[pixel_ptr++] = (x >> 6) & 0x01;
                rgb[pixel_ptr++] = (x >> 5) & 0x01;
                rgb[pixel_ptr++] = (x >> 4) & 0x01;
                rgb[pixel_ptr++] = (x >> 3) & 0x01;
                rgb[pixel_ptr++] = (x >> 2) & 0x01;
                rgb[pixel_ptr++] = (x >> 1) & 0x01;
                rgb[pixel_ptr++] =  x       & 0x01;
            }
        }
    }
}

static inline void qtrle_decode_2n4bpp(QtrleContext *s, int row_ptr,
                                       int lines_to_change, int bpp)
{
    int rle_code, i;
    int pixel_ptr;
    int row_inc = s->frame->linesize[0];
    uint8_t pi[16];  /* 16 palette indices */
    uint8_t *rgb = s->frame->data[0];
    int pixel_limit = s->frame->linesize[0] * s->avctx->height;
    int num_pixels = (bpp == 4) ? 8 : 16;

    while (lines_to_change--) {
        pixel_ptr = row_ptr + (num_pixels * (bytestream2_get_byte(&s->g) - 1));
        CHECK_PIXEL_PTR(0);

        while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
            if (bytestream2_get_bytes_left(&s->g) < 1)
                return;
            if (rle_code == 0) {
                /* there's another skip code in the stream */
                pixel_ptr += (num_pixels * (bytestream2_get_byte(&s->g) - 1));
                CHECK_PIXEL_PTR(0);  /* make sure pixel_ptr is positive */
            } else if (rle_code < 0) {
                /* decode the run length code */
                rle_code = -rle_code;
                /* get the next 4 bytes from the stream, treat them as palette
                 * indexes, and output them rle_code times */
                for (i = num_pixels-1; i >= 0; i--) {
                    pi[num_pixels-1-i] = (bytestream2_peek_byte(&s->g) >> ((i*bpp) & 0x07)) & ((1<<bpp)-1);
                    bytestream2_skip(&s->g, ((i & ((num_pixels>>2)-1)) == 0));
                }
                CHECK_PIXEL_PTR(rle_code * num_pixels);
                while (rle_code--) {
                    memcpy(&rgb[pixel_ptr], &pi, num_pixels);
                    pixel_ptr += num_pixels;
                }
            } else {
                /* copy the same pixel directly to output 4 times */
                rle_code *= 4;
                CHECK_PIXEL_PTR(rle_code*(num_pixels>>2));
                while (rle_code--) {
                    if(bpp == 4) {
                        int x = bytestream2_get_byte(&s->g);
                        rgb[pixel_ptr++] = (x >> 4) & 0x0f;
                        rgb[pixel_ptr++] =  x       & 0x0f;
                    } else {
                        int x = bytestream2_get_byte(&s->g);
                        rgb[pixel_ptr++] = (x >> 6) & 0x03;
                        rgb[pixel_ptr++] = (x >> 4) & 0x03;
                        rgb[pixel_ptr++] = (x >> 2) & 0x03;
                        rgb[pixel_ptr++] =  x       & 0x03;
                    }
                }
            }
        }
        row_ptr += row_inc;
    }
}

static void qtrle_decode_8bpp(QtrleContext *s, int row_ptr, int lines_to_change)
{
    int rle_code;
    int pixel_ptr;
    int row_inc = s->frame->linesize[0];
    uint8_t pi1, pi2, pi3, pi4;  /* 4 palette indexes */
    uint8_t *rgb = s->frame->data[0];
    int pixel_limit = s->frame->linesize[0] * s->avctx->height;

    while (lines_to_change--) {
        pixel_ptr = row_ptr + (4 * (bytestream2_get_byte(&s->g) - 1));
        CHECK_PIXEL_PTR(0);

        while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
            if (bytestream2_get_bytes_left(&s->g) < 1)
                return;
            if (rle_code == 0) {
                /* there's another skip code in the stream */
                pixel_ptr += (4 * (bytestream2_get_byte(&s->g) - 1));
                CHECK_PIXEL_PTR(0);  /* make sure pixel_ptr is positive */
            } else if (rle_code < 0) {
                /* decode the run length code */
                rle_code = -rle_code;
                /* get the next 4 bytes from the stream, treat them as palette
                 * indexes, and output them rle_code times */
                pi1 = bytestream2_get_byte(&s->g);
                pi2 = bytestream2_get_byte(&s->g);
                pi3 = bytestream2_get_byte(&s->g);
                pi4 = bytestream2_get_byte(&s->g);

                CHECK_PIXEL_PTR(rle_code * 4);

                while (rle_code--) {
                    rgb[pixel_ptr++] = pi1;
                    rgb[pixel_ptr++] = pi2;
                    rgb[pixel_ptr++] = pi3;
                    rgb[pixel_ptr++] = pi4;
                }
            } else {
                /* copy the same pixel directly to output 4 times */
                rle_code *= 4;
                CHECK_PIXEL_PTR(rle_code);

                bytestream2_get_buffer(&s->g, &rgb[pixel_ptr], rle_code);
                pixel_ptr += rle_code;
            }
        }
        row_ptr += row_inc;
    }
}

static void qtrle_decode_16bpp(QtrleContext *s, int row_ptr, int lines_to_change)
{
    int rle_code;
    int pixel_ptr;
    int row_inc = s->frame->linesize[0];
    uint16_t rgb16;
    uint8_t *rgb = s->frame->data[0];
    int pixel_limit = s->frame->linesize[0] * s->avctx->height;

    while (lines_to_change--) {
        pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 2;
        CHECK_PIXEL_PTR(0);

        while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
            if (bytestream2_get_bytes_left(&s->g) < 1)
                return;
            if (rle_code == 0) {
                /* there's another skip code in the stream */
                pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 2;
                CHECK_PIXEL_PTR(0);  /* make sure pixel_ptr is positive */
            } else if (rle_code < 0) {
                /* decode the run length code */
                rle_code = -rle_code;
                rgb16 = bytestream2_get_be16(&s->g);

                CHECK_PIXEL_PTR(rle_code * 2);

                while (rle_code--) {
                    *(uint16_t *)(&rgb[pixel_ptr]) = rgb16;
                    pixel_ptr += 2;
                }
            } else {
                CHECK_PIXEL_PTR(rle_code * 2);

                /* copy pixels directly to output */
                while (rle_code--) {
                    rgb16 = bytestream2_get_be16(&s->g);
                    *(uint16_t *)(&rgb[pixel_ptr]) = rgb16;
                    pixel_ptr += 2;
                }
            }
        }
        row_ptr += row_inc;
    }
}

static void qtrle_decode_24bpp(QtrleContext *s, int row_ptr, int lines_to_change)
{
    int rle_code, rle_code_half;
    int pixel_ptr;
    int row_inc = s->frame->linesize[0];
    uint8_t b;
    uint16_t rg;
    uint8_t *rgb = s->frame->data[0];
    int pixel_limit = s->frame->linesize[0] * s->avctx->height;

    while (lines_to_change--) {
        pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 3;
        CHECK_PIXEL_PTR(0);

        while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
            if (bytestream2_get_bytes_left(&s->g) < 1)
                return;
            if (rle_code == 0) {
                /* there's another skip code in the stream */
                pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 3;
                CHECK_PIXEL_PTR(0);  /* make sure pixel_ptr is positive */
            } else if (rle_code < 0) {
                /* decode the run length code */
                rle_code = -rle_code;
                rg = bytestream2_get_ne16(&s->g);
                b = bytestream2_get_byte(&s->g);

                CHECK_PIXEL_PTR(rle_code * 3);

                while (rle_code--) {
                    AV_WN16(rgb + pixel_ptr, rg);
                    rgb[pixel_ptr + 2] = b;
                    pixel_ptr += 3;
                }
            } else {
                CHECK_PIXEL_PTR(rle_code * 3);

                rle_code_half = rle_code / 2;

                while (rle_code_half--) { /* copy 2 raw rgb value at the same time */
                    AV_WN32(rgb + pixel_ptr, bytestream2_get_ne32(&s->g)); /* rgbr */
                    AV_WN16(rgb + pixel_ptr + 4, bytestream2_get_ne16(&s->g)); /* rgbr */
                    pixel_ptr += 6;
                }

                if (rle_code % 2 != 0){ /* not even raw value */
                    AV_WN16(rgb + pixel_ptr, bytestream2_get_ne16(&s->g));
                    rgb[pixel_ptr + 2] = bytestream2_get_byte(&s->g);
                    pixel_ptr += 3;
                }
            }
        }
        row_ptr += row_inc;
    }
}

static void qtrle_decode_32bpp(QtrleContext *s, int row_ptr, int lines_to_change)
{
    int rle_code, rle_code_half;
    int pixel_ptr;
    int row_inc = s->frame->linesize[0];
    unsigned int argb;
    uint8_t *rgb = s->frame->data[0];
    int pixel_limit = s->frame->linesize[0] * s->avctx->height;

    while (lines_to_change--) {
        pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 4;
        CHECK_PIXEL_PTR(0);

        while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
            if (bytestream2_get_bytes_left(&s->g) < 1)
                return;
            if (rle_code == 0) {
                /* there's another skip code in the stream */
                pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 4;
                CHECK_PIXEL_PTR(0);  /* make sure pixel_ptr is positive */
            } else if (rle_code < 0) {
                /* decode the run length code */
                rle_code = -rle_code;
                argb = bytestream2_get_ne32(&s->g);

                CHECK_PIXEL_PTR(rle_code * 4);

                while (rle_code--) {
                    AV_WN32A(rgb + pixel_ptr, argb);
                    pixel_ptr += 4;
                }
            } else {
                CHECK_PIXEL_PTR(rle_code * 4);

                /* copy pixels directly to output */
                rle_code_half = rle_code / 2;
                while (rle_code_half--) { /* copy 2 argb raw value at the same time */
                    AV_WN64(rgb + pixel_ptr, bytestream2_get_ne64(&s->g));
                    pixel_ptr += 8;
                }

                if (rle_code % 2 != 0){ /* not even raw value */
                    AV_WN32A(rgb + pixel_ptr, bytestream2_get_ne32(&s->g));
                    pixel_ptr += 4;
                }
            }
        }
        row_ptr += row_inc;
    }
}

static av_cold int qtrle_decode_init(AVCodecContext *avctx)
{
    QtrleContext *s = avctx->priv_data;

    s->avctx = avctx;
    switch (avctx->bits_per_coded_sample) {
    case 1:
    case 2:
    case 4:
    case 8:
    case 33:
    case 34:
    case 36:
    case 40:
        avctx->pix_fmt = AV_PIX_FMT_PAL8;
        break;

    case 16:
        avctx->pix_fmt = AV_PIX_FMT_RGB555;
        break;

    case 24:
        avctx->pix_fmt = AV_PIX_FMT_RGB24;
        break;

    case 32:
        avctx->pix_fmt = AV_PIX_FMT_ARGB;
        break;

    default:
        av_log (avctx, AV_LOG_ERROR, "Unsupported colorspace: %d bits/sample?\n",
            avctx->bits_per_coded_sample);
        return AVERROR_INVALIDDATA;
    }

    s->frame = av_frame_alloc();
    if (!s->frame)
        return AVERROR(ENOMEM);

    return 0;
}

static int qtrle_decode_frame(AVCodecContext *avctx,
                              void *data, int *got_frame,
                              AVPacket *avpkt)
{
    QtrleContext *s = avctx->priv_data;
    int header, start_line;
    int height, row_ptr;
    int has_palette = 0;
    int duplicate = 0;
    int ret, size;

    bytestream2_init(&s->g, avpkt->data, avpkt->size);

    /* check if this frame is even supposed to change */
    if (avpkt->size < 8) {
        duplicate = 1;
        goto done;
    }

    /* start after the chunk size */
    size = bytestream2_get_be32(&s->g) & 0x3FFFFFFF;
    if (size - avpkt->size >  size * (int64_t)avctx->discard_damaged_percentage / 100)
        return AVERROR_INVALIDDATA;


    /* fetch the header */
    header = bytestream2_get_be16(&s->g);

    /* if a header is present, fetch additional decoding parameters */
    if (header & 0x0008) {
        if (avpkt->size < 14) {
            duplicate = 1;
            goto done;
        }
        start_line = bytestream2_get_be16(&s->g);
        bytestream2_skip(&s->g, 2);
        height     = bytestream2_get_be16(&s->g);
        bytestream2_skip(&s->g, 2);
        if (height > s->avctx->height - start_line) {
            duplicate = 1;
            goto done;
        }
    } else {
        start_line = 0;
        height     = s->avctx->height;
    }
    if ((ret = ff_reget_buffer(avctx, s->frame, 0)) < 0)
        return ret;

    row_ptr = s->frame->linesize[0] * start_line;

    switch (avctx->bits_per_coded_sample) {
    case 1:
    case 33:
        qtrle_decode_1bpp(s, row_ptr, height);
        has_palette = 1;
        break;

    case 2:
    case 34:
        qtrle_decode_2n4bpp(s, row_ptr, height, 2);
        has_palette = 1;
        break;

    case 4:
    case 36:
        qtrle_decode_2n4bpp(s, row_ptr, height, 4);
        has_palette = 1;
        break;

    case 8:
    case 40:
        qtrle_decode_8bpp(s, row_ptr, height);
        has_palette = 1;
        break;

    case 16:
        qtrle_decode_16bpp(s, row_ptr, height);
        break;

    case 24:
        qtrle_decode_24bpp(s, row_ptr, height);
        break;

    case 32:
        qtrle_decode_32bpp(s, row_ptr, height);
        break;

    default:
        av_log (s->avctx, AV_LOG_ERROR, "Unsupported colorspace: %d bits/sample?\n",
            avctx->bits_per_coded_sample);
        break;
    }

    if(has_palette) {
        int size;
        const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, &size);

        if (pal && size == AVPALETTE_SIZE) {
            s->frame->palette_has_changed = 1;
            memcpy(s->pal, pal, AVPALETTE_SIZE);
        } else if (pal) {
            av_log(avctx, AV_LOG_ERROR, "Palette size %d is wrong\n", size);
        }

        /* make the palette available on the way out */
        memcpy(s->frame->data[1], s->pal, AVPALETTE_SIZE);
    }

done:
    if (!s->frame->data[0])
        return AVERROR_INVALIDDATA;
    if (duplicate) {
        // ff_reget_buffer() isn't needed when frames don't change, so just update
        // frame props.
        ret = ff_decode_frame_props(avctx, s->frame);
        if (ret < 0)
            return ret;
    }

    if ((ret = av_frame_ref(data, s->frame)) < 0)
        return ret;
    *got_frame      = 1;

    /* always report that the buffer was completely consumed */
    return avpkt->size;
}

static void qtrle_decode_flush(AVCodecContext *avctx)
{
    QtrleContext *s = avctx->priv_data;

    av_frame_unref(s->frame);
}

static av_cold int qtrle_decode_end(AVCodecContext *avctx)
{
    QtrleContext *s = avctx->priv_data;

    av_frame_free(&s->frame);

    return 0;
}

AVCodec ff_qtrle_decoder = {
    .name           = "qtrle",
    .long_name      = NULL_IF_CONFIG_SMALL("QuickTime Animation (RLE) video"),
    .type           = AVMEDIA_TYPE_VIDEO,
    .id             = AV_CODEC_ID_QTRLE,
    .priv_data_size = sizeof(QtrleContext),
    .init           = qtrle_decode_init,
    .close          = qtrle_decode_end,
    .decode         = qtrle_decode_frame,
    .flush          = qtrle_decode_flush,
    .capabilities   = AV_CODEC_CAP_DR1,
};


Generated by: GCOVR (Version 4.2)

Line	Branch	Exec	Source
1			/*
2			* Quicktime Animation (RLE) Video Decoder
3			* Copyright (C) 2004 The FFmpeg project
4			*
5			* This file is part of FFmpeg.
6			*
7			* FFmpeg is free software; you can redistribute it and/or
8			* modify it under the terms of the GNU Lesser General Public
9			* License as published by the Free Software Foundation; either
10			* version 2.1 of the License, or (at your option) any later version.
11			*
12			* FFmpeg is distributed in the hope that it will be useful,
13			* but WITHOUT ANY WARRANTY; without even the implied warranty of
14			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15			* Lesser General Public License for more details.
16			*
17			* You should have received a copy of the GNU Lesser General Public
18			* License along with FFmpeg; if not, write to the Free Software
19			* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20			*/
21
22			/**
23			* @file
24			* QT RLE Video Decoder by Mike Melanson (melanson@pcisys.net)
25			* For more information about the QT RLE format, visit:
26			* http://www.pcisys.net/~melanson/codecs/
27			*
28			* The QT RLE decoder has seven modes of operation:
29			* 1, 2, 4, 8, 16, 24, and 32 bits per pixel. For modes 1, 2, 4, and 8
30			* the decoder outputs PAL8 colorspace data. 16-bit data yields RGB555
31			* data. 24-bit data is RGB24 and 32-bit data is RGB32.
32			*/
33
34			#include <stdio.h>
35			#include <stdlib.h>
36			#include <string.h>
37
38			#include "avcodec.h"
39			#include "bytestream.h"
40			#include "internal.h"
41
42			typedef struct QtrleContext {
43			AVCodecContext *avctx;
44			AVFrame *frame;
45
46			GetByteContext g;
47			uint32_t pal[256];
48			} QtrleContext;
49
50			#define CHECK_PIXEL_PTR(n) \
51			if ((pixel_ptr + n > pixel_limit) \|\| (pixel_ptr + n < 0)) { \
52			av_log (s->avctx, AV_LOG_ERROR, "Problem: pixel_ptr = %d, pixel_limit = %d\n",\
53			pixel_ptr + n, pixel_limit); \
54			return; \
55			} \
56
57		38	static void qtrle_decode_1bpp(QtrleContext *s, int row_ptr, int lines_to_change)
58			{
59			int rle_code;
60			int pixel_ptr;
61		38	int row_inc = s->frame->linesize[0];
62			uint8_t pi0, pi1; /* 2 8-pixel values */
63		38	uint8_t *rgb = s->frame->data[0];
64		38	int pixel_limit = s->frame->linesize[0] * s->avctx->height;
65			int skip;
66			/* skip & 0x80 appears to mean 'start a new line', which can be interpreted
67			* as 'go to next line' during the decoding of a frame but is 'go to first
68			* line' at the beginning. Since we always interpret it as 'go to next line'
69			* in the decoding loop (which makes code simpler/faster), the first line
70			* would not be counted, so we count one more.
71			* See: https://trac.ffmpeg.org/ticket/226
72			* In the following decoding loop, row_ptr will be the position of the
73			* current row. */
74
75		38	row_ptr -= row_inc;
76		38	pixel_ptr = row_ptr;
77		38	lines_to_change++;
78	✓✗	13034	while (lines_to_change) {
79		13034	skip = bytestream2_get_byte(&s->g);
80		13034	rle_code = (int8_t)bytestream2_get_byte(&s->g);
81	✓✓	13034	if (rle_code == 0)
82		38	break;
83	✓✓	12996	if(skip & 0x80) {
84		9120	lines_to_change--;
85		9120	row_ptr += row_inc;
86		9120	pixel_ptr = row_ptr + 2 * 8 * (skip & 0x7f);
87			} else
88		3876	pixel_ptr += 2 * 8 * skip;
89	✓✗✗✓	12996	CHECK_PIXEL_PTR(0); /* make sure pixel_ptr is positive */
90
91	✗✓	12996	if(rle_code == -1)
92			continue;
93
94	✓✓	12996	if (rle_code < 0) {
95			/* decode the run length code */
96		1825	rle_code = -rle_code;
97			/* get the next 2 bytes from the stream, treat them as groups
98			* of 8 pixels, and output them rle_code times */
99
100		1825	pi0 = bytestream2_get_byte(&s->g);
101		1825	pi1 = bytestream2_get_byte(&s->g);
102	✓✗✗✓	1825	CHECK_PIXEL_PTR(rle_code * 2 * 8);
103
104	✓✓	7072	while (rle_code--) {
105		5247	rgb[pixel_ptr++] = (pi0 >> 7) & 0x01;
106		5247	rgb[pixel_ptr++] = (pi0 >> 6) & 0x01;
107		5247	rgb[pixel_ptr++] = (pi0 >> 5) & 0x01;
108		5247	rgb[pixel_ptr++] = (pi0 >> 4) & 0x01;
109		5247	rgb[pixel_ptr++] = (pi0 >> 3) & 0x01;
110		5247	rgb[pixel_ptr++] = (pi0 >> 2) & 0x01;
111		5247	rgb[pixel_ptr++] = (pi0 >> 1) & 0x01;
112		5247	rgb[pixel_ptr++] = pi0 & 0x01;
113		5247	rgb[pixel_ptr++] = (pi1 >> 7) & 0x01;
114		5247	rgb[pixel_ptr++] = (pi1 >> 6) & 0x01;
115		5247	rgb[pixel_ptr++] = (pi1 >> 5) & 0x01;
116		5247	rgb[pixel_ptr++] = (pi1 >> 4) & 0x01;
117		5247	rgb[pixel_ptr++] = (pi1 >> 3) & 0x01;
118		5247	rgb[pixel_ptr++] = (pi1 >> 2) & 0x01;
119		5247	rgb[pixel_ptr++] = (pi1 >> 1) & 0x01;
120		5247	rgb[pixel_ptr++] = pi1 & 0x01;
121			}
122			} else {
123			/* copy the same pixel directly to output 2 times */
124		11171	rle_code *= 2;
125	✓✗✗✓	11171	CHECK_PIXEL_PTR(rle_code * 8);
126
127	✓✓	363961	while (rle_code--) {
128		352790	int x = bytestream2_get_byte(&s->g);
129		352790	rgb[pixel_ptr++] = (x >> 7) & 0x01;
130		352790	rgb[pixel_ptr++] = (x >> 6) & 0x01;
131		352790	rgb[pixel_ptr++] = (x >> 5) & 0x01;
132		352790	rgb[pixel_ptr++] = (x >> 4) & 0x01;
133		352790	rgb[pixel_ptr++] = (x >> 3) & 0x01;
134		352790	rgb[pixel_ptr++] = (x >> 2) & 0x01;
135		352790	rgb[pixel_ptr++] = (x >> 1) & 0x01;
136		352790	rgb[pixel_ptr++] = x & 0x01;
137			}
138			}
139			}
140			}
141
142		114	static inline void qtrle_decode_2n4bpp(QtrleContext *s, int row_ptr,
143			int lines_to_change, int bpp)
144			{
145			int rle_code, i;
146			int pixel_ptr;
147		114	int row_inc = s->frame->linesize[0];
148			uint8_t pi[16]; /* 16 palette indices */
149		114	uint8_t *rgb = s->frame->data[0];
150		114	int pixel_limit = s->frame->linesize[0] * s->avctx->height;
151	✓✓	114	int num_pixels = (bpp == 4) ? 8 : 16;
152
153	✓✓	27474	while (lines_to_change--) {
154		27360	pixel_ptr = row_ptr + (num_pixels * (bytestream2_get_byte(&s->g) - 1));
155	✓✗✗✓	27360	CHECK_PIXEL_PTR(0);
156
157	✓✓	172476	while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
158	✗✓	145116	if (bytestream2_get_bytes_left(&s->g) < 1)
159			return;
160	✓✓	145116	if (rle_code == 0) {
161			/* there's another skip code in the stream */
162		32727	pixel_ptr += (num_pixels * (bytestream2_get_byte(&s->g) - 1));
163	✓✗✗✓	32727	CHECK_PIXEL_PTR(0); /* make sure pixel_ptr is positive */
164	✓✓	112389	} else if (rle_code < 0) {
165			/* decode the run length code */
166		30399	rle_code = -rle_code;
167			/* get the next 4 bytes from the stream, treat them as palette
168			* indexes, and output them rle_code times */
169	✓✓	292911	for (i = num_pixels-1; i >= 0; i--) {
170		262512	pi[num_pixels-1-i] = (bytestream2_peek_byte(&s->g) >> ((i*bpp) & 0x07)) & ((1<<bpp)-1);
171		262512	bytestream2_skip(&s->g, ((i & ((num_pixels>>2)-1)) == 0));
172			}
173	✓✗✗✓	30399	CHECK_PIXEL_PTR(rle_code * num_pixels);
174	✓✓	131895	while (rle_code--) {
175		101496	memcpy(&rgb[pixel_ptr], &pi, num_pixels);
176		101496	pixel_ptr += num_pixels;
177			}
178			} else {
179			/* copy the same pixel directly to output 4 times */
180		81990	rle_code *= 4;
181	✓✗✗✓	81990	CHECK_PIXEL_PTR(rle_code*(num_pixels>>2));
182	✓✓	2966410	while (rle_code--) {
183	✓✓	2884420	if(bpp == 4) {
184		2213528	int x = bytestream2_get_byte(&s->g);
185		2213528	rgb[pixel_ptr++] = (x >> 4) & 0x0f;
186		2213528	rgb[pixel_ptr++] = x & 0x0f;
187			} else {
188		670892	int x = bytestream2_get_byte(&s->g);
189		670892	rgb[pixel_ptr++] = (x >> 6) & 0x03;
190		670892	rgb[pixel_ptr++] = (x >> 4) & 0x03;
191		670892	rgb[pixel_ptr++] = (x >> 2) & 0x03;
192		670892	rgb[pixel_ptr++] = x & 0x03;
193			}
194			}
195			}
196			}
197		27360	row_ptr += row_inc;
198			}
199			}
200
201		208	static void qtrle_decode_8bpp(QtrleContext *s, int row_ptr, int lines_to_change)
202			{
203			int rle_code;
204			int pixel_ptr;
205		208	int row_inc = s->frame->linesize[0];
206			uint8_t pi1, pi2, pi3, pi4; /* 4 palette indexes */
207		208	uint8_t *rgb = s->frame->data[0];
208		208	int pixel_limit = s->frame->linesize[0] * s->avctx->height;
209
210	✓✓	48519	while (lines_to_change--) {
211		48311	pixel_ptr = row_ptr + (4 * (bytestream2_get_byte(&s->g) - 1));
212	✓✗✗✓	48311	CHECK_PIXEL_PTR(0);
213
214	✓✓	199338	while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
215	✗✓	151027	if (bytestream2_get_bytes_left(&s->g) < 1)
216			return;
217	✓✓	151027	if (rle_code == 0) {
218			/* there's another skip code in the stream */
219		39089	pixel_ptr += (4 * (bytestream2_get_byte(&s->g) - 1));
220	✓✗✗✓	39089	CHECK_PIXEL_PTR(0); /* make sure pixel_ptr is positive */
221	✓✓	111938	} else if (rle_code < 0) {
222			/* decode the run length code */
223		18173	rle_code = -rle_code;
224			/* get the next 4 bytes from the stream, treat them as palette
225			* indexes, and output them rle_code times */
226		18173	pi1 = bytestream2_get_byte(&s->g);
227		18173	pi2 = bytestream2_get_byte(&s->g);
228		18173	pi3 = bytestream2_get_byte(&s->g);
229		18173	pi4 = bytestream2_get_byte(&s->g);
230
231	✓✗✗✓	18173	CHECK_PIXEL_PTR(rle_code * 4);
232
233	✓✓	119754	while (rle_code--) {
234		101581	rgb[pixel_ptr++] = pi1;
235		101581	rgb[pixel_ptr++] = pi2;
236		101581	rgb[pixel_ptr++] = pi3;
237		101581	rgb[pixel_ptr++] = pi4;
238			}
239			} else {
240			/* copy the same pixel directly to output 4 times */
241		93765	rle_code *= 4;
242	✓✗✗✓	93765	CHECK_PIXEL_PTR(rle_code);
243
244		93765	bytestream2_get_buffer(&s->g, &rgb[pixel_ptr], rle_code);
245		93765	pixel_ptr += rle_code;
246			}
247			}
248		48311	row_ptr += row_inc;
249			}
250			}
251
252		83	static void qtrle_decode_16bpp(QtrleContext *s, int row_ptr, int lines_to_change)
253			{
254			int rle_code;
255			int pixel_ptr;
256		83	int row_inc = s->frame->linesize[0];
257			uint16_t rgb16;
258		83	uint8_t *rgb = s->frame->data[0];
259		83	int pixel_limit = s->frame->linesize[0] * s->avctx->height;
260
261	✓✓	10043	while (lines_to_change--) {
262		9960	pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 2;
263	✓✗✗✓	9960	CHECK_PIXEL_PTR(0);
264
265	✓✓	278662	while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
266	✗✓	268702	if (bytestream2_get_bytes_left(&s->g) < 1)
267			return;
268	✗✓	268702	if (rle_code == 0) {
269			/* there's another skip code in the stream */
270			pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 2;
271			CHECK_PIXEL_PTR(0); /* make sure pixel_ptr is positive */
272	✓✓	268702	} else if (rle_code < 0) {
273			/* decode the run length code */
274		234583	rle_code = -rle_code;
275		234583	rgb16 = bytestream2_get_be16(&s->g);
276
277	✓✗✗✓	234583	CHECK_PIXEL_PTR(rle_code * 2);
278
279	✓✓	1764013	while (rle_code--) {
280		1529430	(uint16_t )(&rgb[pixel_ptr]) = rgb16;
281		1529430	pixel_ptr += 2;
282			}
283			} else {
284	✓✗✗✓	34119	CHECK_PIXEL_PTR(rle_code * 2);
285
286			/* copy pixels directly to output */
287	✓✓	98289	while (rle_code--) {
288		64170	rgb16 = bytestream2_get_be16(&s->g);
289		64170	(uint16_t )(&rgb[pixel_ptr]) = rgb16;
290		64170	pixel_ptr += 2;
291			}
292			}
293			}
294		9960	row_ptr += row_inc;
295			}
296			}
297
298		250	static void qtrle_decode_24bpp(QtrleContext *s, int row_ptr, int lines_to_change)
299			{
300			int rle_code, rle_code_half;
301			int pixel_ptr;
302		250	int row_inc = s->frame->linesize[0];
303			uint8_t b;
304			uint16_t rg;
305		250	uint8_t *rgb = s->frame->data[0];
306		250	int pixel_limit = s->frame->linesize[0] * s->avctx->height;
307
308	✓✓	51552	while (lines_to_change--) {
309		51302	pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 3;
310	✓✗✗✓	51302	CHECK_PIXEL_PTR(0);
311
312	✓✓	1607159	while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
313	✗✓	1555857	if (bytestream2_get_bytes_left(&s->g) < 1)
314			return;
315	✓✓	1555857	if (rle_code == 0) {
316			/* there's another skip code in the stream */
317		109372	pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 3;
318	✓✗✗✓	109372	CHECK_PIXEL_PTR(0); /* make sure pixel_ptr is positive */
319	✓✓	1446485	} else if (rle_code < 0) {
320			/* decode the run length code */
321		764625	rle_code = -rle_code;
322		764625	rg = bytestream2_get_ne16(&s->g);
323		764625	b = bytestream2_get_byte(&s->g);
324
325	✓✗✗✓	764625	CHECK_PIXEL_PTR(rle_code * 3);
326
327	✓✓	3138145	while (rle_code--) {
328		2373520	AV_WN16(rgb + pixel_ptr, rg);
329		2373520	rgb[pixel_ptr + 2] = b;
330		2373520	pixel_ptr += 3;
331			}
332			} else {
333	✓✗✗✓	681860	CHECK_PIXEL_PTR(rle_code * 3);
334
335		681860	rle_code_half = rle_code / 2;
336
337	✓✓	7319587	while (rle_code_half--) { /* copy 2 raw rgb value at the same time */
338		6637727	AV_WN32(rgb + pixel_ptr, bytestream2_get_ne32(&s->g)); /* rgbr */
339		6637727	AV_WN16(rgb + pixel_ptr + 4, bytestream2_get_ne16(&s->g)); /* rgbr */
340		6637727	pixel_ptr += 6;
341			}
342
343	✓✓	681860	if (rle_code % 2 != 0){ /* not even raw value */
344		229085	AV_WN16(rgb + pixel_ptr, bytestream2_get_ne16(&s->g));
345		229085	rgb[pixel_ptr + 2] = bytestream2_get_byte(&s->g);
346		229085	pixel_ptr += 3;
347			}
348			}
349			}
350		51302	row_ptr += row_inc;
351			}
352			}
353
354		26	static void qtrle_decode_32bpp(QtrleContext *s, int row_ptr, int lines_to_change)
355			{
356			int rle_code, rle_code_half;
357			int pixel_ptr;
358		26	int row_inc = s->frame->linesize[0];
359			unsigned int argb;
360		26	uint8_t *rgb = s->frame->data[0];
361		26	int pixel_limit = s->frame->linesize[0] * s->avctx->height;
362
363	✓✓	12506	while (lines_to_change--) {
364		12480	pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 4;
365	✓✗✗✓	12480	CHECK_PIXEL_PTR(0);
366
367	✓✓	1205972	while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) {
368	✗✓	1193492	if (bytestream2_get_bytes_left(&s->g) < 1)
369			return;
370	✓✓	1193492	if (rle_code == 0) {
371			/* there's another skip code in the stream */
372		244756	pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 4;
373	✓✗✗✓	244756	CHECK_PIXEL_PTR(0); /* make sure pixel_ptr is positive */
374	✓✓	948736	} else if (rle_code < 0) {
375			/* decode the run length code */
376		565158	rle_code = -rle_code;
377		565158	argb = bytestream2_get_ne32(&s->g);
378
379	✓✗✗✓	565158	CHECK_PIXEL_PTR(rle_code * 4);
380
381	✓✓	2768198	while (rle_code--) {
382		2203040	AV_WN32A(rgb + pixel_ptr, argb);
383		2203040	pixel_ptr += 4;
384			}
385			} else {
386	✓✗✗✓	383578	CHECK_PIXEL_PTR(rle_code * 4);
387
388			/* copy pixels directly to output */
389		383578	rle_code_half = rle_code / 2;
390	✓✓	871158	while (rle_code_half--) { /* copy 2 argb raw value at the same time */
391		487580	AV_WN64(rgb + pixel_ptr, bytestream2_get_ne64(&s->g));
392		487580	pixel_ptr += 8;
393			}
394
395	✓✓	383578	if (rle_code % 2 != 0){ /* not even raw value */
396		256768	AV_WN32A(rgb + pixel_ptr, bytestream2_get_ne32(&s->g));
397		256768	pixel_ptr += 4;
398			}
399			}
400			}
401		12480	row_ptr += row_inc;
402			}
403			}
404
405		39	static av_cold int qtrle_decode_init(AVCodecContext *avctx)
406			{
407		39	QtrleContext *s = avctx->priv_data;
408
409		39	s->avctx = avctx;
410	✓✓✓✓ ✗	39	switch (avctx->bits_per_coded_sample) {
411		17	case 1:
412			case 2:
413			case 4:
414			case 8:
415			case 33:
416			case 34:
417			case 36:
418			case 40:
419		17	avctx->pix_fmt = AV_PIX_FMT_PAL8;
420		17	break;
421
422		2	case 16:
423		2	avctx->pix_fmt = AV_PIX_FMT_RGB555;
424		2	break;
425
426		18	case 24:
427		18	avctx->pix_fmt = AV_PIX_FMT_RGB24;
428		18	break;
429
430		2	case 32:
431		2	avctx->pix_fmt = AV_PIX_FMT_ARGB;
432		2	break;
433
434			default:
435			av_log (avctx, AV_LOG_ERROR, "Unsupported colorspace: %d bits/sample?\n",
436			avctx->bits_per_coded_sample);
437			return AVERROR_INVALIDDATA;
438			}
439
440		39	s->frame = av_frame_alloc();
441	✗✓	39	if (!s->frame)
442			return AVERROR(ENOMEM);
443
444		39	return 0;
445			}
446
447		828	static int qtrle_decode_frame(AVCodecContext *avctx,
448			void data, int got_frame,
449			AVPacket *avpkt)
450			{
451		828	QtrleContext *s = avctx->priv_data;
452			int header, start_line;
453			int height, row_ptr;
454		828	int has_palette = 0;
455		828	int duplicate = 0;
456			int ret, size;
457
458		828	bytestream2_init(&s->g, avpkt->data, avpkt->size);
459
460			/* check if this frame is even supposed to change */
461	✓✓	828	if (avpkt->size < 8) {
462		109	duplicate = 1;
463		109	goto done;
464			}
465
466			/* start after the chunk size */
467		719	size = bytestream2_get_be32(&s->g) & 0x3FFFFFFF;
468	✗✓	719	if (size - avpkt->size > size * (int64_t)avctx->discard_damaged_percentage / 100)
469			return AVERROR_INVALIDDATA;
470
471
472			/* fetch the header */
473		719	header = bytestream2_get_be16(&s->g);
474
475			/* if a header is present, fetch additional decoding parameters */
476	✓✓	719	if (header & 0x0008) {
477	✗✓	369	if (avpkt->size < 14) {
478			duplicate = 1;
479			goto done;
480			}
481		369	start_line = bytestream2_get_be16(&s->g);
482		369	bytestream2_skip(&s->g, 2);
483		369	height = bytestream2_get_be16(&s->g);
484		369	bytestream2_skip(&s->g, 2);
485	✗✓	369	if (height > s->avctx->height - start_line) {
486			duplicate = 1;
487			goto done;
488			}
489			} else {
490		350	start_line = 0;
491		350	height = s->avctx->height;
492			}
493	✗✓	719	if ((ret = ff_reget_buffer(avctx, s->frame, 0)) < 0)
494			return ret;
495
496		719	row_ptr = s->frame->linesize[0] * start_line;
497
498	✓✓✓✓ ✓✓✓✗	719	switch (avctx->bits_per_coded_sample) {
499		38	case 1:
500			case 33:
501		38	qtrle_decode_1bpp(s, row_ptr, height);
502		38	has_palette = 1;
503		38	break;
504
505		38	case 2:
506			case 34:
507		38	qtrle_decode_2n4bpp(s, row_ptr, height, 2);
508		38	has_palette = 1;
509		38	break;
510
511		76	case 4:
512			case 36:
513		76	qtrle_decode_2n4bpp(s, row_ptr, height, 4);
514		76	has_palette = 1;
515		76	break;
516
517		208	case 8:
518			case 40:
519		208	qtrle_decode_8bpp(s, row_ptr, height);
520		208	has_palette = 1;
521		208	break;
522
523		83	case 16:
524		83	qtrle_decode_16bpp(s, row_ptr, height);
525		83	break;
526
527		250	case 24:
528		250	qtrle_decode_24bpp(s, row_ptr, height);
529		250	break;
530
531		26	case 32:
532		26	qtrle_decode_32bpp(s, row_ptr, height);
533		26	break;
534
535			default:
536			av_log (s->avctx, AV_LOG_ERROR, "Unsupported colorspace: %d bits/sample?\n",
537			avctx->bits_per_coded_sample);
538			break;
539			}
540
541	✓✓	719	if(has_palette) {
542			int size;
543		360	const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, &size);
544
545	✓✓✓✗	360	if (pal && size == AVPALETTE_SIZE) {
546		8	s->frame->palette_has_changed = 1;
547		8	memcpy(s->pal, pal, AVPALETTE_SIZE);
548	✗✓	352	} else if (pal) {
549			av_log(avctx, AV_LOG_ERROR, "Palette size %d is wrong\n", size);
550			}
551
552			/* make the palette available on the way out */
553		360	memcpy(s->frame->data[1], s->pal, AVPALETTE_SIZE);
554			}
555
556		359	done:
557	✗✓	828	if (!s->frame->data[0])
558			return AVERROR_INVALIDDATA;
559	✓✓	828	if (duplicate) {
560			// ff_reget_buffer() isn't needed when frames don't change, so just update
561			// frame props.
562		109	ret = ff_decode_frame_props(avctx, s->frame);
563	✗✓	109	if (ret < 0)
564			return ret;
565			}
566
567	✗✓	828	if ((ret = av_frame_ref(data, s->frame)) < 0)
568			return ret;
569		828	*got_frame = 1;
570
571			/* always report that the buffer was completely consumed */
572		828	return avpkt->size;
573			}
574
575			static void qtrle_decode_flush(AVCodecContext *avctx)
576			{
577			QtrleContext *s = avctx->priv_data;
578
579			av_frame_unref(s->frame);
580			}
581
582		39	static av_cold int qtrle_decode_end(AVCodecContext *avctx)
583			{
584		39	QtrleContext *s = avctx->priv_data;
585
586		39	av_frame_free(&s->frame);
587
588		39	return 0;
589			}
590
591			AVCodec ff_qtrle_decoder = {
592			.name = "qtrle",
593			.long_name = NULL_IF_CONFIG_SMALL("QuickTime Animation (RLE) video"),
594			.type = AVMEDIA_TYPE_VIDEO,
595			.id = AV_CODEC_ID_QTRLE,
596			.priv_data_size = sizeof(QtrleContext),
597			.init = qtrle_decode_init,
598			.close = qtrle_decode_end,
599			.decode = qtrle_decode_frame,
600			.flush = qtrle_decode_flush,
601			.capabilities = AV_CODEC_CAP_DR1,
602			};