FFmpeg coverage

GCC Code Coverage Report

Directory:	../../../ffmpeg/		Exec	Total	Coverage
File:	src/libavcodec/vmdvideo.c	Lines:	149	245	60.8 %
Date:	2021-04-18 21:26:34	Branches:	87	172	50.6 %


/*
 * Sierra VMD video decoder
 * Copyright (c) 2004 The FFmpeg Project
 *
 * This file is part of FFmpeg.
 *
 * FFmpeg is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * FFmpeg is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with FFmpeg; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

/**
 * @file
 * Sierra VMD video decoder
 * by Vladimir "VAG" Gneushev (vagsoft at mail.ru)
 * for more information on the Sierra VMD format, visit:
 *   http://www.pcisys.net/~melanson/codecs/
 *
 * The video decoder outputs PAL8 colorspace data. The decoder expects
 * a 0x330-byte VMD file header to be transmitted via extradata during
 * codec initialization. Each encoded frame that is sent to this decoder
 * is expected to be prepended with the appropriate 16-byte frame
 * information record from the VMD file.
 */

#include <string.h>

#include "libavutil/common.h"
#include "libavutil/intreadwrite.h"

#include "avcodec.h"
#include "internal.h"
#include "bytestream.h"

#define VMD_HEADER_SIZE 0x330
#define PALETTE_COUNT 256

typedef struct VmdVideoContext {

    AVCodecContext *avctx;
    AVFrame *prev_frame;

    const unsigned char *buf;
    int size;

    unsigned char palette[PALETTE_COUNT * 4];
    unsigned char *unpack_buffer;
    int unpack_buffer_size;

    int x_off, y_off;
} VmdVideoContext;

#define QUEUE_SIZE 0x1000
#define QUEUE_MASK 0x0FFF

static int lz_unpack(const unsigned char *src, int src_len,
                      unsigned char *dest, int dest_len)
{
    unsigned char *d;
    unsigned char *d_end;
    unsigned char queue[QUEUE_SIZE];
    unsigned int qpos;
    unsigned int dataleft;
    unsigned int chainofs;
    unsigned int chainlen;
    unsigned int speclen;
    unsigned char tag;
    unsigned int i, j;
    GetByteContext gb;

    bytestream2_init(&gb, src, src_len);
    d = dest;
    d_end = d + dest_len;
    dataleft = bytestream2_get_le32(&gb);
    memset(queue, 0x20, QUEUE_SIZE);
    if (bytestream2_get_bytes_left(&gb) < 4)
        return AVERROR_INVALIDDATA;
    if (bytestream2_peek_le32(&gb) == 0x56781234) {
        bytestream2_skipu(&gb, 4);
        qpos = 0x111;
        speclen = 0xF + 3;
    } else {
        qpos = 0xFEE;
        speclen = 100;  /* no speclen */
    }

    while (dataleft > 0 && bytestream2_get_bytes_left(&gb) > 0) {
        tag = bytestream2_get_byteu(&gb);
        if ((tag == 0xFF) && (dataleft > 8)) {
            if (d_end - d < 8 || bytestream2_get_bytes_left(&gb) < 8)
                return AVERROR_INVALIDDATA;
            for (i = 0; i < 8; i++) {
                queue[qpos++] = *d++ = bytestream2_get_byteu(&gb);
                qpos &= QUEUE_MASK;
            }
            dataleft -= 8;
        } else {
            for (i = 0; i < 8; i++) {
                if (dataleft == 0)
                    break;
                if (tag & 0x01) {
                    if (d_end - d < 1 || bytestream2_get_bytes_left(&gb) < 1)
                        return AVERROR_INVALIDDATA;
                    queue[qpos++] = *d++ = bytestream2_get_byteu(&gb);
                    qpos &= QUEUE_MASK;
                    dataleft--;
                } else {
                    chainofs = bytestream2_get_byte(&gb);
                    chainofs |= ((bytestream2_peek_byte(&gb) & 0xF0) << 4);
                    chainlen = (bytestream2_get_byte(&gb) & 0x0F) + 3;
                    if (chainlen == speclen) {
                        chainlen = bytestream2_get_byte(&gb) + 0xF + 3;
                    }
                    if (d_end - d < chainlen)
                        return AVERROR_INVALIDDATA;
                    for (j = 0; j < chainlen; j++) {
                        *d = queue[chainofs++ & QUEUE_MASK];
                        queue[qpos++] = *d++;
                        qpos &= QUEUE_MASK;
                    }
                    dataleft -= chainlen;
                }
                tag >>= 1;
            }
        }
    }
    return d - dest;
}
static int rle_unpack(const unsigned char *src, unsigned char *dest,
                      int src_count, int src_size, int dest_len)
{
    unsigned char *pd;
    int i, l, used = 0;
    unsigned char *dest_end = dest + dest_len;
    GetByteContext gb;
    uint16_t run_val;

    bytestream2_init(&gb, src, src_size);
    pd = dest;
    if (src_count & 1) {
        if (bytestream2_get_bytes_left(&gb) < 1)
            return 0;
        *pd++ = bytestream2_get_byteu(&gb);
        used++;
    }

    do {
        if (bytestream2_get_bytes_left(&gb) < 1)
            break;
        l = bytestream2_get_byteu(&gb);
        if (l & 0x80) {
            l = (l & 0x7F) * 2;
            if (dest_end - pd < l || bytestream2_get_bytes_left(&gb) < l)
                return bytestream2_tell(&gb);
            bytestream2_get_bufferu(&gb, pd, l);
            pd += l;
        } else {
            if (dest_end - pd < 2*l || bytestream2_get_bytes_left(&gb) < 2)
                return bytestream2_tell(&gb);
            run_val = bytestream2_get_ne16(&gb);
            for (i = 0; i < l; i++) {
                AV_WN16(pd, run_val);
                pd += 2;
            }
            l *= 2;
        }
        used += l;
    } while (used < src_count);

    return bytestream2_tell(&gb);
}

static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
{
    int i;
    unsigned int *palette32;
    unsigned char r, g, b;

    GetByteContext gb;

    unsigned char meth;
    unsigned char *dp;   /* pointer to current frame */
    unsigned char *pp;   /* pointer to previous frame */
    unsigned char len;
    int ofs;

    int frame_x, frame_y, prev_linesize;
    int frame_width, frame_height;

    frame_x = AV_RL16(&s->buf[6]);
    frame_y = AV_RL16(&s->buf[8]);
    frame_width = AV_RL16(&s->buf[10]) - frame_x + 1;
    frame_height = AV_RL16(&s->buf[12]) - frame_y + 1;

    if ((frame_width == s->avctx->width && frame_height == s->avctx->height) &&
        (frame_x || frame_y)) {

        s->x_off = frame_x;
        s->y_off = frame_y;
    }
    frame_x -= s->x_off;
    frame_y -= s->y_off;

    if (frame_x < 0 || frame_width < 0 ||
        frame_x >= s->avctx->width ||
        frame_width > s->avctx->width ||
        frame_x + frame_width > s->avctx->width) {
        av_log(s->avctx, AV_LOG_ERROR,
               "Invalid horizontal range %d-%d\n",
               frame_x, frame_width);
        return AVERROR_INVALIDDATA;
    }
    if (frame_y < 0 || frame_height < 0 ||
        frame_y >= s->avctx->height ||
        frame_height > s->avctx->height ||
        frame_y + frame_height > s->avctx->height) {
        av_log(s->avctx, AV_LOG_ERROR,
               "Invalid vertical range %d-%d\n",
               frame_y, frame_height);
        return AVERROR_INVALIDDATA;
    }

    /* if only a certain region will be updated, copy the entire previous
     * frame before the decode */
    if (s->prev_frame->data[0] &&
        (frame_x || frame_y || (frame_width != s->avctx->width) ||
        (frame_height != s->avctx->height))) {

        memcpy(frame->data[0], s->prev_frame->data[0],
            s->avctx->height * frame->linesize[0]);
    }

    /* check if there is a new palette */
    bytestream2_init(&gb, s->buf + 16, s->size - 16);
    if (s->buf[15] & 0x02) {
        bytestream2_skip(&gb, 2);
        palette32 = (unsigned int *)s->palette;
        if (bytestream2_get_bytes_left(&gb) >= PALETTE_COUNT * 3) {
            for (i = 0; i < PALETTE_COUNT; i++) {
                r = bytestream2_get_byteu(&gb) * 4;
                g = bytestream2_get_byteu(&gb) * 4;
                b = bytestream2_get_byteu(&gb) * 4;
                palette32[i] = 0xFFU << 24 | (r << 16) | (g << 8) | (b);
                palette32[i] |= palette32[i] >> 6 & 0x30303;
            }
        } else {
            av_log(s->avctx, AV_LOG_ERROR, "Incomplete palette\n");
            return AVERROR_INVALIDDATA;
        }
    }

    if (!s->size)
        return 0;

    /* originally UnpackFrame in VAG's code */
    if (bytestream2_get_bytes_left(&gb) < 1)
        return AVERROR_INVALIDDATA;
    meth = bytestream2_get_byteu(&gb);
    if (meth & 0x80) {
        int size;
        if (!s->unpack_buffer_size) {
            av_log(s->avctx, AV_LOG_ERROR,
                   "Trying to unpack LZ-compressed frame with no LZ buffer\n");
            return AVERROR_INVALIDDATA;
        }
        size = lz_unpack(gb.buffer, bytestream2_get_bytes_left(&gb),
                         s->unpack_buffer, s->unpack_buffer_size);
        if (size < 0)
            return size;
        meth &= 0x7F;
        bytestream2_init(&gb, s->unpack_buffer, size);
    }

    dp = &frame->data[0][frame_y * frame->linesize[0] + frame_x];
    if (s->prev_frame->data[0]) {
        prev_linesize = s->prev_frame->linesize[0];
        pp = s->prev_frame->data[0] + frame_y * prev_linesize + frame_x;
    } else {
        pp = NULL;
        prev_linesize = 0;
    }
    switch (meth) {
    case 1:
        for (i = 0; i < frame_height; i++) {
            ofs = 0;
            do {
                len = bytestream2_get_byte(&gb);
                if (len & 0x80) {
                    len = (len & 0x7F) + 1;
                    if (ofs + len > frame_width ||
                        bytestream2_get_bytes_left(&gb) < len)
                        return AVERROR_INVALIDDATA;
                    bytestream2_get_bufferu(&gb, &dp[ofs], len);
                    ofs += len;
                } else {
                    /* interframe pixel copy */
                    if (ofs + len + 1 > frame_width || !pp)
                        return AVERROR_INVALIDDATA;
                    memcpy(&dp[ofs], &pp[ofs], len + 1);
                    ofs += len + 1;
                }
            } while (ofs < frame_width);
            if (ofs > frame_width) {
                av_log(s->avctx, AV_LOG_ERROR,
                       "offset > width (%d > %d)\n",
                       ofs, frame_width);
                return AVERROR_INVALIDDATA;
            }
            dp += frame->linesize[0];
            pp  = FF_PTR_ADD(pp, prev_linesize);
        }
        break;

    case 2:
        for (i = 0; i < frame_height; i++) {
            bytestream2_get_buffer(&gb, dp, frame_width);
            dp += frame->linesize[0];
        }
        break;

    case 3:
        for (i = 0; i < frame_height; i++) {
            ofs = 0;
            do {
                len = bytestream2_get_byte(&gb);
                if (len & 0x80) {
                    len = (len & 0x7F) + 1;
                    if (bytestream2_peek_byte(&gb) == 0xFF) {
                        int slen = len;
                        bytestream2_get_byte(&gb);
                        len = rle_unpack(gb.buffer, &dp[ofs],
                                         len, bytestream2_get_bytes_left(&gb),
                                         frame_width - ofs);
                        ofs += slen;
                        bytestream2_skip(&gb, len);
                    } else {
                        if (ofs + len > frame_width ||
                            bytestream2_get_bytes_left(&gb) < len)
                            return AVERROR_INVALIDDATA;
                        bytestream2_get_buffer(&gb, &dp[ofs], len);
                        ofs += len;
                    }
                } else {
                    /* interframe pixel copy */
                    if (ofs + len + 1 > frame_width || !pp)
                        return AVERROR_INVALIDDATA;
                    memcpy(&dp[ofs], &pp[ofs], len + 1);
                    ofs += len + 1;
                }
            } while (ofs < frame_width);
            if (ofs > frame_width) {
                av_log(s->avctx, AV_LOG_ERROR,
                       "offset > width (%d > %d)\n",
                       ofs, frame_width);
                return AVERROR_INVALIDDATA;
            }
            dp += frame->linesize[0];
            pp  = FF_PTR_ADD(pp, prev_linesize);
        }
        break;
    }
    return 0;
}

static av_cold int vmdvideo_decode_end(AVCodecContext *avctx)
{
    VmdVideoContext *s = avctx->priv_data;

    av_frame_free(&s->prev_frame);
    av_freep(&s->unpack_buffer);
    s->unpack_buffer_size = 0;

    return 0;
}

static av_cold int vmdvideo_decode_init(AVCodecContext *avctx)
{
    VmdVideoContext *s = avctx->priv_data;
    int i;
    unsigned int *palette32;
    int palette_index = 0;
    unsigned char r, g, b;
    unsigned char *vmd_header;
    unsigned char *raw_palette;

    s->avctx = avctx;
    avctx->pix_fmt = AV_PIX_FMT_PAL8;

    /* make sure the VMD header made it */
    if (s->avctx->extradata_size != VMD_HEADER_SIZE) {
        av_log(s->avctx, AV_LOG_ERROR, "expected extradata size of %d\n",
            VMD_HEADER_SIZE);
        return AVERROR_INVALIDDATA;
    }
    vmd_header = (unsigned char *)avctx->extradata;

    s->unpack_buffer_size = AV_RL32(&vmd_header[800]);
    if (s->unpack_buffer_size) {
        s->unpack_buffer = av_malloc(s->unpack_buffer_size);
        if (!s->unpack_buffer)
            return AVERROR(ENOMEM);
    }

    /* load up the initial palette */
    raw_palette = &vmd_header[28];
    palette32 = (unsigned int *)s->palette;
    for (i = 0; i < PALETTE_COUNT; i++) {
        r = raw_palette[palette_index++] * 4;
        g = raw_palette[palette_index++] * 4;
        b = raw_palette[palette_index++] * 4;
        palette32[i] = 0xFFU << 24 | (r << 16) | (g << 8) | (b);
        palette32[i] |= palette32[i] >> 6 & 0x30303;
    }

    s->prev_frame = av_frame_alloc();
    if (!s->prev_frame) {
        vmdvideo_decode_end(avctx);
        return AVERROR(ENOMEM);
    }

    return 0;
}

static int vmdvideo_decode_frame(AVCodecContext *avctx,
                                 void *data, int *got_frame,
                                 AVPacket *avpkt)
{
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    VmdVideoContext *s = avctx->priv_data;
    AVFrame *frame = data;
    int ret;

    s->buf = buf;
    s->size = buf_size;

    if (buf_size < 16)
        return AVERROR_INVALIDDATA;

    if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0)
        return ret;

    if ((ret = vmd_decode(s, frame)) < 0)
        return ret;

    /* make the palette available on the way out */
    memcpy(frame->data[1], s->palette, PALETTE_COUNT * 4);

    /* shuffle frames */
    av_frame_unref(s->prev_frame);
    if ((ret = av_frame_ref(s->prev_frame, frame)) < 0)
        return ret;

    *got_frame      = 1;

    /* report that the buffer was completely consumed */
    return buf_size;
}

AVCodec ff_vmdvideo_decoder = {
    .name           = "vmdvideo",
    .long_name      = NULL_IF_CONFIG_SMALL("Sierra VMD video"),
    .type           = AVMEDIA_TYPE_VIDEO,
    .id             = AV_CODEC_ID_VMDVIDEO,
    .priv_data_size = sizeof(VmdVideoContext),
    .init           = vmdvideo_decode_init,
    .close          = vmdvideo_decode_end,
    .decode         = vmdvideo_decode_frame,
    .capabilities   = AV_CODEC_CAP_DR1,
};


Generated by: GCOVR (Version 4.2)

Line	Branch	Exec	Source
1			/*
2			* Sierra VMD video decoder
3			* Copyright (c) 2004 The FFmpeg Project
4			*
5			* This file is part of FFmpeg.
6			*
7			* FFmpeg is free software; you can redistribute it and/or
8			* modify it under the terms of the GNU Lesser General Public
9			* License as published by the Free Software Foundation; either
10			* version 2.1 of the License, or (at your option) any later version.
11			*
12			* FFmpeg is distributed in the hope that it will be useful,
13			* but WITHOUT ANY WARRANTY; without even the implied warranty of
14			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15			* Lesser General Public License for more details.
16			*
17			* You should have received a copy of the GNU Lesser General Public
18			* License along with FFmpeg; if not, write to the Free Software
19			* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20			*/
21
22			/**
23			* @file
24			* Sierra VMD video decoder
25			* by Vladimir "VAG" Gneushev (vagsoft at mail.ru)
26			* for more information on the Sierra VMD format, visit:
27			* http://www.pcisys.net/~melanson/codecs/
28			*
29			* The video decoder outputs PAL8 colorspace data. The decoder expects
30			* a 0x330-byte VMD file header to be transmitted via extradata during
31			* codec initialization. Each encoded frame that is sent to this decoder
32			* is expected to be prepended with the appropriate 16-byte frame
33			* information record from the VMD file.
34			*/
35
36			#include <string.h>
37
38			#include "libavutil/common.h"
39			#include "libavutil/intreadwrite.h"
40
41			#include "avcodec.h"
42			#include "internal.h"
43			#include "bytestream.h"
44
45			#define VMD_HEADER_SIZE 0x330
46			#define PALETTE_COUNT 256
47
48			typedef struct VmdVideoContext {
49
50			AVCodecContext *avctx;
51			AVFrame *prev_frame;
52
53			const unsigned char *buf;
54			int size;
55
56			unsigned char palette[PALETTE_COUNT * 4];
57			unsigned char *unpack_buffer;
58			int unpack_buffer_size;
59
60			int x_off, y_off;
61			} VmdVideoContext;
62
63			#define QUEUE_SIZE 0x1000
64			#define QUEUE_MASK 0x0FFF
65
66		128	static int lz_unpack(const unsigned char *src, int src_len,
67			unsigned char *dest, int dest_len)
68			{
69			unsigned char *d;
70			unsigned char *d_end;
71			unsigned char queue[QUEUE_SIZE];
72			unsigned int qpos;
73			unsigned int dataleft;
74			unsigned int chainofs;
75			unsigned int chainlen;
76			unsigned int speclen;
77			unsigned char tag;
78			unsigned int i, j;
79			GetByteContext gb;
80
81		128	bytestream2_init(&gb, src, src_len);
82		128	d = dest;
83		128	d_end = d + dest_len;
84		128	dataleft = bytestream2_get_le32(&gb);
85		128	memset(queue, 0x20, QUEUE_SIZE);
86	✗✓	128	if (bytestream2_get_bytes_left(&gb) < 4)
87			return AVERROR_INVALIDDATA;
88	✓✓	128	if (bytestream2_peek_le32(&gb) == 0x56781234) {
89		84	bytestream2_skipu(&gb, 4);
90		84	qpos = 0x111;
91		84	speclen = 0xF + 3;
92			} else {
93		44	qpos = 0xFEE;
94		44	speclen = 100; /* no speclen */
95			}
96
97	✓✓✓✗	20091	while (dataleft > 0 && bytestream2_get_bytes_left(&gb) > 0) {
98		19963	tag = bytestream2_get_byteu(&gb);
99	✓✓✓✓	19963	if ((tag == 0xFF) && (dataleft > 8)) {
100	✓✗✗✓	1814	if (d_end - d < 8 \|\| bytestream2_get_bytes_left(&gb) < 8)
101			return AVERROR_INVALIDDATA;
102	✓✓	16326	for (i = 0; i < 8; i++) {
103		14512	queue[qpos++] = *d++ = bytestream2_get_byteu(&gb);
104		14512	qpos &= QUEUE_MASK;
105			}
106		1814	dataleft -= 8;
107			} else {
108	✓✓	162858	for (i = 0; i < 8; i++) {
109	✓✓	144819	if (dataleft == 0)
110		110	break;
111	✓✓	144709	if (tag & 0x01) {
112	✓✗✗✓	84919	if (d_end - d < 1 \|\| bytestream2_get_bytes_left(&gb) < 1)
113			return AVERROR_INVALIDDATA;
114		84919	queue[qpos++] = *d++ = bytestream2_get_byteu(&gb);
115		84919	qpos &= QUEUE_MASK;
116		84919	dataleft--;
117			} else {
118		59790	chainofs = bytestream2_get_byte(&gb);
119		59790	chainofs \|= ((bytestream2_peek_byte(&gb) & 0xF0) << 4);
120		59790	chainlen = (bytestream2_get_byte(&gb) & 0x0F) + 3;
121	✓✓	59790	if (chainlen == speclen) {
122		7696	chainlen = bytestream2_get_byte(&gb) + 0xF + 3;
123			}
124	✗✓	59790	if (d_end - d < chainlen)
125			return AVERROR_INVALIDDATA;
126	✓✓	739328	for (j = 0; j < chainlen; j++) {
127		679538	*d = queue[chainofs++ & QUEUE_MASK];
128		679538	queue[qpos++] = *d++;
129		679538	qpos &= QUEUE_MASK;
130			}
131		59790	dataleft -= chainlen;
132			}
133		144709	tag >>= 1;
134			}
135			}
136			}
137		128	return d - dest;
138			}
139			static int rle_unpack(const unsigned char src, unsigned char dest,
140			int src_count, int src_size, int dest_len)
141			{
142			unsigned char *pd;
143			int i, l, used = 0;
144			unsigned char *dest_end = dest + dest_len;
145			GetByteContext gb;
146			uint16_t run_val;
147
148			bytestream2_init(&gb, src, src_size);
149			pd = dest;
150			if (src_count & 1) {
151			if (bytestream2_get_bytes_left(&gb) < 1)
152			return 0;
153			*pd++ = bytestream2_get_byteu(&gb);
154			used++;
155			}
156
157			do {
158			if (bytestream2_get_bytes_left(&gb) < 1)
159			break;
160			l = bytestream2_get_byteu(&gb);
161			if (l & 0x80) {
162			l = (l & 0x7F) * 2;
163			if (dest_end - pd < l \|\| bytestream2_get_bytes_left(&gb) < l)
164			return bytestream2_tell(&gb);
165			bytestream2_get_bufferu(&gb, pd, l);
166			pd += l;
167			} else {
168			if (dest_end - pd < 2*l \|\| bytestream2_get_bytes_left(&gb) < 2)
169			return bytestream2_tell(&gb);
170			run_val = bytestream2_get_ne16(&gb);
171			for (i = 0; i < l; i++) {
172			AV_WN16(pd, run_val);
173			pd += 2;
174			}
175			l *= 2;
176			}
177			used += l;
178			} while (used < src_count);
179
180			return bytestream2_tell(&gb);
181			}
182
183		137	static int vmd_decode(VmdVideoContext s, AVFrame frame)
184			{
185			int i;
186			unsigned int *palette32;
187			unsigned char r, g, b;
188
189			GetByteContext gb;
190
191			unsigned char meth;
192			unsigned char dp; / pointer to current frame */
193			unsigned char pp; / pointer to previous frame */
194			unsigned char len;
195			int ofs;
196
197			int frame_x, frame_y, prev_linesize;
198			int frame_width, frame_height;
199
200		137	frame_x = AV_RL16(&s->buf[6]);
201		137	frame_y = AV_RL16(&s->buf[8]);
202		137	frame_width = AV_RL16(&s->buf[10]) - frame_x + 1;
203		137	frame_height = AV_RL16(&s->buf[12]) - frame_y + 1;
204
205	✓✓✓✓ ✓✗	137	if ((frame_width == s->avctx->width && frame_height == s->avctx->height) &&
206	✗✓	6	(frame_x \|\| frame_y)) {
207
208			s->x_off = frame_x;
209			s->y_off = frame_y;
210			}
211		137	frame_x -= s->x_off;
212		137	frame_y -= s->y_off;
213
214	✓✗✓✗	137	if (frame_x < 0 \|\| frame_width < 0 \|\|
215	✓✗	137	frame_x >= s->avctx->width \|\|
216	✓✗	137	frame_width > s->avctx->width \|\|
217	✗✓	137	frame_x + frame_width > s->avctx->width) {
218			av_log(s->avctx, AV_LOG_ERROR,
219			"Invalid horizontal range %d-%d\n",
220			frame_x, frame_width);
221			return AVERROR_INVALIDDATA;
222			}
223	✓✗✓✗	137	if (frame_y < 0 \|\| frame_height < 0 \|\|
224	✓✗	137	frame_y >= s->avctx->height \|\|
225	✓✗	137	frame_height > s->avctx->height \|\|
226	✗✓	137	frame_y + frame_height > s->avctx->height) {
227			av_log(s->avctx, AV_LOG_ERROR,
228			"Invalid vertical range %d-%d\n",
229			frame_y, frame_height);
230			return AVERROR_INVALIDDATA;
231			}
232
233			/* if only a certain region will be updated, copy the entire previous
234			* frame before the decode */
235	✓✓✓✓	137	if (s->prev_frame->data[0] &&
236	✓✓✓✗	8	(frame_x \|\| frame_y \|\| (frame_width != s->avctx->width) \|\|
237	✓✓	5	(frame_height != s->avctx->height))) {
238
239		131	memcpy(frame->data[0], s->prev_frame->data[0],
240		131	s->avctx->height * frame->linesize[0]);
241			}
242
243			/* check if there is a new palette */
244		137	bytestream2_init(&gb, s->buf + 16, s->size - 16);
245	✗✓	137	if (s->buf[15] & 0x02) {
246			bytestream2_skip(&gb, 2);
247			palette32 = (unsigned int *)s->palette;
248			if (bytestream2_get_bytes_left(&gb) >= PALETTE_COUNT * 3) {
249			for (i = 0; i < PALETTE_COUNT; i++) {
250			r = bytestream2_get_byteu(&gb) * 4;
251			g = bytestream2_get_byteu(&gb) * 4;
252			b = bytestream2_get_byteu(&gb) * 4;
253			palette32[i] = 0xFFU << 24 \| (r << 16) \| (g << 8) \| (b);
254			palette32[i] \|= palette32[i] >> 6 & 0x30303;
255			}
256			} else {
257			av_log(s->avctx, AV_LOG_ERROR, "Incomplete palette\n");
258			return AVERROR_INVALIDDATA;
259			}
260			}
261
262	✗✓	137	if (!s->size)
263			return 0;
264
265			/* originally UnpackFrame in VAG's code */
266	✗✓	137	if (bytestream2_get_bytes_left(&gb) < 1)
267			return AVERROR_INVALIDDATA;
268		137	meth = bytestream2_get_byteu(&gb);
269	✓✓	137	if (meth & 0x80) {
270			int size;
271	✗✓	128	if (!s->unpack_buffer_size) {
272			av_log(s->avctx, AV_LOG_ERROR,
273			"Trying to unpack LZ-compressed frame with no LZ buffer\n");
274			return AVERROR_INVALIDDATA;
275			}
276		128	size = lz_unpack(gb.buffer, bytestream2_get_bytes_left(&gb),
277			s->unpack_buffer, s->unpack_buffer_size);
278	✗✓	128	if (size < 0)
279			return size;
280		128	meth &= 0x7F;
281		128	bytestream2_init(&gb, s->unpack_buffer, size);
282			}
283
284		137	dp = &frame->data[0][frame_y * frame->linesize[0] + frame_x];
285	✓✓	137	if (s->prev_frame->data[0]) {
286		135	prev_linesize = s->prev_frame->linesize[0];
287		135	pp = s->prev_frame->data[0] + frame_y * prev_linesize + frame_x;
288			} else {
289		2	pp = NULL;
290		2	prev_linesize = 0;
291			}
292	✓✓✗✗	137	switch (meth) {
293		131	case 1:
294	✓✓	11919	for (i = 0; i < frame_height; i++) {
295		11788	ofs = 0;
296			do {
297		56026	len = bytestream2_get_byte(&gb);
298	✓✓	56026	if (len & 0x80) {
299		21508	len = (len & 0x7F) + 1;
300	✓✗	21508	if (ofs + len > frame_width \|\|
301	✗✓	21508	bytestream2_get_bytes_left(&gb) < len)
302			return AVERROR_INVALIDDATA;
303		21508	bytestream2_get_bufferu(&gb, &dp[ofs], len);
304		21508	ofs += len;
305			} else {
306			/* interframe pixel copy */
307	✓✗✗✓	34518	if (ofs + len + 1 > frame_width \|\| !pp)
308			return AVERROR_INVALIDDATA;
309		34518	memcpy(&dp[ofs], &pp[ofs], len + 1);
310		34518	ofs += len + 1;
311			}
312	✓✓	56026	} while (ofs < frame_width);
313	✗✓	11788	if (ofs > frame_width) {
314			av_log(s->avctx, AV_LOG_ERROR,
315			"offset > width (%d > %d)\n",
316			ofs, frame_width);
317			return AVERROR_INVALIDDATA;
318			}
319		11788	dp += frame->linesize[0];
320	✓✗	11788	pp = FF_PTR_ADD(pp, prev_linesize);
321			}
322		131	break;
323
324		6	case 2:
325	✓✓	771	for (i = 0; i < frame_height; i++) {
326		765	bytestream2_get_buffer(&gb, dp, frame_width);
327		765	dp += frame->linesize[0];
328			}
329		6	break;
330
331			case 3:
332			for (i = 0; i < frame_height; i++) {
333			ofs = 0;
334			do {
335			len = bytestream2_get_byte(&gb);
336			if (len & 0x80) {
337			len = (len & 0x7F) + 1;
338			if (bytestream2_peek_byte(&gb) == 0xFF) {
339			int slen = len;
340			bytestream2_get_byte(&gb);
341			len = rle_unpack(gb.buffer, &dp[ofs],
342			len, bytestream2_get_bytes_left(&gb),
343			frame_width - ofs);
344			ofs += slen;
345			bytestream2_skip(&gb, len);
346			} else {
347			if (ofs + len > frame_width \|\|
348			bytestream2_get_bytes_left(&gb) < len)
349			return AVERROR_INVALIDDATA;
350			bytestream2_get_buffer(&gb, &dp[ofs], len);
351			ofs += len;
352			}
353			} else {
354			/* interframe pixel copy */
355			if (ofs + len + 1 > frame_width \|\| !pp)
356			return AVERROR_INVALIDDATA;
357			memcpy(&dp[ofs], &pp[ofs], len + 1);
358			ofs += len + 1;
359			}
360			} while (ofs < frame_width);
361			if (ofs > frame_width) {
362			av_log(s->avctx, AV_LOG_ERROR,
363			"offset > width (%d > %d)\n",
364			ofs, frame_width);
365			return AVERROR_INVALIDDATA;
366			}
367			dp += frame->linesize[0];
368			pp = FF_PTR_ADD(pp, prev_linesize);
369			}
370			break;
371			}
372		137	return 0;
373			}
374
375		5	static av_cold int vmdvideo_decode_end(AVCodecContext *avctx)
376			{
377		5	VmdVideoContext *s = avctx->priv_data;
378
379		5	av_frame_free(&s->prev_frame);
380		5	av_freep(&s->unpack_buffer);
381		5	s->unpack_buffer_size = 0;
382
383		5	return 0;
384			}
385
386		5	static av_cold int vmdvideo_decode_init(AVCodecContext *avctx)
387			{
388		5	VmdVideoContext *s = avctx->priv_data;
389			int i;
390			unsigned int *palette32;
391		5	int palette_index = 0;
392			unsigned char r, g, b;
393			unsigned char *vmd_header;
394			unsigned char *raw_palette;
395
396		5	s->avctx = avctx;
397		5	avctx->pix_fmt = AV_PIX_FMT_PAL8;
398
399			/* make sure the VMD header made it */
400	✗✓	5	if (s->avctx->extradata_size != VMD_HEADER_SIZE) {
401			av_log(s->avctx, AV_LOG_ERROR, "expected extradata size of %d\n",
402			VMD_HEADER_SIZE);
403			return AVERROR_INVALIDDATA;
404			}
405		5	vmd_header = (unsigned char *)avctx->extradata;
406
407		5	s->unpack_buffer_size = AV_RL32(&vmd_header[800]);
408	✓✗	5	if (s->unpack_buffer_size) {
409		5	s->unpack_buffer = av_malloc(s->unpack_buffer_size);
410	✗✓	5	if (!s->unpack_buffer)
411			return AVERROR(ENOMEM);
412			}
413
414			/* load up the initial palette */
415		5	raw_palette = &vmd_header[28];
416		5	palette32 = (unsigned int *)s->palette;
417	✓✓	1285	for (i = 0; i < PALETTE_COUNT; i++) {
418		1280	r = raw_palette[palette_index++] * 4;
419		1280	g = raw_palette[palette_index++] * 4;
420		1280	b = raw_palette[palette_index++] * 4;
421		1280	palette32[i] = 0xFFU << 24 \| (r << 16) \| (g << 8) \| (b);
422		1280	palette32[i] \|= palette32[i] >> 6 & 0x30303;
423			}
424
425		5	s->prev_frame = av_frame_alloc();
426	✗✓	5	if (!s->prev_frame) {
427			vmdvideo_decode_end(avctx);
428			return AVERROR(ENOMEM);
429			}
430
431		5	return 0;
432			}
433
434		137	static int vmdvideo_decode_frame(AVCodecContext *avctx,
435			void data, int got_frame,
436			AVPacket *avpkt)
437			{
438		137	const uint8_t *buf = avpkt->data;
439		137	int buf_size = avpkt->size;
440		137	VmdVideoContext *s = avctx->priv_data;
441		137	AVFrame *frame = data;
442			int ret;
443
444		137	s->buf = buf;
445		137	s->size = buf_size;
446
447	✗✓	137	if (buf_size < 16)
448			return AVERROR_INVALIDDATA;
449
450	✗✓	137	if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0)
451			return ret;
452
453	✗✓	137	if ((ret = vmd_decode(s, frame)) < 0)
454			return ret;
455
456			/* make the palette available on the way out */
457		137	memcpy(frame->data[1], s->palette, PALETTE_COUNT * 4);
458
459			/* shuffle frames */
460		137	av_frame_unref(s->prev_frame);
461	✗✓	137	if ((ret = av_frame_ref(s->prev_frame, frame)) < 0)
462			return ret;
463
464		137	*got_frame = 1;
465
466			/* report that the buffer was completely consumed */
467		137	return buf_size;
468			}
469
470			AVCodec ff_vmdvideo_decoder = {
471			.name = "vmdvideo",
472			.long_name = NULL_IF_CONFIG_SMALL("Sierra VMD video"),
473			.type = AVMEDIA_TYPE_VIDEO,
474			.id = AV_CODEC_ID_VMDVIDEO,
475			.priv_data_size = sizeof(VmdVideoContext),
476			.init = vmdvideo_decode_init,
477			.close = vmdvideo_decode_end,
478			.decode = vmdvideo_decode_frame,
479			.capabilities = AV_CODEC_CAP_DR1,
480			};