mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2026-08-09 01:21:06 +00:00
avcodec/vulkan/ffv1_dec_setup: reject a remap that produces zero entries
This commit is contained in:
committed by
michaelni
parent
533a3c254d
commit
cc82fdfbd4
@@ -91,7 +91,7 @@ int decode_current_mul(uint ctx_off, int mul_count, int64_t i)
|
||||
return mul[ndx];
|
||||
}
|
||||
|
||||
void decode_remap(uint slice_idx, inout SliceContext sc)
|
||||
bool decode_remap(uint slice_idx, inout SliceContext sc)
|
||||
{
|
||||
uint end = uint(rct_offset - 1);
|
||||
uint flip_mask = end ^ (end >> 1);
|
||||
@@ -106,10 +106,8 @@ void decode_remap(uint slice_idx, inout SliceContext sc)
|
||||
rc_state[k] = uint8_t(128);
|
||||
|
||||
int mul_count = int(get_usymbol(0));
|
||||
if (mul_count > 4096) {
|
||||
sc.remap_count[p] = j;
|
||||
return;
|
||||
}
|
||||
if (mul_count > 4096)
|
||||
return true;
|
||||
for (int mi = 0; mi < mul_count; mi++)
|
||||
mul[mi] = -1;
|
||||
mul[mul_count] = 1;
|
||||
@@ -131,10 +129,8 @@ void decode_remap(uint slice_idx, inout SliceContext sc)
|
||||
run1--;
|
||||
if (current_mul > 1) {
|
||||
int delta = get_isymbol(uint(lu*3 + 1)*CONTEXT_SIZE);
|
||||
if (delta <= -current_mul || delta > current_mul/2) {
|
||||
sc.remap_count[p] = j;
|
||||
return;
|
||||
}
|
||||
if (delta <= -current_mul || delta > current_mul/2)
|
||||
return true;
|
||||
i += int64_t(current_mul - 1 + delta);
|
||||
}
|
||||
if (i - 1 >= int64_t(end))
|
||||
@@ -148,8 +144,12 @@ void decode_remap(uint slice_idx, inout SliceContext sc)
|
||||
i += int64_t(current_mul);
|
||||
lu ^= int(run == 0u);
|
||||
}
|
||||
if (j == 0)
|
||||
return true;
|
||||
sc.remap_count[p] = j;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
bool decode_slice_header(uint slice_idx, inout SliceContext sc)
|
||||
@@ -200,8 +200,8 @@ bool decode_slice_header(uint slice_idx, inout SliceContext sc)
|
||||
|
||||
if (micro_version >= 4) {
|
||||
sc.remap = get_usymbol(0);
|
||||
if (sc.remap != 0)
|
||||
decode_remap(slice_idx, sc);
|
||||
if (sc.remap != 0 && decode_remap(slice_idx, sc))
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user