* Decode inter-frame * @return 0 on success, -1 on critical buffer underflow */
| 146 | * @return 0 on success, -1 on critical buffer underflow |
| 147 | */ |
| 148 | static int tgv_decode_inter(TgvContext *s, AVFrame *frame, |
| 149 | const uint8_t *buf, const uint8_t *buf_end) |
| 150 | { |
| 151 | int num_mvs; |
| 152 | int num_blocks_raw; |
| 153 | int num_blocks_packed; |
| 154 | int vector_bits; |
| 155 | int i,j,x,y; |
| 156 | GetBitContext gb; |
| 157 | int mvbits; |
| 158 | const uint8_t *blocks_raw; |
| 159 | |
| 160 | if(buf_end - buf < 12) |
| 161 | return AVERROR_INVALIDDATA; |
| 162 | |
| 163 | num_mvs = AV_RL16(&buf[0]); |
| 164 | num_blocks_raw = AV_RL16(&buf[2]); |
| 165 | num_blocks_packed = AV_RL16(&buf[4]); |
| 166 | vector_bits = AV_RL16(&buf[6]); |
| 167 | buf += 12; |
| 168 | |
| 169 | if (vector_bits > MIN_CACHE_BITS || !vector_bits) { |
| 170 | av_log(s->avctx, AV_LOG_ERROR, |
| 171 | "Invalid value for motion vector bits: %d\n", vector_bits); |
| 172 | return AVERROR_INVALIDDATA; |
| 173 | } |
| 174 | |
| 175 | /* allocate codebook buffers as necessary */ |
| 176 | if (num_mvs > s->num_mvs) { |
| 177 | int err = av_reallocp_array(&s->mv_codebook, num_mvs, sizeof(*s->mv_codebook)); |
| 178 | if (err < 0) { |
| 179 | s->num_mvs = 0; |
| 180 | return err; |
| 181 | } |
| 182 | s->num_mvs = num_mvs; |
| 183 | } |
| 184 | |
| 185 | if (num_blocks_packed > s->num_blocks_packed) { |
| 186 | int err; |
| 187 | if ((err = av_reallocp(&s->block_codebook, num_blocks_packed * 16)) < 0) { |
| 188 | s->num_blocks_packed = 0; |
| 189 | return err; |
| 190 | } |
| 191 | s->num_blocks_packed = num_blocks_packed; |
| 192 | } |
| 193 | |
| 194 | /* read motion vectors */ |
| 195 | mvbits = (num_mvs * 2 * 10 + 31) & ~31; |
| 196 | |
| 197 | if (buf_end - buf < (mvbits>>3) + 16*num_blocks_raw + 8*num_blocks_packed) |
| 198 | return AVERROR_INVALIDDATA; |
| 199 | |
| 200 | init_get_bits(&gb, buf, mvbits); |
| 201 | for (i = 0; i < num_mvs; i++) { |
| 202 | s->mv_codebook[i][0] = get_sbits(&gb, 10); |
| 203 | s->mv_codebook[i][1] = get_sbits(&gb, 10); |
| 204 | } |
| 205 | buf += mvbits >> 3; |
no test coverage detected