| 627 | } |
| 628 | |
| 629 | static int find_next_slice(AVCodecContext *avctx, |
| 630 | uint8_t *buf, uint8_t *buf_end, int idx, |
| 631 | uint8_t **pos, uint32_t *len) |
| 632 | { |
| 633 | FFV1Context *f = avctx->priv_data; |
| 634 | |
| 635 | /* Length field */ |
| 636 | uint32_t v = buf_end - buf; |
| 637 | if (idx || f->version > 2) { |
| 638 | /* Three bytes of length, plus flush bit + CRC */ |
| 639 | uint32_t trailer = 3 + 5*!!f->ec; |
| 640 | if (trailer > buf_end - buf) |
| 641 | v = INT_MAX; |
| 642 | else |
| 643 | v = AV_RB24(buf_end - trailer) + trailer; |
| 644 | } |
| 645 | |
| 646 | if (buf_end - buf < v) { |
| 647 | av_log(avctx, AV_LOG_ERROR, "Slice pointer chain broken\n"); |
| 648 | ff_progress_frame_report(&f->picture, INT_MAX); |
| 649 | return AVERROR_INVALIDDATA; |
| 650 | } |
| 651 | |
| 652 | *len = v; |
| 653 | if (idx) |
| 654 | *pos = buf_end - v; |
| 655 | else |
| 656 | *pos = buf; |
| 657 | |
| 658 | return 0; |
| 659 | } |
| 660 | |
| 661 | static int decode_header(AVCodecContext *avctx, RangeCoder *c, |
| 662 | uint8_t *buf, size_t buf_size) |
no test coverage detected