| 496 | } |
| 497 | |
| 498 | static int read_header(FFV1Context *f, RangeCoder *c) |
| 499 | { |
| 500 | uint8_t state[CONTEXT_SIZE]; |
| 501 | int context_count = -1; //-1 to avoid warning |
| 502 | int ret; |
| 503 | |
| 504 | memset(state, 128, sizeof(state)); |
| 505 | |
| 506 | ret = ff_ffv1_parse_header(f, c, state); |
| 507 | if (ret < 0) |
| 508 | return ret; |
| 509 | |
| 510 | if (f->configured_pix_fmt != f->pix_fmt || |
| 511 | f->configured_width != f->width || |
| 512 | f->configured_height != f->height || |
| 513 | f->configured_ac != f->ac) { |
| 514 | f->avctx->pix_fmt = get_pixel_format(f); |
| 515 | if (f->avctx->pix_fmt < 0) |
| 516 | return AVERROR(EINVAL); |
| 517 | f->configured_pix_fmt = f->pix_fmt; |
| 518 | f->configured_width = f->width; |
| 519 | f->configured_height = f->height; |
| 520 | f->configured_ac = f->ac; |
| 521 | } |
| 522 | |
| 523 | ff_dlog(f->avctx, "%d %d %d\n", |
| 524 | f->chroma_h_shift, f->chroma_v_shift, f->pix_fmt); |
| 525 | if (f->version < 2) { |
| 526 | context_count = ff_ffv1_read_quant_tables(c, f->quant_tables[0]); |
| 527 | if (context_count < 0) { |
| 528 | av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\n"); |
| 529 | return AVERROR_INVALIDDATA; |
| 530 | } |
| 531 | f->slice_count = f->max_slice_count; |
| 532 | } else if (f->version < 3) { |
| 533 | f->slice_count = ff_ffv1_get_symbol(c, state, 0); |
| 534 | } else { |
| 535 | const uint8_t *p = c->bytestream_end; |
| 536 | for (f->slice_count = 0; |
| 537 | f->slice_count < MAX_SLICES && 3 + 5*!!f->ec < p - c->bytestream_start; |
| 538 | f->slice_count++) { |
| 539 | int trailer = 3 + 5*!!f->ec; |
| 540 | int size = AV_RB24(p-trailer); |
| 541 | if (size + trailer > p - c->bytestream_start) |
| 542 | break; |
| 543 | p -= size + trailer; |
| 544 | } |
| 545 | } |
| 546 | if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0 || f->slice_count > f->max_slice_count) { |
| 547 | av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid (max=%d)\n", f->slice_count, f->max_slice_count); |
| 548 | return AVERROR_INVALIDDATA; |
| 549 | } |
| 550 | |
| 551 | av_refstruct_unref(&f->slice_damaged); |
| 552 | f->slice_damaged = av_refstruct_allocz(f->slice_count * sizeof(*f->slice_damaged)); |
| 553 | if (!f->slice_damaged) |
| 554 | return AVERROR(ENOMEM); |
| 555 |
no test coverage detected