| 218 | } |
| 219 | |
| 220 | static int decode_frame(AVCodecContext *avctx, |
| 221 | AVFrame *frame, int *got_frame, |
| 222 | AVPacket *avpkt) |
| 223 | { |
| 224 | VMIXContext *s = avctx->priv_data; |
| 225 | unsigned offset, q; |
| 226 | int ret; |
| 227 | |
| 228 | if (avpkt->size <= 7) |
| 229 | return AVERROR_INVALIDDATA; |
| 230 | |
| 231 | s->lshift = 0; |
| 232 | offset = 2 + avpkt->data[0]; |
| 233 | if (offset == 5) |
| 234 | s->lshift = avpkt->data[1]; |
| 235 | else if (offset != 3) |
| 236 | return AVERROR_INVALIDDATA; |
| 237 | |
| 238 | if (s->lshift > 31) |
| 239 | return AVERROR_INVALIDDATA; |
| 240 | |
| 241 | q = quality[FFMIN(avpkt->data[offset - 2], FF_ARRAY_ELEMS(quality)-1)]; |
| 242 | for (int n = 0; n < 64; n++) |
| 243 | s->factors[n] = quant[n] * q; |
| 244 | |
| 245 | s->nb_slices = (avctx->height + 15) / 16; |
| 246 | av_fast_mallocz(&s->slices, &s->slices_size, s->nb_slices * sizeof(*s->slices)); |
| 247 | if (!s->slices) |
| 248 | return AVERROR(ENOMEM); |
| 249 | |
| 250 | for (int n = 0; n < s->nb_slices; n++) { |
| 251 | unsigned slice_size; |
| 252 | |
| 253 | if (offset + 4 > avpkt->size) |
| 254 | return AVERROR_INVALIDDATA; |
| 255 | |
| 256 | slice_size = AV_RL32(avpkt->data + offset); |
| 257 | if (slice_size > avpkt->size) |
| 258 | return AVERROR_INVALIDDATA; |
| 259 | |
| 260 | if (avpkt->size - slice_size - 4LL < offset) |
| 261 | return AVERROR_INVALIDDATA; |
| 262 | |
| 263 | s->slices[n].dc_size = slice_size; |
| 264 | s->slices[n].dc_ptr = avpkt->data + offset + 4; |
| 265 | offset += slice_size + 4; |
| 266 | } |
| 267 | |
| 268 | for (int n = 0; n < s->nb_slices; n++) { |
| 269 | unsigned slice_size; |
| 270 | |
| 271 | if (offset + 4 > avpkt->size) |
| 272 | return AVERROR_INVALIDDATA; |
| 273 | |
| 274 | slice_size = AV_RL32(avpkt->data + offset); |
| 275 | if (slice_size > avpkt->size) |
| 276 | return AVERROR_INVALIDDATA; |
| 277 |
nothing calls this directly
no test coverage detected