From: Alexandre Colucci <[email protected]>

These have a DXSA tag and contain alpha in addition to
color values for palette.

Signed-off-by: Jean-Baptiste Kempf <[email protected]>
Signed-off-by: Luca Barbato <[email protected]>
---

The bound check should be updated (otherwise you can craft evil
packets that read over the buffer).

Having branches in loops isn't that nice.

For the rest looks nice to me, if you have a sample I'd like
to test my changes.

 libavcodec/xsubdec.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/libavcodec/xsubdec.c b/libavcodec/xsubdec.c
index 3d85973..452d281 100644
--- a/libavcodec/xsubdec.c
+++ b/libavcodec/xsubdec.c
@@ -56,11 +56,12 @@ static int decode_frame(AVCodecContext *avctx, void *data, 
int *data_size,
     int w, h, x, y, i;
     int64_t packet_time = 0;
     GetBitContext gb;
+    int has_alpha = avctx->codec_tag == MKTAG('D','X','S','A');

     memset(sub, 0, sizeof(*sub));

     // check that at least header fits
-    if (buf_size < 27 + 7 * 2 + 4 * 3) {
+    if (buf_size < 27 + 7 * 2 + 4 * (3 + has_alpha)) {
         av_log(avctx, AV_LOG_ERROR, "coded frame too small\n");
         return -1;
     }
@@ -107,9 +108,15 @@ static int decode_frame(AVCodecContext *avctx, void *data, 
int *data_size,
     // read palette
     for (i = 0; i < sub->rects[0]->nb_colors; i++)
         ((uint32_t*)sub->rects[0]->pict.data[1])[i] = 
bytestream_get_be24(&buf);
-    // make all except background (first entry) non-transparent
-    for (i = 1; i < sub->rects[0]->nb_colors; i++)
-        ((uint32_t*)sub->rects[0]->pict.data[1])[i] |= 0xff000000;
+
+    if (!has_alpha) {
+        // make all except background (first entry) non-transparent
+        for (i = 1; i < sub->rects[0]->nb_colors; i++)
+            ((uint32_t*)sub->rects[0]->pict.data[1])[i] |= 0xff000000;
+    } else {
+        for (i = 0; i < sub->rects[0]->nb_colors; i++)
+            ((uint32_t*)sub->rects[0]->pict.data[1])[i] |= *buf++ << 24;
+    }

     // process RLE-compressed data
     init_get_bits(&gb, buf, (buf_end - buf) * 8);
--
2.1.0

_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to