I'm not sure how I would write it in a way that isn't a repetition of the new definition of ctx->tex_size
On Sun, Jan 28, 2024 at 11:52 PM Andreas Rheinhardt < andreas.rheinha...@outlook.com> wrote: > Connor Worley: > > Signed-off-by: Connor Worley <connorbwor...@gmail.com> > > --- > > libavcodec/dxv.c | 53 ++++++++---------------------------------------- > > 1 file changed, 9 insertions(+), 44 deletions(-) > > > > diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c > > index cae5d8a92f..b29adf8ad9 100644 > > --- a/libavcodec/dxv.c > > +++ b/libavcodec/dxv.c > > @@ -39,20 +39,12 @@ typedef struct DXVContext { > > > > uint8_t *tex_data; // Compressed texture > > uint8_t *ctex_data; // Compressed chroma texture > > - int tex_rat; // Compression ratio > > - int tex_step; // Distance between blocks > > - int ctex_step; // Distance between blocks > > + > > int64_t tex_size; // Texture size > > int64_t ctex_size; // Chroma texture size > > > > uint8_t *op_data[4]; // Opcodes > > int64_t op_size[4]; // Opcodes size > > - > > - int texture_block_w; > > - int texture_block_h; > > - > > - int ctexture_block_w; > > - int ctexture_block_h; > > } DXVContext; > > > > /* This scheme addresses already decoded elements depending on 2-bit > status: > > @@ -865,9 +857,6 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame > *frame, > > cavctx.coded_height = avctx->coded_height / 2; > > cavctx.coded_width = avctx->coded_width / 2; > > > > - ctx->texture_block_h = 4; > > - ctx->texture_block_w = 4; > > - > > avctx->pix_fmt = AV_PIX_FMT_RGBA; > > avctx->colorspace = AVCOL_SPC_RGB; > > > > @@ -878,8 +867,6 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame > *frame, > > texdsp_ctx.tex_funct = ctx->texdsp.dxt1_block; > > texdsp_ctx.tex_ratio = 8; > > texdsp_ctx.raw_ratio = 16; > > - ctx->tex_rat = 8; > > - ctx->tex_step = 8; > > msgcomp = "DXTR1"; > > msgtext = "DXT1"; > > break; > > @@ -888,8 +875,6 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame > *frame, > > texdsp_ctx.tex_funct = ctx->texdsp.dxt5_block; > > texdsp_ctx.tex_ratio = 16; > > texdsp_ctx.raw_ratio = 16; > > - ctx->tex_rat = 4; > > - ctx->tex_step = 16; > > msgcomp = "DXTR5"; > > msgtext = "DXT5"; > > break; > > @@ -901,16 +886,8 @@ static int dxv_decode(AVCodecContext *avctx, > AVFrame *frame, > > ctexdsp_ctx.tex_funct = ctx->texdsp.rgtc1u_gray_block; > > ctexdsp_ctx.tex_ratio = 16; > > ctexdsp_ctx.raw_ratio = 4; > > - ctx->tex_rat = 8; > > - ctx->tex_step = 32; > > - ctx->ctex_step = 16; > > msgcomp = "YOCOCG6"; > > msgtext = "YCG6"; > > - ctx->ctex_size = avctx->coded_width * avctx->coded_height / 4; > > - ctx->texture_block_h = 4; > > - ctx->texture_block_w = 16; > > - ctx->ctexture_block_h = 4; > > - ctx->ctexture_block_w = 4; > > avctx->pix_fmt = AV_PIX_FMT_YUV420P; > > avctx->colorspace = AVCOL_SPC_YCOCG; > > break; > > @@ -922,16 +899,8 @@ static int dxv_decode(AVCodecContext *avctx, > AVFrame *frame, > > ctexdsp_ctx.tex_funct = ctx->texdsp.rgtc1u_gray_block; > > ctexdsp_ctx.tex_ratio = 16; > > ctexdsp_ctx.raw_ratio = 4; > > - ctx->tex_rat = 4; > > - ctx->tex_step = 64; > > - ctx->ctex_step = 16; > > msgcomp = "YAOCOCG10"; > > msgtext = "YG10"; > > - ctx->ctex_size = avctx->coded_width * avctx->coded_height / 4; > > - ctx->texture_block_h = 4; > > - ctx->texture_block_w = 16; > > - ctx->ctexture_block_h = 4; > > - ctx->ctexture_block_w = 4; > > avctx->pix_fmt = AV_PIX_FMT_YUVA420P; > > avctx->colorspace = AVCOL_SPC_YCOCG; > > break; > > @@ -956,7 +925,6 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame > *frame, > > texdsp_ctx.tex_funct = ctx->texdsp.dxt5_block; > > texdsp_ctx.tex_ratio = 16; > > texdsp_ctx.raw_ratio = 16; > > - ctx->tex_step = 16; > > } else if (old_type & 0x20 || version_major == 1) { > > tag = DXV_FMT_DXT1; > > msgtext = "DXT1"; > > @@ -964,12 +932,10 @@ static int dxv_decode(AVCodecContext *avctx, > AVFrame *frame, > > texdsp_ctx.tex_funct = ctx->texdsp.dxt1_block; > > texdsp_ctx.tex_ratio = 8; > > texdsp_ctx.raw_ratio = 16; > > - ctx->tex_step = 8; > > } else { > > av_log(avctx, AV_LOG_ERROR, "Unsupported header > (0x%08"PRIX32")\n.", tag); > > return AVERROR_INVALIDDATA; > > } > > - ctx->tex_rat = 1; > > break; > > } > > > > @@ -985,7 +951,6 @@ static int dxv_decode(AVCodecContext *avctx, AVFrame > *frame, > > /* Encoder copies texture data when compression is not > advantageous. */ > > if (bytestream2_get_byte(gbc)) { > > msgcomp = "RAW"; > > - ctx->tex_rat = 1; > > decompress_tex = dxv_decompress_raw; > > } > > > > @@ -1003,14 +968,20 @@ static int dxv_decode(AVCodecContext *avctx, > AVFrame *frame, > > return AVERROR_INVALIDDATA; > > } > > > > - ctx->tex_size = avctx->coded_width * avctx->coded_height * 4 / > ctx->tex_rat; > > + ctx->tex_size = avctx->coded_width / (texdsp_ctx.raw_ratio / > (avctx->pix_fmt == AV_PIX_FMT_RGBA ? 4 : 1)) * > > + avctx->coded_height / TEXTURE_BLOCK_H * > > + texdsp_ctx.tex_ratio; > > ret = av_reallocp(&ctx->tex_data, ctx->tex_size + > AV_INPUT_BUFFER_PADDING_SIZE); > > if (ret < 0) > > return ret; > > > > - if (ctx->ctex_size) { > > + if (avctx->pix_fmt != AV_PIX_FMT_RGBA) { > > int i; > > > > + ctx->ctex_size = cavctx.coded_width / ctexdsp_ctx.raw_ratio * > > + cavctx.coded_height / TEXTURE_BLOCK_H * > > + ctexdsp_ctx.tex_ratio; > > + > > ctx->op_size[0] = avctx->coded_width * avctx->coded_height / 16; > > ctx->op_size[1] = avctx->coded_width * avctx->coded_height / 32; > > ctx->op_size[2] = avctx->coded_width * avctx->coded_height / 32; > > @@ -1030,12 +1001,6 @@ static int dxv_decode(AVCodecContext *avctx, > AVFrame *frame, > > ret = decompress_tex(avctx); > > if (ret < 0) > > return ret; > > - { > > - int w_block = avctx->coded_width / ctx->texture_block_w; > > - int h_block = avctx->coded_height / ctx->texture_block_h; > > - if (w_block * h_block * ctx->tex_step > ctx->tex_size * 8LL) > > - return AVERROR_INVALIDDATA; > > - } > > I am pretty sure that this check has been added due to a fuzzing sample > with gigantic dimensions. Where is the check for this now? > > > > > ret = ff_thread_get_buffer(avctx, frame, 0); > > if (ret < 0) > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe". > -- Connor Worley _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".