Commit f98f29de authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/pnmdec: Fix misaligned reads

Found-by: 's avatar"Steinar H. Gunderson" <steinar+ffmpeg@gunderson.no>
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ea28ce9bc13803ccef97850388ddc9a73998a23e)
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 531ddbac
...@@ -173,7 +173,7 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data, ...@@ -173,7 +173,7 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data,
} else if (upgrade == 2) { } else if (upgrade == 2) {
unsigned int j, v, f = (65535 * 32768 + s->maxval / 2) / s->maxval; unsigned int j, v, f = (65535 * 32768 + s->maxval / 2) / s->maxval;
for (j = 0; j < n / 2; j++) { for (j = 0; j < n / 2; j++) {
v = av_be2ne16(((uint16_t *)s->bytestream)[j]); v = AV_RB16(s->bytestream + 2*j);
((uint16_t *)ptr)[j] = (v * f + 16384) >> 15; ((uint16_t *)ptr)[j] = (v * f + 16384) >> 15;
} }
} }
...@@ -227,7 +227,7 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data, ...@@ -227,7 +227,7 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
for (i = 0; i < avctx->height; i++) { for (i = 0; i < avctx->height; i++) {
for (j = 0; j < n / 2; j++) { for (j = 0; j < n / 2; j++) {
v = av_be2ne16(((uint16_t *)s->bytestream)[j]); v = AV_RB16(s->bytestream + 2*j);
((uint16_t *)ptr)[j] = (v * f + 16384) >> 15; ((uint16_t *)ptr)[j] = (v * f + 16384) >> 15;
} }
s->bytestream += n; s->bytestream += n;
...@@ -239,13 +239,13 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data, ...@@ -239,13 +239,13 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data,
h = avctx->height >> 1; h = avctx->height >> 1;
for (i = 0; i < h; i++) { for (i = 0; i < h; i++) {
for (j = 0; j < n / 2; j++) { for (j = 0; j < n / 2; j++) {
v = av_be2ne16(((uint16_t *)s->bytestream)[j]); v = AV_RB16(s->bytestream + 2*j);
ptr1[j] = (v * f + 16384) >> 15; ptr1[j] = (v * f + 16384) >> 15;
} }
s->bytestream += n; s->bytestream += n;
for (j = 0; j < n / 2; j++) { for (j = 0; j < n / 2; j++) {
v = av_be2ne16(((uint16_t *)s->bytestream)[j]); v = AV_RB16(s->bytestream + 2*j);
ptr2[j] = (v * f + 16384) >> 15; ptr2[j] = (v * f + 16384) >> 15;
} }
s->bytestream += n; s->bytestream += n;
...@@ -267,9 +267,9 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data, ...@@ -267,9 +267,9 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data,
b = (float *)p->data[1]; b = (float *)p->data[1];
for (int i = 0; i < avctx->height; i++) { for (int i = 0; i < avctx->height; i++) {
for (int j = 0; j < avctx->width; j++) { for (int j = 0; j < avctx->width; j++) {
r[j] = av_int2float(av_le2ne32(((uint32_t *)s->bytestream)[0])) * scale; r[j] = av_int2float(AV_RL32(s->bytestream+0)) * scale;
g[j] = av_int2float(av_le2ne32(((uint32_t *)s->bytestream)[4])) * scale; g[j] = av_int2float(AV_RL32(s->bytestream+4)) * scale;
b[j] = av_int2float(av_le2ne32(((uint32_t *)s->bytestream)[8])) * scale; b[j] = av_int2float(AV_RL32(s->bytestream+8)) * scale;
s->bytestream += 12; s->bytestream += 12;
} }
...@@ -285,9 +285,9 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data, ...@@ -285,9 +285,9 @@ static int pnm_decode_frame(AVCodecContext *avctx, void *data,
b = (float *)p->data[1]; b = (float *)p->data[1];
for (int i = 0; i < avctx->height; i++) { for (int i = 0; i < avctx->height; i++) {
for (int j = 0; j < avctx->width; j++) { for (int j = 0; j < avctx->width; j++) {
r[j] = av_int2float(av_be2ne32(((uint32_t *)s->bytestream)[0])) * scale; r[j] = av_int2float(AV_RB32(s->bytestream+0)) * scale;
g[j] = av_int2float(av_be2ne32(((uint32_t *)s->bytestream)[4])) * scale; g[j] = av_int2float(AV_RB32(s->bytestream+4)) * scale;
b[j] = av_int2float(av_be2ne32(((uint32_t *)s->bytestream)[8])) * scale; b[j] = av_int2float(AV_RB32(s->bytestream+8)) * scale;
s->bytestream += 12; s->bytestream += 12;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment