additional protection from segmentation faults and memory access errors by
[ffmpeg-lucabe.git] / libavcodec / xan.c
blobc369be1fced7baaccd3e1a0235de9080384b26af
1 /*
2 * Wing Commander/Xan Video Decoder
3 * Copyright (C) 2003 the ffmpeg project
5 * This file is part of FFmpeg.
7 * FFmpeg is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
12 * FFmpeg is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with FFmpeg; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
22 /**
23 * @file xan.c
24 * Xan video decoder for Wing Commander III computer game
25 * by Mario Brito (mbrito@student.dei.uc.pt)
26 * and Mike Melanson (melanson@pcisys.net)
28 * The xan_wc3 decoder outputs PAL8 data.
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <string.h>
34 #include <unistd.h>
36 #include "avcodec.h"
38 typedef struct XanContext {
40 AVCodecContext *avctx;
41 AVFrame last_frame;
42 AVFrame current_frame;
44 const unsigned char *buf;
45 int size;
47 /* scratch space */
48 unsigned char *buffer1;
49 int buffer1_size;
50 unsigned char *buffer2;
51 int buffer2_size;
53 int frame_size;
55 } XanContext;
57 static av_cold int xan_decode_init(AVCodecContext *avctx)
59 XanContext *s = avctx->priv_data;
61 s->avctx = avctx;
62 s->frame_size = 0;
64 if ((avctx->codec->id == CODEC_ID_XAN_WC3) &&
65 (s->avctx->palctrl == NULL)) {
66 av_log(avctx, AV_LOG_ERROR, " WC3 Xan video: palette expected.\n");
67 return -1;
70 avctx->pix_fmt = PIX_FMT_PAL8;
72 if(avcodec_check_dimensions(avctx, avctx->width, avctx->height))
73 return -1;
75 s->buffer1_size = avctx->width * avctx->height;
76 s->buffer1 = av_malloc(s->buffer1_size);
77 s->buffer2_size = avctx->width * avctx->height;
78 s->buffer2 = av_malloc(s->buffer2_size);
79 if (!s->buffer1 || !s->buffer2)
80 return -1;
82 return 0;
85 /* This function is used in lieu of memcpy(). This decoder cannot use
86 * memcpy because the memory locations often overlap and
87 * memcpy doesn't like that; it's not uncommon, for example, for
88 * dest = src+1, to turn byte A into pattern AAAAAAAA.
89 * This was originally repz movsb in Intel x86 ASM. */
90 static inline void bytecopy(unsigned char *dest, const unsigned char *src, int count)
92 int i;
94 for (i = 0; i < count; i++)
95 dest[i] = src[i];
98 static int xan_huffman_decode(unsigned char *dest, const unsigned char *src,
99 int dest_len)
101 unsigned char byte = *src++;
102 unsigned char ival = byte + 0x16;
103 const unsigned char * ptr = src + byte*2;
104 unsigned char val = ival;
105 int counter = 0;
106 unsigned char *dest_end = dest + dest_len;
108 unsigned char bits = *ptr++;
110 while ( val != 0x16 ) {
111 if ( (1 << counter) & bits )
112 val = src[byte + val - 0x17];
113 else
114 val = src[val - 0x17];
116 if ( val < 0x16 ) {
117 if (dest + 1 > dest_end)
118 return 0;
119 *dest++ = val;
120 val = ival;
123 if (counter++ == 7) {
124 counter = 0;
125 bits = *ptr++;
129 return 0;
132 static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_len)
134 unsigned char opcode;
135 int size;
136 int offset;
137 int byte1, byte2, byte3;
138 unsigned char *dest_end = dest + dest_len;
140 for (;;) {
141 opcode = *src++;
143 if ( (opcode & 0x80) == 0 ) {
145 offset = *src++;
147 size = opcode & 3;
148 if (dest + size > dest_end)
149 return;
150 bytecopy(dest, src, size); dest += size; src += size;
152 size = ((opcode & 0x1c) >> 2) + 3;
153 if (dest + size > dest_end)
154 return;
155 bytecopy (dest, dest - (((opcode & 0x60) << 3) + offset + 1), size);
156 dest += size;
158 } else if ( (opcode & 0x40) == 0 ) {
160 byte1 = *src++;
161 byte2 = *src++;
163 size = byte1 >> 6;
164 if (dest + size > dest_end)
165 return;
166 bytecopy (dest, src, size); dest += size; src += size;
168 size = (opcode & 0x3f) + 4;
169 if (dest + size > dest_end)
170 return;
171 bytecopy (dest, dest - (((byte1 & 0x3f) << 8) + byte2 + 1), size);
172 dest += size;
174 } else if ( (opcode & 0x20) == 0 ) {
176 byte1 = *src++;
177 byte2 = *src++;
178 byte3 = *src++;
180 size = opcode & 3;
181 if (dest + size > dest_end)
182 return;
183 bytecopy (dest, src, size); dest += size; src += size;
185 size = byte3 + 5 + ((opcode & 0xc) << 6);
186 if (dest + size > dest_end)
187 return;
188 bytecopy (dest,
189 dest - ((((opcode & 0x10) >> 4) << 0x10) + 1 + (byte1 << 8) + byte2),
190 size);
191 dest += size;
192 } else {
193 size = ((opcode & 0x1f) << 2) + 4;
195 if (size > 0x70)
196 break;
198 if (dest + size > dest_end)
199 return;
200 bytecopy (dest, src, size); dest += size; src += size;
204 size = opcode & 3;
205 bytecopy(dest, src, size); dest += size; src += size;
208 static inline void xan_wc3_output_pixel_run(XanContext *s,
209 const unsigned char *pixel_buffer, int x, int y, int pixel_count)
211 int stride;
212 int line_inc;
213 int index;
214 int current_x;
215 int width = s->avctx->width;
216 unsigned char *palette_plane;
218 palette_plane = s->current_frame.data[0];
219 stride = s->current_frame.linesize[0];
220 line_inc = stride - width;
221 index = y * stride + x;
222 current_x = x;
223 while((pixel_count--) && (index < s->frame_size)) {
225 /* don't do a memcpy() here; keyframes generally copy an entire
226 * frame of data and the stride needs to be accounted for */
227 palette_plane[index++] = *pixel_buffer++;
229 current_x++;
230 if (current_x >= width) {
231 index += line_inc;
232 current_x = 0;
237 static inline void xan_wc3_copy_pixel_run(XanContext *s,
238 int x, int y, int pixel_count, int motion_x, int motion_y)
240 int stride;
241 int line_inc;
242 int curframe_index, prevframe_index;
243 int curframe_x, prevframe_x;
244 int width = s->avctx->width;
245 unsigned char *palette_plane, *prev_palette_plane;
247 palette_plane = s->current_frame.data[0];
248 prev_palette_plane = s->last_frame.data[0];
249 stride = s->current_frame.linesize[0];
250 line_inc = stride - width;
251 curframe_index = y * stride + x;
252 curframe_x = x;
253 prevframe_index = (y + motion_y) * stride + x + motion_x;
254 prevframe_x = x + motion_x;
255 while((pixel_count--) && (curframe_index < s->frame_size)) {
257 palette_plane[curframe_index++] =
258 prev_palette_plane[prevframe_index++];
260 curframe_x++;
261 if (curframe_x >= width) {
262 curframe_index += line_inc;
263 curframe_x = 0;
266 prevframe_x++;
267 if (prevframe_x >= width) {
268 prevframe_index += line_inc;
269 prevframe_x = 0;
274 static void xan_wc3_decode_frame(XanContext *s) {
276 int width = s->avctx->width;
277 int height = s->avctx->height;
278 int total_pixels = width * height;
279 unsigned char opcode;
280 unsigned char flag = 0;
281 int size = 0;
282 int motion_x, motion_y;
283 int x, y;
285 unsigned char *opcode_buffer = s->buffer1;
286 int opcode_buffer_size = s->buffer1_size;
287 const unsigned char *imagedata_buffer = s->buffer2;
289 /* pointers to segments inside the compressed chunk */
290 const unsigned char *huffman_segment;
291 const unsigned char *size_segment;
292 const unsigned char *vector_segment;
293 const unsigned char *imagedata_segment;
295 huffman_segment = s->buf + AV_RL16(&s->buf[0]);
296 size_segment = s->buf + AV_RL16(&s->buf[2]);
297 vector_segment = s->buf + AV_RL16(&s->buf[4]);
298 imagedata_segment = s->buf + AV_RL16(&s->buf[6]);
300 xan_huffman_decode(opcode_buffer, huffman_segment, opcode_buffer_size);
302 if (imagedata_segment[0] == 2)
303 xan_unpack(s->buffer2, &imagedata_segment[1], s->buffer2_size);
304 else
305 imagedata_buffer = &imagedata_segment[1];
307 /* use the decoded data segments to build the frame */
308 x = y = 0;
309 while (total_pixels) {
311 opcode = *opcode_buffer++;
312 size = 0;
314 switch (opcode) {
316 case 0:
317 flag ^= 1;
318 continue;
320 case 1:
321 case 2:
322 case 3:
323 case 4:
324 case 5:
325 case 6:
326 case 7:
327 case 8:
328 size = opcode;
329 break;
331 case 12:
332 case 13:
333 case 14:
334 case 15:
335 case 16:
336 case 17:
337 case 18:
338 size += (opcode - 10);
339 break;
341 case 9:
342 case 19:
343 size = *size_segment++;
344 break;
346 case 10:
347 case 20:
348 size = AV_RB16(&size_segment[0]);
349 size_segment += 2;
350 break;
352 case 11:
353 case 21:
354 size = AV_RB24(size_segment);
355 size_segment += 3;
356 break;
359 if (opcode < 12) {
360 flag ^= 1;
361 if (flag) {
362 /* run of (size) pixels is unchanged from last frame */
363 xan_wc3_copy_pixel_run(s, x, y, size, 0, 0);
364 } else {
365 /* output a run of pixels from imagedata_buffer */
366 xan_wc3_output_pixel_run(s, imagedata_buffer, x, y, size);
367 imagedata_buffer += size;
369 } else {
370 /* run-based motion compensation from last frame */
371 motion_x = (*vector_segment >> 4) & 0xF;
372 motion_y = *vector_segment & 0xF;
373 vector_segment++;
375 /* sign extension */
376 if (motion_x & 0x8)
377 motion_x |= 0xFFFFFFF0;
378 if (motion_y & 0x8)
379 motion_y |= 0xFFFFFFF0;
381 /* copy a run of pixels from the previous frame */
382 xan_wc3_copy_pixel_run(s, x, y, size, motion_x, motion_y);
384 flag = 0;
387 /* coordinate accounting */
388 total_pixels -= size;
389 while (size) {
390 if (x + size >= width) {
391 y++;
392 size -= (width - x);
393 x = 0;
394 } else {
395 x += size;
396 size = 0;
402 static void xan_wc4_decode_frame(XanContext *s) {
405 static int xan_decode_frame(AVCodecContext *avctx,
406 void *data, int *data_size,
407 const uint8_t *buf, int buf_size)
409 XanContext *s = avctx->priv_data;
410 AVPaletteControl *palette_control = avctx->palctrl;
412 if (avctx->get_buffer(avctx, &s->current_frame)) {
413 av_log(s->avctx, AV_LOG_ERROR, " Xan Video: get_buffer() failed\n");
414 return -1;
416 s->current_frame.reference = 3;
418 if (!s->frame_size)
419 s->frame_size = s->current_frame.linesize[0] * s->avctx->height;
421 palette_control->palette_changed = 0;
422 memcpy(s->current_frame.data[1], palette_control->palette,
423 AVPALETTE_SIZE);
424 s->current_frame.palette_has_changed = 1;
426 s->buf = buf;
427 s->size = buf_size;
429 if (avctx->codec->id == CODEC_ID_XAN_WC3)
430 xan_wc3_decode_frame(s);
431 else if (avctx->codec->id == CODEC_ID_XAN_WC4)
432 xan_wc4_decode_frame(s);
434 /* release the last frame if it is allocated */
435 if (s->last_frame.data[0])
436 avctx->release_buffer(avctx, &s->last_frame);
438 *data_size = sizeof(AVFrame);
439 *(AVFrame*)data = s->current_frame;
441 /* shuffle frames */
442 FFSWAP(AVFrame, s->current_frame, s->last_frame);
444 /* always report that the buffer was completely consumed */
445 return buf_size;
448 static av_cold int xan_decode_end(AVCodecContext *avctx)
450 XanContext *s = avctx->priv_data;
452 /* release the frames */
453 if (s->last_frame.data[0])
454 avctx->release_buffer(avctx, &s->last_frame);
455 if (s->current_frame.data[0])
456 avctx->release_buffer(avctx, &s->current_frame);
458 av_free(s->buffer1);
459 av_free(s->buffer2);
461 return 0;
464 AVCodec xan_wc3_decoder = {
465 "xan_wc3",
466 CODEC_TYPE_VIDEO,
467 CODEC_ID_XAN_WC3,
468 sizeof(XanContext),
469 xan_decode_init,
470 NULL,
471 xan_decode_end,
472 xan_decode_frame,
473 CODEC_CAP_DR1,
477 AVCodec xan_wc4_decoder = {
478 "xan_wc4",
479 CODEC_TYPE_VIDEO,
480 CODEC_ID_XAN_WC4,
481 sizeof(XanContext),
482 xan_decode_init,
483 NULL,
484 xan_decode_end,
485 xan_decode_frame,
486 CODEC_CAP_DR1,