[FFmpeg-devel] [PATCH] avcodec/zmbv: handle corrupted packet

[Zhao Zhili]

From: Zhao Zhili <zhilizhao at tencent.com>

Mark the frame as corrupt when AV_CODEC_FLAG_OUTPUT_CORRUPT is set,
drop the frame otherwise.
---
 libavcodec/zmbv.c        | 26 ++++++++++++++++++++------
 tests/ref/fate/zmbv-8bit |  1 -
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c
index d309a8612b..c7408f7af8 100644
--- a/libavcodec/zmbv.c
+++ b/libavcodec/zmbv.c
@@ -148,9 +148,11 @@ static int zmbv_decode_xor_8(ZmbvContext *c)
         output += c->width * c->bh;
         prev += c->width * c->bh;
     }
-    if (src - c->decomp_buf != c->decomp_len)
+    if (src - c->decomp_buf != c->decomp_len) {
         av_log(c->avctx, AV_LOG_ERROR, "Used %"PTRDIFF_SPECIFIER" of %i bytes\n",
                src-c->decomp_buf, c->decomp_len);
+        return AVERROR_INVALIDDATA;
+    }
     return 0;
 }
 
@@ -224,9 +226,11 @@ static int zmbv_decode_xor_16(ZmbvContext *c)
         output += c->width * c->bh;
         prev += c->width * c->bh;
     }
-    if (src - c->decomp_buf != c->decomp_len)
+    if (src - c->decomp_buf != c->decomp_len) {
         av_log(c->avctx, AV_LOG_ERROR, "Used %"PTRDIFF_SPECIFIER" of %i bytes\n",
                src-c->decomp_buf, c->decomp_len);
+        return AVERROR_INVALIDDATA;
+    }
     return 0;
 }
 
@@ -309,9 +313,11 @@ static int zmbv_decode_xor_24(ZmbvContext *c)
         output += stride * c->bh;
         prev += stride * c->bh;
     }
-    if (src - c->decomp_buf != c->decomp_len)
+    if (src - c->decomp_buf != c->decomp_len) {
         av_log(c->avctx, AV_LOG_ERROR, "Used %"PTRDIFF_SPECIFIER" of %i bytes\n",
                src-c->decomp_buf, c->decomp_len);
+        return AVERROR_INVALIDDATA;
+    }
     return 0;
 }
 #endif //ZMBV_ENABLE_24BPP
@@ -386,9 +392,11 @@ static int zmbv_decode_xor_32(ZmbvContext *c)
         output += c->width * c->bh;
         prev   += c->width * c->bh;
     }
-    if (src - c->decomp_buf != c->decomp_len)
+    if (src - c->decomp_buf != c->decomp_len) {
         av_log(c->avctx, AV_LOG_ERROR, "Used %"PTRDIFF_SPECIFIER" of %i bytes\n",
                src-c->decomp_buf, c->decomp_len);
+        return AVERROR_INVALIDDATA;
+    }
     return 0;
 }
 
@@ -567,8 +575,14 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
         frame->pict_type = AV_PICTURE_TYPE_P;
         if (c->decomp_len < 2LL * ((c->width + c->bw - 1) / c->bw) * ((c->height + c->bh - 1) / c->bh))
             return AVERROR_INVALIDDATA;
-        if (c->decomp_len)
-            c->decode_xor(c);
+        if (c->decomp_len) {
+            if (c->decode_xor(c) < 0) {
+                if (avctx->flags & AV_CODEC_FLAG_OUTPUT_CORRUPT)
+                    frame->flags |= AV_FRAME_FLAG_CORRUPT;
+                else
+                    return buf_size;
+            }
+        }
     }
 
     /* update frames */
diff --git a/tests/ref/fate/zmbv-8bit b/tests/ref/fate/zmbv-8bit
index 7c2fab691f..9a7c96cb32 100644
--- a/tests/ref/fate/zmbv-8bit
+++ b/tests/ref/fate/zmbv-8bit
@@ -278,4 +278,3 @@
 0,        272,        272,        1,   192000, 0xd08e49d1
 0,        273,        273,        1,   192000, 0xd08e49d1
 0,        274,        274,        1,   192000, 0xd08e49d1
-0,        275,        275,        1,   192000, 0x1f34135f
-- 
2.42.0