From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <ffmpeg-devel-bounces@ffmpeg.org>
Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100])
	by master.gitmailbox.com (Postfix) with ESMTPS id 211194CEA3
	for <ffmpegdev@gitmailbox.com>; Sat, 15 Mar 2025 09:33:07 +0000 (UTC)
Received: from [127.0.1.1] (localhost [127.0.0.1])
	by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 32E9868DD4F;
	Sat, 15 Mar 2025 11:32:40 +0200 (EET)
Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com
 [209.85.128.47])
 by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E384F68D6BF
 for <ffmpeg-devel@ffmpeg.org>; Sat, 15 Mar 2025 11:32:31 +0200 (EET)
Received: by mail-wm1-f47.google.com with SMTP id
 5b1f17b1804b1-43d0618746bso3234765e9.2
 for <ffmpeg-devel@ffmpeg.org>; Sat, 15 Mar 2025 02:32:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1742031151; x=1742635951; darn=ffmpeg.org;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:from:to:cc:subject:date
 :message-id:reply-to;
 bh=2nS1rkRkwLhETk8QVEiLCn7l4WcBz0kdTsDtYtmFnx4=;
 b=OiVoECp/BYWfQx94KvMtHB7gJcnfzobETywlwd0hBes7tBHvLRAtJ5GaeZczeeCxdQ
 yzizEvgHz7FCjKxlm95loN4b2AnH7x3bjmrcQbc+ipc5onmLx+h3PU3990+gbsV4bYRW
 NdJTT1eNXQG7L6IrUw+rqig3Zv+prUzCM/LMqGevjiddzQvYgu7u6tIDjSuc9z0bSR3K
 P8FDsGAbcU9t9/fgugCuh3OuzZ0OuOWZmV1+mjTgVsWetXpBECg8fK5YHpg8N78sLNXa
 BL1SEsPTo3CHcr/ffshp2J4+Ho9T/m1clRE25pLyVS6tx+w/VNCfNmswsEy8HPPrIlO0
 VUiQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1742031151; x=1742635951;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
 :subject:date:message-id:reply-to;
 bh=2nS1rkRkwLhETk8QVEiLCn7l4WcBz0kdTsDtYtmFnx4=;
 b=q/hKaqvbC7A3M8FRleByuKtFSouAdtzW9xjkITY7kUk8BD7wfl3R37wjZhCGnzS0Rr
 dwvgd9VxdN6ilpEok9j3x+b0Geb7cnYM0nE/29ssPloncB0/7UIxIImZkwm1/iegHuFv
 KLM1TEhcRt3eYpsP8NmnBCTrUKUV0UwUfG8njZhC5EYWiAXBvLtpHSh6Xd0eDHKltBT3
 W7t5pzUAJvxWTknuH/Ta34Uk5EwGu9yx0+3MnuXUzCamsFdYYkACTbWAZUEvj35y8/t7
 7GnwHYqAyj9AmdJIPqVBTegVPq98CEHJ23r5CBGbhNu+qCr6OtlIK5o+Fqk1AvZYIVJc
 vLGQ==
X-Gm-Message-State: AOJu0YxUN14irD7QVBkaysEcS679tzhdffKBhhSrTtV2I4qU7rixJ57T
 BbjXLR1gQW4bqntmy7PuGp5o8dpDi17doTH8ulmYvsA+yzrntaVTXZEznw==
X-Gm-Gg: ASbGncvObVH1n6BfSowtsqPSSPCv7nTRjc2WxTc1/GlAEHm1Z/diKlIhfLWextkD54w
 za7dWDrcLMdDwr3BvnrqFO6mWSu3GAM80ZY7Nnor88a+QH8k07bmq18Zt2NXaZENbAekQrQ2S9v
 M5k7Qso9MBa5t/01cJZy2nle+TDuKtXKxnyBtCfxfcd3Tv3q8PYB2yHp4mPpGsTB+4Z1zhasMgO
 ryz5pweBPxPQvpc6FzDX+r/rHhgL6SgmFxlszxzjdpH6doH98nOpXjC85vpNYcI1MV3nrtDRbY8
 aGblLDhTkSCs30bgRW3v7+ou9VlQ/AHa8+g9B5w8m0YiHWI0EGVYAxOSa1PqkS8YL+/cn0EriaY
 IW7vj40uZYPnoSZvrLBEFoIrLSNLDg/bt+wNnv1dtguXUy0LXfjIDSdY=
X-Google-Smtp-Source: AGHT+IHqVTizsvEOe5tFliLUJ6oZ/iGLuuj6F1PT30Z1hJdsLsE+lNaksD9HNrkVB71R3sjcWgOO2Q==
X-Received: by 2002:a05:600c:41d3:b0:43c:f689:dd with SMTP id
 5b1f17b1804b1-43d20e467c7mr56085495e9.19.1742031150834; 
 Sat, 15 Mar 2025 02:32:30 -0700 (PDT)
Received: from flagship3.deu.mlau.at
 (p200300c0271f29004c5623f045c27bca.dip0.t-ipconnect.de.
 [2003:c0:271f:2900:4c56:23f0:45c2:7bca])
 by smtp.gmail.com with ESMTPSA id
 5b1f17b1804b1-43d1fe659b3sm43302905e9.34.2025.03.15.02.32.30
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Sat, 15 Mar 2025 02:32:30 -0700 (PDT)
From: Manuel Lauss <manuel.lauss@gmail.com>
To: ffmpeg-devel@ffmpeg.org
Date: Sat, 15 Mar 2025 10:32:09 +0100
Message-ID: <20250315093220.2565-3-manuel.lauss@gmail.com>
X-Mailer: git-send-email 2.48.1
In-Reply-To: <20250315093220.2565-1-manuel.lauss@gmail.com>
References: <20250315093220.2565-1-manuel.lauss@gmail.com>
MIME-Version: 1.0
Subject: [FFmpeg-devel] [PATCH v2 02/13] avcodec/sanm: FOBJ left/top are
 signed values
X-BeenThere: ffmpeg-devel@ffmpeg.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: FFmpeg development discussions and patches <ffmpeg-devel.ffmpeg.org>
List-Unsubscribe: <https://ffmpeg.org/mailman/options/ffmpeg-devel>,
 <mailto:ffmpeg-devel-request@ffmpeg.org?subject=unsubscribe>
List-Archive: <https://ffmpeg.org/pipermail/ffmpeg-devel>
List-Post: <mailto:ffmpeg-devel@ffmpeg.org>
List-Help: <mailto:ffmpeg-devel-request@ffmpeg.org?subject=help>
List-Subscribe: <https://ffmpeg.org/mailman/listinfo/ffmpeg-devel>,
 <mailto:ffmpeg-devel-request@ffmpeg.org?subject=subscribe>
Reply-To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Cc: Manuel Lauss <manuel.lauss@gmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: ffmpeg-devel-bounces@ffmpeg.org
Sender: "ffmpeg-devel" <ffmpeg-devel-bounces@ffmpeg.org>
Archived-At: <https://master.gitmailbox.com/ffmpegdev/20250315093220.2565-3-manuel.lauss@gmail.com/>
List-Archive: <https://master.gitmailbox.com/ffmpegdev/>
List-Post: <mailto:ffmpegdev@gitmailbox.com>

The left/top parameters of a FOBJ are signed values.  Adjust
codec1 code accordingly to not draw outside the buffer area.
Rebel Assault 1 makes heavy use of this.

Signed-off-by: Manuel Lauss <manuel.lauss@gmail.com>
---
 libavcodec/sanm.c | 33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index 49ac9bebfe..65ca525b9d 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -558,18 +558,18 @@ static int rle_decode(SANMVideoContext *ctx, uint8_t *dst, const int out_size)
 static int old_codec1(SANMVideoContext *ctx, int top,
                       int left, int width, int height)
 {
-    uint8_t *dst = ((uint8_t *)ctx->frm0) + left + top * ctx->pitch;
-    int i, j, len, flag, code, val, pos, end;
+    int i, j, len, flag, code, val, end, pxoff;
+    const int maxpxo = ctx->height * ctx->pitch;
+    uint8_t *dst = (uint8_t *)ctx->frm0;
 
     for (i = 0; i < height; i++) {
-        pos = 0;
-
         if (bytestream2_get_bytes_left(&ctx->gb) < 2)
             return AVERROR_INVALIDDATA;
 
         len = bytestream2_get_le16u(&ctx->gb);
         end = bytestream2_tell(&ctx->gb) + len;
 
+        pxoff = left + ((top + i) * ctx->pitch);
         while (bytestream2_tell(&ctx->gb) < end) {
             if (bytestream2_get_bytes_left(&ctx->gb) < 2)
                 return AVERROR_INVALIDDATA;
@@ -577,25 +577,28 @@ static int old_codec1(SANMVideoContext *ctx, int top,
             code = bytestream2_get_byteu(&ctx->gb);
             flag = code & 1;
             code = (code >> 1) + 1;
-            if (pos + code > width)
-                return AVERROR_INVALIDDATA;
             if (flag) {
                 val = bytestream2_get_byteu(&ctx->gb);
-                if (val)
-                    memset(dst + pos, val, code);
-                pos += code;
+                if (val) {
+                    for (j = 0; j < code; j++) {
+                        if (pxoff >= 0 && pxoff < maxpxo)
+                            *(dst + pxoff) = val;
+                        pxoff++;
+                    }
+                } else {
+                    pxoff += code;
+                }
             } else {
                 if (bytestream2_get_bytes_left(&ctx->gb) < code)
                     return AVERROR_INVALIDDATA;
                 for (j = 0; j < code; j++) {
                     val = bytestream2_get_byteu(&ctx->gb);
-                    if (val)
-                        dst[pos] = val;
-                    pos++;
+                    if ((pxoff >= 0) && (pxoff < maxpxo) && val)
+                        *(dst + pxoff) = val;
+                    pxoff++;
                 }
             }
         }
-        dst += ctx->pitch;
     }
     ctx->rotate_code = 0;
 
@@ -1236,8 +1239,8 @@ static int old_codec48(SANMVideoContext *ctx, int width, int height)
 static int process_frame_obj(SANMVideoContext *ctx)
 {
     uint16_t codec = bytestream2_get_le16u(&ctx->gb);
-    uint16_t left  = bytestream2_get_le16u(&ctx->gb);
-    uint16_t top   = bytestream2_get_le16u(&ctx->gb);
+    int16_t  left  = bytestream2_get_le16u(&ctx->gb);
+    int16_t  top   = bytestream2_get_le16u(&ctx->gb);
     uint16_t w     = bytestream2_get_le16u(&ctx->gb);
     uint16_t h     = bytestream2_get_le16u(&ctx->gb);
 
-- 
2.48.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".