Coverage Report

Created: 2026-01-16 07:48

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ffmpeg/libavcodec/rv10.c
Line
Count
Source
1
/*
2
 * RV10/RV20 decoder
3
 * Copyright (c) 2000,2001 Fabrice Bellard
4
 * Copyright (c) 2002-2004 Michael Niedermayer
5
 *
6
 * This file is part of FFmpeg.
7
 *
8
 * FFmpeg is free software; you can redistribute it and/or
9
 * modify it under the terms of the GNU Lesser General Public
10
 * License as published by the Free Software Foundation; either
11
 * version 2.1 of the License, or (at your option) any later version.
12
 *
13
 * FFmpeg is distributed in the hope that it will be useful,
14
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16
 * Lesser General Public License for more details.
17
 *
18
 * You should have received a copy of the GNU Lesser General Public
19
 * License along with FFmpeg; if not, write to the Free Software
20
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
21
 */
22
23
/**
24
 * @file
25
 * RV10/RV20 decoder
26
 */
27
28
#include <inttypes.h>
29
30
#include "libavutil/imgutils.h"
31
#include "libavutil/thread.h"
32
33
#include "avcodec.h"
34
#include "codec_internal.h"
35
#include "decode.h"
36
#include "error_resilience.h"
37
#include "h263.h"
38
#include "h263data.h"
39
#include "h263dec.h"
40
#include "mpeg_er.h"
41
#include "mpegvideo.h"
42
#include "mpegvideodec.h"
43
#include "mpeg4video.h"
44
#include "mpegvideodata.h"
45
#include "rv10dec.h"
46
47
7.14k
#define RV_GET_MAJOR_VER(x)  ((x) >> 28)
48
196k
#define RV_GET_MINOR_VER(x) (((x) >> 20) & 0xFF)
49
7.14k
#define RV_GET_MICRO_VER(x) (((x) >> 12) & 0xFF)
50
51
#define MAX_VLC_ENTRIES 1023 // Note: Does not include the skip entries.
52
698k
#define DC_VLC_BITS        9
53
54
typedef struct RVDecContext {
55
    H263DecContext h;
56
    int sub_id;
57
    int orig_width, orig_height;
58
} RVDecContext;
59
60
/* (run, length) encoded value for the symbols table. The actual symbols
61
 * are run..run - length (mod 256).
62
 * The last two entries in the following table apply to luma only.
63
 * The skip values are not included in this list. */
64
static const uint8_t rv_sym_run_len[][2] = {
65
    {   0,   0 }, {   1,   0 }, { 255,   0 }, {   3,   1 }, { 254,  1 },
66
    {   7,   3 }, { 252,   3 }, {  15,   7 }, { 248,   7 }, {  31, 15 },
67
    { 240,  15 }, {  63,  31 }, { 224,  31 }, { 127,  63 }, { 192, 63 },
68
    { 255, 127 }, { 128, 127 }, { 127, 255 }, { 128, 255 },
69
};
70
71
/* entry[i] of the following tables gives
72
 * the number of VLC codes of length i + 2. */
73
static const uint16_t rv_lum_len_count[15] = {
74
    1,  0,  2,  4,  8, 16, 32,  0, 64,  0, 128,  0, 256,  0, 512,
75
};
76
77
static const uint16_t rv_chrom_len_count[15] = {
78
    1,  2,  4,  0,  8,  0, 16,  0, 32,  0,  64,  0, 128,  0, 256,
79
};
80
81
static VLCElem rv_dc_lum[1472], rv_dc_chrom[992];
82
83
int ff_rv_decode_dc(H263DecContext *const h, int n)
84
698k
{
85
698k
    int code;
86
87
698k
    if (n < 4) {
88
474k
        code = get_vlc2(&h->gb, rv_dc_lum, DC_VLC_BITS, 2);
89
474k
    } else {
90
224k
        code = get_vlc2(&h->gb, rv_dc_chrom, DC_VLC_BITS, 2);
91
224k
        if (code < 0) {
92
272
            av_log(h->c.avctx, AV_LOG_ERROR, "chroma dc error\n");
93
272
            return -1;
94
272
        }
95
224k
    }
96
698k
    return code;
97
698k
}
98
99
/* read RV 1.0 compatible frame header */
100
static int rv10_decode_picture_header(H263DecContext *const h)
101
37.2k
{
102
37.2k
    int mb_count, pb_frame, marker, mb_xy;
103
104
37.2k
    marker = get_bits1(&h->gb);
105
106
37.2k
    if (get_bits1(&h->gb))
107
13.2k
        h->c.pict_type = AV_PICTURE_TYPE_P;
108
23.9k
    else
109
23.9k
        h->c.pict_type = AV_PICTURE_TYPE_I;
110
111
37.2k
    if (!marker)
112
36.0k
        av_log(h->c.avctx, AV_LOG_ERROR, "marker missing\n");
113
114
37.2k
    pb_frame = get_bits1(&h->gb);
115
116
37.2k
    ff_dlog(h->c.avctx, "pict_type=%d pb_frame=%d\n", h->c.pict_type, pb_frame);
117
118
37.2k
    if (pb_frame) {
119
458
        avpriv_request_sample(h->c.avctx, "PB-frame");
120
458
        return AVERROR_PATCHWELCOME;
121
458
    }
122
123
36.7k
    h->c.qscale = get_bits(&h->gb, 5);
124
36.7k
    if (h->c.qscale == 0) {
125
2.29k
        av_log(h->c.avctx, AV_LOG_ERROR, "Invalid qscale value: 0\n");
126
2.29k
        return AVERROR_INVALIDDATA;
127
2.29k
    }
128
129
34.4k
    if (h->c.pict_type == AV_PICTURE_TYPE_I) {
130
21.4k
        if (h->rv10_version == 3) {
131
            /* specific MPEG like DC coding not used */
132
18.1k
            h->last_dc[0] = get_bits(&h->gb, 8);
133
18.1k
            h->last_dc[1] = get_bits(&h->gb, 8);
134
18.1k
            h->last_dc[2] = get_bits(&h->gb, 8);
135
18.1k
            ff_dlog(h->c.avctx, "DC:%d %d %d\n", h->last_dc[0],
136
18.1k
                    h->last_dc[1], h->last_dc[2]);
137
18.1k
        }
138
21.4k
    }
139
    /* if multiple packets per frame are sent, the position at which
140
     * to display the macroblocks is coded here */
141
142
34.4k
    mb_xy = h->c.mb_x + h->c.mb_y * h->c.mb_width;
143
34.4k
    if (show_bits(&h->gb, 12) == 0 || (mb_xy && mb_xy < h->c.mb_num)) {
144
15.2k
        h->c.mb_x  = get_bits(&h->gb, 6); /* mb_x */
145
15.2k
        h->c.mb_y  = get_bits(&h->gb, 6); /* mb_y */
146
15.2k
        mb_count   = get_bits(&h->gb, 12);
147
19.1k
    } else {
148
19.1k
        h->c.mb_x  = 0;
149
19.1k
        h->c.mb_y  = 0;
150
19.1k
        mb_count = h->c.mb_width * h->c.mb_height;
151
19.1k
    }
152
34.4k
    skip_bits(&h->gb, 3);   /* ignored */
153
154
34.4k
    return mb_count;
155
36.7k
}
156
157
static int rv20_decode_picture_header(RVDecContext *rv, int whole_size)
158
71.2k
{
159
71.2k
    static const enum AVPictureType pict_types[] =
160
71.2k
        { AV_PICTURE_TYPE_I, AV_PICTURE_TYPE_I /* hmm ... */,
161
71.2k
          AV_PICTURE_TYPE_P, AV_PICTURE_TYPE_B };
162
71.2k
    H263DecContext *const h = &rv->h;
163
71.2k
    int seq, mb_pos, ret;
164
71.2k
    int rpr_max;
165
166
71.2k
    h->c.pict_type = pict_types[get_bits(&h->gb, 2)];
167
168
71.2k
    if (h->c.low_delay && h->c.pict_type == AV_PICTURE_TYPE_B) {
169
823
        av_log(h->c.avctx, AV_LOG_ERROR, "low delay B\n");
170
823
        return -1;
171
823
    }
172
70.4k
    if (!h->c.last_pic.ptr && h->c.pict_type == AV_PICTURE_TYPE_B) {
173
788
        av_log(h->c.avctx, AV_LOG_ERROR, "early B-frame\n");
174
788
        return AVERROR_INVALIDDATA;
175
788
    }
176
177
69.6k
    if (get_bits1(&h->gb)) {
178
1.63k
        av_log(h->c.avctx, AV_LOG_ERROR, "reserved bit set\n");
179
1.63k
        return AVERROR_INVALIDDATA;
180
1.63k
    }
181
182
67.9k
    h->c.qscale = get_bits(&h->gb, 5);
183
67.9k
    if (h->c.qscale == 0) {
184
3.38k
        av_log(h->c.avctx, AV_LOG_ERROR, "Invalid qscale value: 0\n");
185
3.38k
        return AVERROR_INVALIDDATA;
186
3.38k
    }
187
188
64.5k
    if (RV_GET_MINOR_VER(rv->sub_id) >= 2)
189
62.6k
        h->loop_filter = get_bits1(&h->gb) && !h->c.avctx->lowres;
190
191
64.5k
    if (RV_GET_MINOR_VER(rv->sub_id) <= 1)
192
1.90k
        seq = get_bits(&h->gb, 8) << 7;
193
62.6k
    else
194
62.6k
        seq = get_bits(&h->gb, 13) << 2;
195
196
64.5k
    rpr_max = h->c.avctx->extradata[1] & 7;
197
64.5k
    if (rpr_max) {
198
56.7k
        int f, new_w, new_h;
199
56.7k
        int rpr_bits = av_log2(rpr_max) + 1;
200
201
56.7k
        f = get_bits(&h->gb, rpr_bits);
202
203
56.7k
        if (f) {
204
34.1k
            if (h->c.avctx->extradata_size < 8 + 2 * f) {
205
328
                av_log(h->c.avctx, AV_LOG_ERROR, "Extradata too small.\n");
206
328
                return AVERROR_INVALIDDATA;
207
328
            }
208
209
33.7k
            new_w = 4 * h->c.avctx->extradata[6 + 2 * f];
210
33.7k
            new_h = 4 * h->c.avctx->extradata[7 + 2 * f];
211
33.7k
        } else {
212
22.6k
            new_w = rv->orig_width;
213
22.6k
            new_h = rv->orig_height;
214
22.6k
        }
215
56.4k
        if (new_w != h->c.width || new_h != h->c.height || !h->c.context_initialized) {
216
29.3k
            AVRational old_aspect = h->c.avctx->sample_aspect_ratio;
217
29.3k
            av_log(h->c.avctx, AV_LOG_DEBUG,
218
29.3k
                   "attempting to change resolution to %dx%d\n", new_w, new_h);
219
29.3k
            if (av_image_check_size(new_w, new_h, 0, h->c.avctx) < 0)
220
700
                return AVERROR_INVALIDDATA;
221
222
28.6k
            if (whole_size < (new_w + 15)/16 * ((new_h + 15)/16) / 8)
223
2.34k
                return AVERROR_INVALIDDATA;
224
225
26.3k
            ff_mpv_common_end(&h->c);
226
227
            // attempt to keep aspect during typical resolution switches
228
26.3k
            if (!old_aspect.num)
229
9.25k
                old_aspect = (AVRational){1, 1};
230
26.3k
            if (2 * (int64_t)new_w * h->c.height == (int64_t)new_h * h->c.width)
231
3.04k
                h->c.avctx->sample_aspect_ratio = av_mul_q(old_aspect, (AVRational){2, 1});
232
26.3k
            if ((int64_t)new_w * h->c.height == 2 * (int64_t)new_h * h->c.width)
233
4.53k
                h->c.avctx->sample_aspect_ratio = av_mul_q(old_aspect, (AVRational){1, 2});
234
235
26.3k
            ret = ff_set_dimensions(h->c.avctx, new_w, new_h);
236
26.3k
            if (ret < 0)
237
0
                return ret;
238
239
26.3k
            h->c.width  = new_w;
240
26.3k
            h->c.height = new_h;
241
26.3k
            if ((ret = ff_mpv_common_init(&h->c)) < 0)
242
0
                return ret;
243
26.3k
        }
244
245
53.4k
        if (h->c.avctx->debug & FF_DEBUG_PICT_INFO) {
246
0
            av_log(h->c.avctx, AV_LOG_DEBUG, "F %d/%d/%d\n", f, rpr_bits, rpr_max);
247
0
        }
248
53.4k
    }
249
61.2k
    if (av_image_check_size(h->c.width, h->c.height, 0, h->c.avctx) < 0)
250
0
        return AVERROR_INVALIDDATA;
251
252
61.2k
    mb_pos = ff_h263_decode_mba(h);
253
254
61.2k
    seq |= h->c.time & ~0x7FFF;
255
61.2k
    if (seq - h->c.time >  0x4000)
256
6.58k
        seq -= 0x8000;
257
61.2k
    if (seq - h->c.time < -0x4000)
258
5.53k
        seq += 0x8000;
259
260
61.2k
    if (seq != h->c.time) {
261
37.3k
        if (h->c.pict_type != AV_PICTURE_TYPE_B) {
262
34.9k
            h->c.time            = seq;
263
34.9k
            h->c.pp_time         = h->c.time - h->c.last_non_b_time;
264
34.9k
            h->c.last_non_b_time = h->c.time;
265
34.9k
        } else {
266
2.43k
            h->c.time    = seq;
267
2.43k
            h->c.pb_time = h->c.pp_time - (h->c.last_non_b_time - h->c.time);
268
2.43k
        }
269
37.3k
    }
270
61.2k
    if (h->c.pict_type == AV_PICTURE_TYPE_B) {
271
4.24k
        if (h->c.pp_time <=h->c.pb_time || h->c.pp_time <= h->c.pp_time - h->c.pb_time || h->c.pp_time<=0) {
272
557
            av_log(h->c.avctx, AV_LOG_DEBUG,
273
557
                   "messed up order, possible from seeking? skipping current B-frame\n");
274
20.3k
#define ERROR_SKIP_FRAME -123
275
557
            return ERROR_SKIP_FRAME;
276
557
        }
277
3.68k
        ff_mpeg4_init_direct_mv(&h->c);
278
3.68k
    }
279
280
60.6k
    h->c.no_rounding = get_bits1(&h->gb);
281
282
60.6k
    if (RV_GET_MINOR_VER(rv->sub_id) <= 1 && h->c.pict_type == AV_PICTURE_TYPE_B)
283
        // binary decoder reads 3+2 bits here but they don't seem to be used
284
0
        skip_bits(&h->gb, 5);
285
286
60.6k
    h->c.h263_aic        = h->c.pict_type == AV_PICTURE_TYPE_I;
287
60.6k
    if (h->c.h263_aic) {
288
12.9k
        h->c.y_dc_scale_table =
289
12.9k
        h->c.c_dc_scale_table = ff_aic_dc_scale_table;
290
47.7k
    } else {
291
47.7k
        h->c.y_dc_scale_table =
292
47.7k
        h->c.c_dc_scale_table = ff_mpeg1_dc_scale_table;
293
47.7k
    }
294
60.6k
    if (!h->c.avctx->lowres)
295
30.3k
        h->loop_filter = 1;
296
297
60.6k
    if (h->c.avctx->debug & FF_DEBUG_PICT_INFO) {
298
0
        av_log(h->c.avctx, AV_LOG_INFO,
299
0
               "num:%5d x:%2d y:%2d type:%d qscale:%2d rnd:%d\n",
300
0
               seq, h->c.mb_x, h->c.mb_y, h->c.pict_type, h->c.qscale,
301
0
               h->c.no_rounding);
302
0
    }
303
304
60.6k
    av_assert0(h->c.pict_type != AV_PICTURE_TYPE_B || !h->c.low_delay);
305
306
60.6k
    return h->c.mb_width * h->c.mb_height - mb_pos;
307
60.6k
}
308
309
static av_cold void rv10_build_vlc(VLCElem vlc[], int table_size,
310
                                   const uint16_t len_count[15],
311
                                   const uint8_t sym_rl[][2], int sym_rl_elems)
312
4
{
313
4
    uint16_t syms[MAX_VLC_ENTRIES];
314
4
    uint8_t  lens[MAX_VLC_ENTRIES];
315
4
    unsigned nb_syms = 0, nb_lens = 0;
316
317
76
    for (unsigned i = 0; i < sym_rl_elems; i++) {
318
72
        unsigned cur_sym = sym_rl[i][0];
319
3.14k
        for (unsigned tmp = nb_syms + sym_rl[i][1]; nb_syms <= tmp; nb_syms++)
320
3.06k
            syms[nb_syms] = 0xFF & cur_sym--;
321
72
    }
322
323
64
    for (unsigned i = 0; i < 15; i++)
324
3.12k
        for (unsigned tmp = nb_lens + len_count[i]; nb_lens < tmp; nb_lens++)
325
3.06k
            lens[nb_lens] = i + 2;
326
4
    av_assert1(nb_lens == nb_syms);
327
4
    ff_vlc_init_table_from_lengths(vlc, table_size, DC_VLC_BITS, nb_lens,
328
4
                                   lens, 1, syms, 2, 2, 0, 0);
329
4
}
330
331
static av_cold void rv10_init_static(void)
332
2
{
333
2
    rv10_build_vlc(rv_dc_lum, FF_ARRAY_ELEMS(rv_dc_lum), rv_lum_len_count,
334
2
                   rv_sym_run_len, FF_ARRAY_ELEMS(rv_sym_run_len));
335
10
    for (int i = 0; i < 1 << (DC_VLC_BITS - 7 /* Length of skip prefix */); i++) {
336
        /* All codes beginning with 0x7F have the same length and value.
337
         * Modifying the table directly saves us the useless subtables. */
338
8
        rv_dc_lum[(0x7F << (DC_VLC_BITS - 7)) + i].sym = 255;
339
8
        rv_dc_lum[(0x7F << (DC_VLC_BITS - 7)) + i].len = 18;
340
8
    }
341
2
    rv10_build_vlc(rv_dc_chrom, FF_ARRAY_ELEMS(rv_dc_chrom), rv_chrom_len_count,
342
2
                   rv_sym_run_len, FF_ARRAY_ELEMS(rv_sym_run_len) - 2);
343
4
    for (int i = 0; i < 1 << (DC_VLC_BITS - 9 /* Length of skip prefix */); i++) {
344
        /* Same as above. */
345
2
        rv_dc_chrom[(0x1FE << (DC_VLC_BITS - 9)) + i].sym = 255;
346
2
        rv_dc_chrom[(0x1FE << (DC_VLC_BITS - 9)) + i].len = 18;
347
2
    }
348
2
}
349
350
static av_cold int rv10_decode_init(AVCodecContext *avctx)
351
7.55k
{
352
7.55k
    static AVOnce init_static_once = AV_ONCE_INIT;
353
7.55k
    RVDecContext *rv = avctx->priv_data;
354
7.55k
    H263DecContext *const h = &rv->h;
355
7.55k
    int major_ver, minor_ver, micro_ver, ret;
356
357
7.55k
    if (avctx->extradata_size < 8) {
358
381
        av_log(avctx, AV_LOG_ERROR, "Extradata is too small.\n");
359
381
        return AVERROR_INVALIDDATA;
360
381
    }
361
7.17k
    if ((ret = av_image_check_size(avctx->coded_width,
362
7.17k
                                   avctx->coded_height, 0, avctx)) < 0)
363
23
        return ret;
364
365
7.14k
    ret = ff_h263_decode_init(avctx);
366
7.14k
    if (ret < 0)
367
0
        return ret;
368
369
7.14k
    rv->orig_width  = avctx->coded_width;
370
7.14k
    rv->orig_height = avctx->coded_height;
371
372
7.14k
    h->h263_long_vectors = avctx->extradata[3] & 1;
373
7.14k
    rv->sub_id           = AV_RB32A(avctx->extradata + 4);
374
7.14k
    if (avctx->codec_id == AV_CODEC_ID_RV20) {
375
3.93k
        h->modified_quant        = 1;
376
3.93k
        h->c.chroma_qscale_table = ff_h263_chroma_qscale_table;
377
3.93k
    }
378
379
7.14k
    major_ver = RV_GET_MAJOR_VER(rv->sub_id);
380
7.14k
    minor_ver = RV_GET_MINOR_VER(rv->sub_id);
381
7.14k
    micro_ver = RV_GET_MICRO_VER(rv->sub_id);
382
383
7.14k
    switch (major_ver) {
384
4.42k
    case 1:
385
4.42k
        h->rv10_version = micro_ver ? 3 : 1;
386
4.42k
        h->c.obmc         = micro_ver == 2;
387
4.42k
        break;
388
2.61k
    case 2:
389
2.61k
        if (minor_ver >= 2) {
390
2.50k
            h->c.low_delay      = 0;
391
2.50k
            avctx->has_b_frames = 1;
392
2.50k
        }
393
2.61k
        break;
394
116
    default:
395
116
        av_log(avctx, AV_LOG_ERROR, "unknown header %X\n", rv->sub_id);
396
116
        avpriv_request_sample(avctx, "RV1/2 version");
397
116
        return AVERROR_PATCHWELCOME;
398
7.14k
    }
399
400
7.03k
    if (avctx->debug & FF_DEBUG_PICT_INFO) {
401
0
        av_log(avctx, AV_LOG_DEBUG, "ver:%X ver0:%"PRIX32"\n", rv->sub_id,
402
0
               AV_RL32A(avctx->extradata));
403
0
    }
404
405
    /* init static VLCs */
406
7.03k
    ff_thread_once(&init_static_once, rv10_init_static);
407
408
7.03k
    return 0;
409
7.14k
}
410
411
static int rv10_decode_packet(AVCodecContext *avctx, const uint8_t *buf,
412
                              int buf_size, int buf_size2, int whole_size)
413
108k
{
414
108k
    RVDecContext *rv = avctx->priv_data;
415
108k
    H263DecContext *const h = &rv->h;
416
108k
    int mb_count, mb_pos, left, start_mb_x, active_bits_size, ret;
417
418
108k
    active_bits_size = buf_size * 8;
419
108k
    init_get_bits(&h->gb, buf, FFMAX(buf_size, buf_size2) * 8);
420
108k
    if (h->c.codec_id == AV_CODEC_ID_RV10)
421
37.2k
        mb_count = rv10_decode_picture_header(h);
422
71.2k
    else
423
71.2k
        mb_count = rv20_decode_picture_header(rv, whole_size);
424
108k
    if (mb_count < 0) {
425
19.7k
        if (mb_count != ERROR_SKIP_FRAME)
426
19.2k
            av_log(h->c.avctx, AV_LOG_ERROR, "HEADER ERROR\n");
427
19.7k
        return AVERROR_INVALIDDATA;
428
19.7k
    }
429
430
88.6k
    if (h->c.mb_x >= h->c.mb_width ||
431
87.7k
        h->c.mb_y >= h->c.mb_height) {
432
2.92k
        av_log(h->c.avctx, AV_LOG_ERROR, "POS ERROR %d %d\n", h->c.mb_x, h->c.mb_y);
433
2.92k
        return AVERROR_INVALIDDATA;
434
2.92k
    }
435
85.7k
    mb_pos = h->c.mb_y * h->c.mb_width + h->c.mb_x;
436
85.7k
    left   = h->c.mb_width * h->c.mb_height - mb_pos;
437
85.7k
    if (mb_count > left) {
438
678
        av_log(h->c.avctx, AV_LOG_ERROR, "COUNT ERROR\n");
439
678
        return AVERROR_INVALIDDATA;
440
678
    }
441
442
85.0k
    if (whole_size < h->c.mb_width * h->c.mb_height / 8)
443
3.13k
        return AVERROR_INVALIDDATA;
444
445
81.9k
    if ((h->c.mb_x == 0 && h->c.mb_y == 0) || !h->c.cur_pic.ptr) {
446
        // FIXME write parser so we always have complete frames?
447
76.0k
        if (h->c.cur_pic.ptr) {
448
23.2k
            ff_er_frame_end(&h->c.er, NULL);
449
23.2k
            ff_mpv_frame_end(&h->c);
450
23.2k
            h->c.mb_x = h->c.mb_y = h->c.resync_mb_x = h->c.resync_mb_y = 0;
451
23.2k
        }
452
76.0k
        if ((ret = ff_mpv_frame_start(&h->c, avctx)) < 0)
453
2.82k
            return ret;
454
73.1k
        ff_mpv_er_frame_start_ext(&h->c, 0, h->c.pp_time, h->c.pb_time);
455
73.1k
    } else {
456
5.90k
        if (h->c.cur_pic.ptr->f->pict_type != h->c.pict_type) {
457
943
            av_log(h->c.avctx, AV_LOG_ERROR, "Slice type mismatch\n");
458
943
            return AVERROR_INVALIDDATA;
459
943
        }
460
5.90k
    }
461
462
463
78.1k
    ff_dlog(avctx, "qscale=%d\n", h->c.qscale);
464
465
    /* default quantization values */
466
78.1k
    if (h->c.codec_id == AV_CODEC_ID_RV10) {
467
27.9k
        if (h->c.mb_y == 0)
468
27.2k
            h->c.first_slice_line = 1;
469
50.1k
    } else {
470
50.1k
        h->c.first_slice_line = 1;
471
50.1k
        h->c.resync_mb_x      = h->c.mb_x;
472
50.1k
    }
473
78.1k
    start_mb_x     = h->c.mb_x;
474
78.1k
    h->c.resync_mb_y = h->c.mb_y;
475
476
78.1k
    ff_set_qscale(&h->c, h->c.qscale);
477
478
78.1k
    h->rv10_first_dc_coded[0] = 0;
479
78.1k
    h->rv10_first_dc_coded[1] = 0;
480
78.1k
    h->rv10_first_dc_coded[2] = 0;
481
78.1k
    ff_init_block_index(&h->c);
482
483
    /* decode each macroblock */
484
2.28M
    for (h->mb_num_left = mb_count; h->mb_num_left > 0; h->mb_num_left--) {
485
2.25M
        int ret;
486
2.25M
        ff_update_block_index(&h->c, 8, h->c.avctx->lowres, 1);
487
2.25M
        ff_tlog(avctx, "**mb x=%d y=%d\n", h->c.mb_x, h->c.mb_y);
488
489
2.25M
        h->c.mv_dir  = MV_DIR_FORWARD;
490
2.25M
        h->c.mv_type = MV_TYPE_16X16;
491
2.25M
        ret = ff_h263_decode_mb(h);
492
493
        // Repeat the slice end check from ff_h263_decode_mb with our active
494
        // bitstream size
495
2.25M
        if (ret != SLICE_ERROR && active_bits_size >= get_bits_count(&h->gb)) {
496
2.20M
            int v = show_bits(&h->gb, 16);
497
498
2.20M
            if (get_bits_count(&h->gb) + 16 > active_bits_size)
499
6.23k
                v >>= get_bits_count(&h->gb) + 16 - active_bits_size;
500
501
2.20M
            if (!v)
502
4.57k
                ret = SLICE_END;
503
2.20M
        }
504
2.25M
        if (ret != SLICE_ERROR && active_bits_size < get_bits_count(&h->gb) &&
505
2.84k
            8 * buf_size2 >= get_bits_count(&h->gb)) {
506
1.42k
            active_bits_size = buf_size2 * 8;
507
1.42k
            av_log(avctx, AV_LOG_DEBUG, "update size from %d to %d\n",
508
1.42k
                   8 * buf_size, active_bits_size);
509
1.42k
            ret = SLICE_OK;
510
1.42k
        }
511
512
2.25M
        if (ret == SLICE_ERROR || active_bits_size < get_bits_count(&h->gb)) {
513
44.8k
            av_log(h->c.avctx, AV_LOG_ERROR, "ERROR at MB %d %d\n", h->c.mb_x,
514
44.8k
                   h->c.mb_y);
515
44.8k
            return AVERROR_INVALIDDATA;
516
44.8k
        }
517
2.20M
        if (h->c.pict_type != AV_PICTURE_TYPE_B)
518
2.06M
            ff_h263_update_motion_val(&h->c);
519
2.20M
        ff_mpv_reconstruct_mb(&h->c, h->block);
520
2.20M
        if (h->loop_filter)
521
837k
            ff_h263_loop_filter(&h->c);
522
523
2.20M
        if (++h->c.mb_x == h->c.mb_width) {
524
411k
            h->c.mb_x = 0;
525
411k
            h->c.mb_y++;
526
411k
            ff_init_block_index(&h->c);
527
411k
        }
528
2.20M
        if (h->c.mb_x == h->c.resync_mb_x)
529
397k
            h->c.first_slice_line = 0;
530
2.20M
        if (ret == SLICE_END)
531
4.57k
            break;
532
2.20M
    }
533
534
33.3k
    ff_er_add_slice(&h->c.er, start_mb_x, h->c.resync_mb_y, h->c.mb_x - 1, h->c.mb_y,
535
33.3k
                    ER_MB_END);
536
537
33.3k
    return active_bits_size;
538
78.1k
}
539
540
static int get_slice_offset(AVCodecContext *avctx, const uint8_t *buf, int n)
541
145k
{
542
145k
    return AV_RL32(buf + n * 8);
543
145k
}
544
545
static int rv10_decode_frame(AVCodecContext *avctx, AVFrame *pict,
546
                             int *got_frame, AVPacket *avpkt)
547
627k
{
548
627k
    const uint8_t *buf = avpkt->data;
549
627k
    int buf_size       = avpkt->size;
550
627k
    MpegEncContext *s = avctx->priv_data;
551
627k
    int i, ret;
552
627k
    int slice_count;
553
627k
    const uint8_t *slices_hdr = NULL;
554
555
627k
    ff_dlog(avctx, "*****frame %"PRId64" size=%d\n", avctx->frame_num, buf_size);
556
557
    /* no supplementary picture */
558
627k
    if (buf_size == 0) {
559
3.84k
        return 0;
560
3.84k
    }
561
562
623k
    slice_count = (*buf++) + 1;
563
623k
    buf_size--;
564
565
623k
    if (!slice_count || buf_size <= 8 * slice_count) {
566
491k
        av_log(avctx, AV_LOG_ERROR, "Invalid slice count: %d.\n",
567
491k
               slice_count);
568
491k
        return AVERROR_INVALIDDATA;
569
491k
    }
570
571
132k
    slices_hdr = buf + 4;
572
132k
    buf       += 8 * slice_count;
573
132k
    buf_size  -= 8 * slice_count;
574
575
166k
    for (i = 0; i < slice_count; i++) {
576
133k
        unsigned offset = get_slice_offset(avctx, slices_hdr, i);
577
133k
        int size, size2;
578
579
133k
        if (offset >= buf_size)
580
21.8k
            return AVERROR_INVALIDDATA;
581
582
111k
        if (i + 1 == slice_count)
583
104k
            size = buf_size - offset;
584
7.04k
        else
585
7.04k
            size = get_slice_offset(avctx, slices_hdr, i + 1) - offset;
586
587
111k
        if (i + 2 >= slice_count)
588
107k
            size2 = buf_size - offset;
589
4.53k
        else
590
4.53k
            size2 = get_slice_offset(avctx, slices_hdr, i + 2) - offset;
591
592
111k
        if (size <= 0 || size2 <= 0 ||
593
109k
            offset + FFMAX(size, size2) > buf_size)
594
3.39k
            return AVERROR_INVALIDDATA;
595
596
108k
        if ((ret = rv10_decode_packet(avctx, buf + offset, size, size2, buf_size)) < 0)
597
75.0k
            return ret;
598
599
33.3k
        if (ret > 8 * size)
600
811
            i++;
601
33.3k
    }
602
603
32.4k
    if (s->cur_pic.ptr && s->mb_y >= s->mb_height) {
604
21.2k
        ff_er_frame_end(&s->er, NULL);
605
21.2k
        ff_mpv_frame_end(s);
606
607
21.2k
        if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) {
608
18.7k
            if ((ret = av_frame_ref(pict, s->cur_pic.ptr->f)) < 0)
609
0
                return ret;
610
18.7k
            ff_print_debug_info(s, s->cur_pic.ptr, pict);
611
18.7k
            ff_mpv_export_qp_table(s, pict, s->cur_pic.ptr, FF_MPV_QSCALE_TYPE_MPEG1);
612
18.7k
        } else if (s->last_pic.ptr) {
613
2.16k
            if ((ret = av_frame_ref(pict, s->last_pic.ptr->f)) < 0)
614
0
                return ret;
615
2.16k
            ff_print_debug_info(s, s->last_pic.ptr, pict);
616
2.16k
            ff_mpv_export_qp_table(s, pict,s->last_pic.ptr, FF_MPV_QSCALE_TYPE_MPEG1);
617
2.16k
        }
618
619
21.2k
        if (s->last_pic.ptr || s->low_delay) {
620
20.8k
            *got_frame = 1;
621
20.8k
        }
622
623
        // so we can detect if frame_end was not called (find some nicer solution...)
624
21.2k
        ff_mpv_unref_picture(&s->cur_pic);
625
21.2k
    }
626
627
32.4k
    return avpkt->size;
628
32.4k
}
629
630
const FFCodec ff_rv10_decoder = {
631
    .p.name         = "rv10",
632
    CODEC_LONG_NAME("RealVideo 1.0"),
633
    .p.type         = AVMEDIA_TYPE_VIDEO,
634
    .p.id           = AV_CODEC_ID_RV10,
635
    .priv_data_size = sizeof(RVDecContext),
636
    .init           = rv10_decode_init,
637
    FF_CODEC_DECODE_CB(rv10_decode_frame),
638
    .close          = ff_mpv_decode_close,
639
    .p.capabilities = AV_CODEC_CAP_DR1,
640
    .p.max_lowres   = 3,
641
    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
642
};
643
644
const FFCodec ff_rv20_decoder = {
645
    .p.name         = "rv20",
646
    CODEC_LONG_NAME("RealVideo 2.0"),
647
    .p.type         = AVMEDIA_TYPE_VIDEO,
648
    .p.id           = AV_CODEC_ID_RV20,
649
    .priv_data_size = sizeof(RVDecContext),
650
    .init           = rv10_decode_init,
651
    FF_CODEC_DECODE_CB(rv10_decode_frame),
652
    .close          = ff_mpv_decode_close,
653
    .p.capabilities = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_DELAY,
654
    .flush          = ff_mpeg_flush,
655
    .p.max_lowres   = 3,
656
    .caps_internal  = FF_CODEC_CAP_INIT_CLEANUP,
657
};