1 files changed, 34 insertions, 8 deletions

diff --git a/libavcodec/aasc.c b/libavcodec/aasc.c
index edca24c..db33eff 100644
--- a/libavcodec/aasc.c
+++ b/libavcodec/aasc.c
@@ -2,20 +2,20 @@
  * Autodesk RLE Decoder
  * Copyright (C) 2005 the ffmpeg project
  *
- * This file is part of Libav.
+ * This file is part of FFmpeg.
  *
- * Libav is free software; you can redistribute it and/or
+ * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * Libav is distributed in the hope that it will be useful,
+ * FFmpeg is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with Libav; if not, write to the Free Software
+ * License along with FFmpeg; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
@@ -43,8 +43,18 @@ static av_cold int aasc_decode_init(AVCodecContext *avctx)
     AascContext *s = avctx->priv_data;
 
     s->avctx = avctx;
-
-    avctx->pix_fmt = PIX_FMT_BGR24;
+    switch (avctx->bits_per_coded_sample) {
+    case 16:
+        avctx->pix_fmt = PIX_FMT_RGB555;
+        break;
+    case 24:
+        avctx->pix_fmt = PIX_FMT_BGR24;
+        break;
+    default:
+        av_log(avctx, AV_LOG_ERROR, "Unsupported bit depth: %d\n", avctx->bits_per_coded_sample);
+        return -1;
+    }
+    avcodec_get_frame_defaults(&s->frame);
 
     return 0;
 }
@@ -58,7 +68,7 @@ static int aasc_decode_frame(AVCodecContext *avctx,
     AascContext *s = avctx->priv_data;
     int compr, i, stride;
 
-    s->frame.reference = 1;
+    s->frame.reference = 3;
     s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
     if (avctx->reget_buffer(avctx, &s->frame)) {
         av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
@@ -68,22 +78,38 @@ static int aasc_decode_frame(AVCodecContext *avctx,
     compr = AV_RL32(buf);
     buf += 4;
     buf_size -= 4;
+    switch (avctx->codec_tag) {
+    case MKTAG('A', 'A', 'S', '4'):
+        bytestream2_init(&s->gb, buf - 4, buf_size + 4);
+        ff_msrle_decode(avctx, (AVPicture*)&s->frame, 8, &s->gb);
+        break;
+    case MKTAG('A', 'A', 'S', 'C'):
     switch(compr){
     case 0:
         stride = (avctx->width * 3 + 3) & ~3;
         for(i = avctx->height - 1; i >= 0; i--){
+            if(avctx->width*3 > buf_size){
+                av_log(avctx, AV_LOG_ERROR, "Next line is beyond buffer bounds\n");
+                break;
+            }
             memcpy(s->frame.data[0] + i*s->frame.linesize[0], buf, avctx->width*3);
             buf += stride;
+            buf_size -= stride;
         }
         break;
     case 1:
-        bytestream2_init(&s->gb, buf - 4, buf_size + 4);
+        bytestream2_init(&s->gb, buf, buf_size);
         ff_msrle_decode(avctx, (AVPicture*)&s->frame, 8, &s->gb);
         break;
     default:
         av_log(avctx, AV_LOG_ERROR, "Unknown compression type %d\n", compr);
         return -1;
     }
+        break;
+    default:
+        av_log(avctx, AV_LOG_ERROR, "Unknown FourCC: %X\n", avctx->codec_tag);
+        return -1;
+    }
 
     *data_size = sizeof(AVFrame);
     *(AVFrame*)data = s->frame;