wangds / libflic Goto Github PK

In commit 024417e src/flic.rs:324,
the inequality:

if self.hdr.frame_count <= 2 {
    return Err(FlicError::Corrupted);
}

should read:

if self.hdr.frame_count < 2 {
    return Err(FlicError::Corrupted);
}

The bug causes it to fail when attempting to encode a FLIC file with exactly
1 frame + 1 ring frame.

In commit c5c2c78 src/codec/codec016.rs:54,
the destination row:

let dst_start = dst.stride * dy + dst.x;

should read:

let dst_start = dst.stride * (dst.y + dy) + dst.x;

The bug causes decode_fps_copy to not respect the destination raster's Y offset.

In commit 6971785 src/codec/codec007.rs:229,
the test for the maximum packet count:

if count > 2 * ::std::u16::MAX as usize {
    return Err(FlicError::ExceededLimit);
}

should read:

if count > 2 * ::std::i16::MAX as usize {
    return Err(FlicError::ExceededLimit);
}

The bug allows lines with packet counts between 0x8000 and 0xFFFF to be
written, which would be interpreted as either a "skip lines" or a "write last
byte" operation.

In commit 4709cfc src/codec/codec018.rs:145,
the postage stamp is initialised with:

let mut pstamp = Vec::with_capacity(dst_w * dst_h);

It should instead be initialised with:

let mut pstamp = vec![0; dst_w * dst_h];

Vec::with_capacity does not allocate any elements, causing a panic due to
index out of range.

In commit 024417e,
around src/flic.rs:649,

match encode_fli_lc(prev.unwrap(), next, w) {
    Ok(size) =>
        if size == 0 {
            try!(w.seek(SeekFrom::Start(pos0)));
            return Ok(0);
        } else if size < next.w * next.h {
            chunk = Some((size, FLI_LC));
        },
    ... 
}

and src/flic.rs:669,

match encode_fli_brun(next, w) {
    Ok(size) =>
        if size < next.w * next.h {
            chunk = Some((size, FLI_BRUN));
        },
    ...
}   

If the FLI_LC/FLI_BRUN chunk is larger than size >= next.w * next.h
(the size of a FLI_COPY chunk), the cursor is not returned to the
original position. This causes the FLI_COPY data to be appended to
the chunk instead of overwriting it.