func: int CVE_2014_8541_PATCHED_ff_mjpeg_decode_sof(MJpegDecodeContext *s) int len , nb_components , i , width , height , bits , pix_fmt_id , ret ; int h_count [ MAX_COMPONENTS ] ; int v_count [ MAX_COMPONENTS ] ; s -> cur_scan = 0; s -> upscale_h = s -> upscale_v = 0; s -> avctx -> bits_per_raw_sample = bits = get_bits ( & s -> gb , 8 ); if ( s -> pegasus_rct )  bits = 9; if ( bits == 9 && ! s -> pegasus_rct )  s -> rct = 1; if ( s -> lossless && s -> avctx -> lowres )  height = get_bits ( & s -> gb , 16 ); width = get_bits ( & s -> gb , 16 ); if ( s -> interlaced && s -> width == width && s -> height == height + 1 )  height = s -> height; if ( av_image_check_size ( width , height , 0 , s -> avctx ) )  nb_components = get_bits ( & s -> gb , 8 ); if ( nb_components <= 0 || nb_components > MAX_COMPONENTS )  if ( s -> interlaced && ( s -> bottom_field == ! s -> interlace_polarity ) )  if ( nb_components != s -> nb_components )  if ( s -> ls && ! ( bits <= 8 || nb_components == 1 ) )  s -> nb_components = nb_components; s -> h_max = 1; s -> v_max = 1; memset ( h_count , 0 , sizeof ( h_count ) ); memset ( v_count , 0 , sizeof ( v_count ) ); for (i = 0; i < nb_components; i++) s -> component_id [ i ] = get_bits ( & s -> gb , 8 ) - 1; h_count [ i ] = get_bits ( & s -> gb , 4 ); v_count [ i ] = get_bits ( & s -> gb , 4 ); if ( h_count [ i ] > s -> h_max )  s -> h_max = h_count [ i ]; if ( v_count [ i ] > s -> v_max )  s -> v_max = v_count [ i ]; s -> quant_index [ i ] = get_bits ( & s -> gb , 8 ); if ( s -> quant_index [ i ] >= 4 )  if ( ! h_count [ i ] || ! v_count [ i ] )  if ( s -> ls && ( s -> h_max > 1 || s -> v_max > 1 ) )  if ( width != s -> width || height != s -> height || bits != s -> bits || memcmp ( s -> h_count , h_count , sizeof ( h_count ) ) || memcmp ( s -> v_count , v_count , sizeof ( v_count ) ) )  s -> width = width; s -> height = height; s -> bits = bits; memcpy ( s -> h_count , h_count , sizeof ( h_count ) ); memcpy ( s -> v_count , v_count , sizeof ( v_count ) ); s -> interlaced = 0; s -> got_picture = 0; if ( s -> first_picture && s -> org_height != 0 && s -> height < ( ( s -> org_height * 3 ) / 4 ) )  s -> interlaced = 1; s -> bottom_field = s -> interlace_polarity; s -> picture_ptr -> interlaced_frame = 1; s -> picture_ptr -> top_field_first = ! s -> interlace_polarity; height *= 2; ret = ff_set_dimensions ( s -> avctx , width , height ); if ( ret < 0 )  s -> first_picture = 0; if ( s -> got_picture && s -> interlaced && ( s -> bottom_field == ! s -> interlace_polarity ) )  if ( s -> progressive )  if ( s -> v_max == 1 && s -> h_max == 1 && s -> lossless == 1 && ( nb_components == 3 || nb_components == 4 ) )  s -> rgb = 1; if ( ! s -> lossless )  s -> rgb = 0; pix_fmt_id = ( s -> h_count [ 0 ] << 28 ) | ( s -> v_count [ 0 ] << 24 ) | ( s -> h_count [ 1 ] << 20 ) | ( s -> v_count [ 1 ] << 16 ) | ( s -> h_count [ 2 ] << 12 ) | ( s -> v_count [ 2 ] << 8 ) | ( s -> h_count [ 3 ] << 4 ) | s -> v_count [ 3 ]; if ( ! ( pix_fmt_id & 0xD0D0D0D0 ) )  pix_fmt_id -= ( pix_fmt_id & 0xF0F0F0F0 ) >> 1; if ( ! ( pix_fmt_id & 0x0D0D0D0D ) )  pix_fmt_id -= ( pix_fmt_id & 0x0F0F0F0F ) >> 1; for (i = 0; i < 8; i++) int j = 6 + ( i & 1 ) - ( i & 6 ) ; int is = ( pix_fmt_id >> ( 4 * i ) ) & 0xF ; int js = ( pix_fmt_id >> ( 4 * j ) ) & 0xF ; if ( is == 1 && js != 2 && ( i < 2 || i > 5 ) )  js = ( pix_fmt_id >> ( 8 + 4 * ( i & 1 ) ) ) & 0xF; if ( is == 1 && js != 2 && ( i < 2 || i > 5 ) )  js = ( pix_fmt_id >> ( 16 + 4 * ( i & 1 ) ) ) & 0xF; if ( is == 1 && js == 2 )  if ( i & 1 )  s -> upscale_h |= 1 << ( j / 2 ); s -> upscale_v |= 1 << ( j / 2 ); switch ( pix_fmt_id )  if ( s -> rgb )  s -> avctx -> pix_fmt = s -> bits <= 9 ? AV_PIX_FMT_BGR24 : AV_PIX_FMT_BGR48; if ( s -> component_id [ 0 ] == 'Q' && s -> component_id [ 1 ] == 'F' && s -> component_id [ 2 ] == 'A' )  s -> avctx -> pix_fmt = s -> bits <= 8 ? AV_PIX_FMT_GBRP : AV_PIX_FMT_GBRP16; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = s -> cs_itu601 ? AV_PIX_FMT_YUV444P : AV_PIX_FMT_YUVJ444P; s -> avctx -> pix_fmt = AV_PIX_FMT_YUV444P16; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; if ( s -> rgb )  s -> avctx -> pix_fmt = s -> bits <= 9 ? AV_PIX_FMT_ABGR : AV_PIX_FMT_RGBA64; if ( s -> adobe_transform == 0 && s -> bits <= 8 )  s -> avctx -> pix_fmt = AV_PIX_FMT_GBRAP; s -> avctx -> pix_fmt = s -> bits <= 8 ? AV_PIX_FMT_YUVA444P : AV_PIX_FMT_YUVA444P16; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; if ( s -> adobe_transform == 0 && s -> bits <= 8 )  s -> avctx -> pix_fmt = AV_PIX_FMT_GBRAP; s -> upscale_v = 6; s -> upscale_h = 6; s -> chroma_height = s -> height; if ( s -> adobe_transform == 2 && s -> bits <= 8 )  s -> avctx -> pix_fmt = AV_PIX_FMT_YUVA444P; s -> upscale_v = 6; s -> upscale_h = 6; s -> chroma_height = s -> height; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = AV_PIX_FMT_YUVA420P; s -> avctx -> pix_fmt = AV_PIX_FMT_YUVA420P16; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = s -> cs_itu601 ? AV_PIX_FMT_YUV444P : AV_PIX_FMT_YUVJ444P; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; s -> chroma_height = s -> height; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = s -> cs_itu601 ? AV_PIX_FMT_YUV444P : AV_PIX_FMT_YUVJ444P; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; s -> chroma_height = ( s -> height + 1 ) / 2; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = AV_PIX_FMT_GRAY8; s -> avctx -> pix_fmt = AV_PIX_FMT_GRAY16; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = s -> cs_itu601 ? AV_PIX_FMT_YUV440P : AV_PIX_FMT_YUVJ440P; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; s -> chroma_height = ( s -> height + 1 ) / 2; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = s -> cs_itu601 ? AV_PIX_FMT_YUV422P : AV_PIX_FMT_YUVJ422P; s -> avctx -> pix_fmt = AV_PIX_FMT_YUV422P16; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = s -> cs_itu601 ? AV_PIX_FMT_YUV422P : AV_PIX_FMT_YUVJ422P; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = s -> cs_itu601 ? AV_PIX_FMT_YUV420P : AV_PIX_FMT_YUVJ420P; s -> avctx -> pix_fmt = AV_PIX_FMT_YUV420P16; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; if ( pix_fmt_id == 0x42111100 )  s -> upscale_h = 6; s -> chroma_height = ( s -> height + 1 ) / 2; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = s -> cs_itu601 ? AV_PIX_FMT_YUV411P : AV_PIX_FMT_YUVJ411P; s -> avctx -> color_range = s -> cs_itu601 ? AVCOL_RANGE_MPEG : AVCOL_RANGE_JPEG; s -> upscale_h = s -> upscale_v = 0; if ( ( s -> upscale_h || s -> upscale_v ) && s -> avctx -> lowres )  if ( s -> ls )  s -> upscale_h = s -> upscale_v = 0; if ( s -> nb_components > 1 )  s -> avctx -> pix_fmt = AV_PIX_FMT_RGB24; if ( s -> palette_index && s -> bits <= 8 )  s -> avctx -> pix_fmt = AV_PIX_FMT_PAL8; if ( s -> bits <= 8 )  s -> avctx -> pix_fmt = AV_PIX_FMT_GRAY8; s -> avctx -> pix_fmt = AV_PIX_FMT_GRAY16; s -> pix_desc = av_pix_fmt_desc_get ( s -> avctx -> pix_fmt ); if ( ! s -> pix_desc )  if ( ff_get_buffer ( s -> avctx , s -> picture_ptr , AV_GET_BUFFER_FLAG_REF ) < 0 )  s -> picture_ptr -> pict_type = AV_PICTURE_TYPE_I; s -> picture_ptr -> key_frame = 1; s -> got_picture = 1; for (i = 0; i < 4; i++) s -> linesize [ i ] = s -> picture_ptr -> linesize [ i ] << s -> interlaced; if ( s -> rgb && ! s -> lossless && ! s -> ls )  if ( s -> progressive )  int bw = ( width + s -> h_max * 8 - 1 ) / ( s -> h_max * 8 ) ; int bh = ( height + s -> v_max * 8 - 1 ) / ( s -> v_max * 8 ) ; for (i = 0; i < s->nb_components; i++) int size = bw * bh * s -> h_count [ i ] * s -> v_count [ i ] ; s -> blocks [ i ] = av_mallocz_array ( size , sizeof ( * * s -> blocks ) ); s -> last_nnz [ i ] = av_mallocz_array ( size , sizeof ( * * s -> last_nnz ) ); if ( ! s -> blocks [ i ] || ! s -> last_nnz [ i ] )  s -> block_stride [ i ] = bw * s -> h_count [ i ]; memset ( s -> coefs_finished , 0 , sizeof ( s -> coefs_finished ) ); 