0 means no data consumed, so it can trigger an infinite loop in the
caller.
CC:libav-stable@libav.org
(cherry picked from commit c7d9b473e2)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Fixes possible invalid memory accesses on corrupted data.
CC:libav-stable@libav.org
Bug-ID: CVE-2013-3674
(cherry picked from commit a1599f3f7e)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The vertical offset mask 0x07 is suspicious.
v_off = FFMIN(data[2] & 0x07, CDG_BORDER_HEIGHT - 1);
Note that v_off is up to 11 (CDG_BORDER_HEIGHT - 1), the correct mask
should be 0x0F.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Also break some long lines, remove codec function placeholder comments
and add spaces in sample/pixel format lists.
Signed-off-by: Martin Storsjö <martin@martin.st>
Passing an explicit filename to this command is only necessary if the
documentation in the @file block refers to a file different from the
one the block resides in.
Originally committed as revision 22921 to svn://svn.ffmpeg.org/ffmpeg/trunk
reference must be 3 because both "fields" are used as reference,
and buffer_hints must include readable since we might memcpy from the old frame.
Originally committed as revision 20923 to svn://svn.ffmpeg.org/ffmpeg/trunk