Carl Eugen Hoyos
00d35e82b2
Do not try to read 16bit gray png files with alpha channel.
...
FFmpeg does not support gray16a.
Fixes the crash in ticket #644 .
(cherry picked from commit 0c5fd6372e
2011-11-18 21:05:12 +01:00
K.Y.H
807342e1cf
cook: fix apparent typo in extradata parsing
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 554caed2d3
2011-11-18 21:05:12 +01:00
Alex Converse
f62fa1ce9f
vp5: Fix illegal read.
...
Found with Address Sanitizer
(cherry picked from commit bb4b0ad83b
2011-11-18 14:29:52 +01:00
Thierry Foucu
8a63deab15
vp6: Fix illegal read.
...
Found with Address Sanitizer
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit e0966eb140
2011-11-18 14:29:52 +01:00
Reimar Döffinger
d58c5586ec
nuv: Fix combination of size changes and LZO compression.
...
There were multiple issues, for example might we have to re-run
the decompression when the size of the buffer increased,
we should always use a decompression buffer large enough for
the header (so we do not get stuck when the size is too small).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
2011-11-08 19:48:14 +01:00
Michael Niedermayer
c4a34f4025
snow: emu edge support
...
Fixes Ticket592
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4416931fc0
2011-11-04 13:36:28 +01:00
Justin Ruggles
cba03dc667
imc: validate channel count
...
ask for a sample if not mono
(cherry picked from commit 7b7f47e733
2011-11-04 13:34:42 +01:00
Justin Ruggles
5a3f494466
imc: check for ff_fft_init() failure
...
(cherry picked from commit 95fee70d67
2011-11-04 13:34:35 +01:00
Justin Ruggles
112431705d
libgsmdec: check output buffer size before decoding
...
(cherry picked from commit b03761b130
2011-11-04 13:33:38 +01:00
Justin Ruggles
711e6c947b
cin audio: validate the channel count
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 13:32:18 +01:00
Justin Ruggles
8491677ab6
binkaudio: add some buffer overread checks.
...
This stops decoding before overreads instead of after.
(cherry picked from commit 101ef19ef4
2011-11-04 13:31:15 +01:00
Justin Ruggles
f98bb0d3ec
atrac1: validate number of channels
...
(cherry picked from commit bff5b2c1ca
2011-11-04 03:40:42 +01:00
Justin Ruggles
346e089d25
atrac1: check output buffer size before decoding
...
(cherry picked from commit 33684b9c12
2011-11-04 03:40:35 +01:00
Ronald S. Bultje
0ac6777a34
vp3: fix oob read for negative tokens and memleaks on error.
...
(cherry picked from commit 8370e426e4
2011-11-04 03:37:06 +01:00
Justin Ruggles
ae2d3d6be0
apedec: set s->currentframeblocks after validating nblocks
2011-11-04 03:32:39 +01:00
Justin Ruggles
998fc04bcf
apedec: use unsigned int for 'nblocks' and make sure that it's within int range
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:30:44 +01:00
Justin Ruggles
43fa5bf55e
apedec: check for data buffer realloc failure
...
(cherry picked from commit 11ca8b2d74
2011-11-04 03:23:39 +01:00
Justin Ruggles
f19b8d9533
apedec: check for filter buffer allocation failure
...
(cherry picked from commit 7500781313
2011-11-04 03:23:34 +01:00
Justin Ruggles
4a66fe2107
mpegaudiodec: check output data size based on avctx->frame_size
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:23:13 +01:00
Michael Niedermayer
edf3c5a3eb
resample: Fix array size
...
Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e7db0a9ee
2011-11-04 03:22:03 +01:00
Michael Niedermayer
a39b5e8b32
resample2: fix potential overflow
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Michael Niedermayer
6ae93d0304
resample: Fix overflow
...
Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Justin Ruggles
2137d99086
vorbisdec: check output buffer size before writing output
...
(cherry picked from commit 60aa1a358d
2011-11-04 03:18:52 +01:00
Justin Ruggles
e9de2d98a9
twinvq: check output buffer size before decoding
...
(cherry picked from commit e53eecd0e7
2011-11-04 03:18:52 +01:00
Alex Converse
93f1159af5
vp6: Fix illegal read.
...
(cherry picked from commit 2a6eb06254
2011-11-04 01:54:13 +01:00
Justin Ruggles
b08001e00a
shorten: check output buffer size before decoding
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:30:29 +01:00
Justin Ruggles
e1ea35fb52
shorten: check for realloc failure
...
(cherry picked from commit 9e5e2c2d01
2011-11-04 01:24:03 +01:00
Matthew Einhorn
f531193690
Fixes avpicture_layout to not write past buffer end.
...
avpicture_get_size() returns the size of buffer required for avpicture_layout.
For pseudo-paletted formats (gray8...) this size does not include the palette.
However, avpicture_layout doesn't know this and still writes the palette. Consequently,
avpicture_layout writes passed the length of the buffer. This fixes it
by fixing avpicture_layout so that it doesn't write the palette for these formats.
Signed-off-by: Matthew Einhorn <moiein2000@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e662b263d9
2011-11-04 01:23:47 +01:00
Ronald S. Bultje
15a7fe106c
pthread: copy coded frame dimensions in update_context_from_thread
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit feadcd1bdc
2011-11-04 01:23:28 +01:00
Ronald S. Bultje
d32f509de1
vp8: prevent read from uninitialized memory in decode_mvs
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 0f0b5d6434
2011-11-04 01:22:59 +01:00
Ronald S. Bultje
5f5f36b52e
vp8: force reallocation in update_thread_context after frame size change
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 5653579381
2011-11-04 01:22:52 +01:00
Ronald S. Bultje
d1166f03be
vp8: fix return value if update_dimensions fails
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit f05c2fb6eb
2011-11-04 01:22:45 +01:00
Justin Ruggles
62cf52c860
truespeech: check to make sure channels == 1
...
(cherry picked from commit 3e7a176759
2011-11-04 01:09:22 +01:00
Justin Ruggles
7e95a12d51
mlpdec: validate that the reported channel count matches the actual output
...
channel count
(cherry picked from commit caa845851d
2011-11-04 01:09:17 +01:00
Mans Rullgard
1c3d46a924
h264: fix HRD parameters parsing
...
The bit_rate_value_minus1 and cpb_size_value_minus1 elements
allow a wider range than get_ue_golomb() supports. This
adds a get_ue_golomb_long() function supporting up to 31
leading zeros, which is the maximum for these syntax
elements, and uses it in decode_hrd_parameters().
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit fdba370f8a
2011-11-04 01:08:09 +01:00
Justin Ruggles
800ab099e3
smacker: validate channels and sample format.
...
(cherry picked from commit ff1f89de2d
2011-11-04 01:07:49 +01:00
Justin Ruggles
e6b2255329
smacker: check buffer size before reading output size
...
(cherry picked from commit cf044f8bff
2011-11-04 01:07:44 +01:00
Justin Ruggles
7f7b2e89e2
smacker: validate number of channels
...
(cherry picked from commit e190e453bd
2011-11-04 01:07:39 +01:00
Mans Rullgard
73f85eae68
sipr: fix get_bits(0) calls
...
Zero-length get_bits() is undefined, must check before calling.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit c79d2a20ba
2011-11-04 01:02:46 +01:00
Mans Rullgard
190807a56c
4xm: fix signed overflow
...
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 84dda40762
2011-11-04 01:02:17 +01:00
Mans Rullgard
33029d7353
wmavoice: fix a signed overflow
...
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit ba3f07d061
2011-11-04 01:02:13 +01:00
Mans Rullgard
c41950099d
mpegvideo_enc: fix a signed overflow
...
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 05795f35be
2011-11-04 01:02:08 +01:00
Mans Rullgard
115d88c4b2
h264pred: use unsigned types for pixel values, fix signed overflows
...
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 60f10e0ad3
2011-11-04 01:01:48 +01:00
Laurent Aimar
a65045915f
qtrle: check for out of bound writes.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7fb92be7e5
2011-11-04 01:01:23 +01:00
Laurent Aimar
adb12c4deb
xxan: check for out of bound accesses
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a68a6a4fb1
2011-11-04 01:01:15 +01:00
Laurent Aimar
ca58b215ab
txd: check for out of bound reads.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e182de9a98
2011-11-04 01:01:11 +01:00
Laurent Aimar
67c46b9b30
qtrle: check for invalid line offset
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9
2011-11-04 01:01:07 +01:00
Laurent Aimar
7ab0b6b7ed
vqavideo: check for out of bound reads.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6d45702f7f
2011-11-04 01:01:04 +01:00
Laurent Aimar
2fdbc1d553
vqavideo: check for invalid/unsupported version
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b226af3910
2011-11-04 01:00:54 +01:00
Laurent Aimar
5415c488f9
eamad: release the reference frame on video size changes
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6c1fb3e763
2011-11-04 01:00:49 +01:00
