Luca Barbato
2da49df19e
lavc: set the default rc_initial_buffer_occupancy
...
rc_buffer_size is not set before.
Solve the initial the rate control underflow issue reported in
bug 222.
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit bff3607547
2013-10-16 22:54:30 +02:00
Luca Barbato
c25bbb6fdb
4xm: Reject not a multiple of 16 dimension
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2f034f255c
2013-09-29 22:37:12 +02:00
Luca Barbato
12dc01bb1f
4xm: do not overread the prestream buffer
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit be373cb50d
2013-09-29 22:37:06 +02:00
Luca Barbato
cd9b0bb07a
4xm: validate the buffer size before parsing it
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit de2e5777e2
2013-09-29 22:37:03 +02:00
Luca Barbato
53c76b6803
indeo: Do not reference mismatched tiles
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f9e5261cab
2013-09-29 21:48:57 +02:00
Luca Barbato
7999ff8966
indeo: Sanitize ff_ivi_init_planes fail paths
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 28dda8a691
2013-09-29 21:48:30 +02:00
Luca Barbato
a0b8f85f29
indeo: Bound-check before applying motion compensation
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 25a6666f6c
2013-09-29 21:41:49 +02:00
Luca Barbato
c02b9e6e63
indeo: Bound-check before applying transform
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit dc79685195
2013-09-29 21:41:12 +02:00
Luca Barbato
efe710f8a0
indeo: reject negative array indexes
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6a10142faa
2013-09-29 21:39:02 +02:00
Luca Barbato
aedde1a48d
indeo: Cosmetic formatting
...
Trim some overly long lines.
(cherry picked from commit 6dfacd7ab1
2013-09-29 21:38:28 +02:00
Luca Barbato
c5da487a38
indeo: Refactor ff_ivi_init_tiles and ivi_decode_blocks
...
Spin large and mostly self contained blocks into stand alone
functions.
(cherry picked from commit 62256010e9
2013-09-29 21:19:17 +02:00
Luca Barbato
f21dce6044
indeo: Refactor ff_ivi_dec_huff_desc
...
Spare an indentation level.
(cherry picked from commit f6f36ca8ca
2013-09-29 21:03:27 +02:00
Anton Khirnov
9978c24abf
lavf: fix the comparison in an overflow check
...
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 26f027fba1
2013-09-23 19:54:13 -04:00
Luca Barbato
b0ca5fef09
dv: Add a guard to not overread the ppcm array
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7ee191cab0
2013-09-23 19:54:02 -04:00
Martin Storsjö
5473d23ece
mpegvideo: Avoid 32-bit wrapping of linesize multiplications
...
This makes sure that linesize * start_y doesn't overflow, so that
emulated_edge_mc can get back the original value if needed.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a711a2cb47
2013-09-23 19:53:02 -04:00
Michael Niedermayer
7a9af1da39
mjpegb: Detect changing number of planes in interlaced video
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit af11fa5409
2013-09-23 19:52:45 -04:00
Martin Storsjö
068c867286
matroskadec: Check that .lang was allocated and set before reading it
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5bcd3ae5b1
2013-09-23 19:50:54 -04:00
Anton Khirnov
23f73fc241
ape demuxer: check for EOF in potentially long loops
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry-picked from commit 488b2984fe
2013-09-23 19:48:52 -04:00
Anton Khirnov
8d2a86a290
lavf: avoid integer overflow when estimating bitrate
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit df33a58e53
2013-09-23 19:47:41 -04:00
Anton Khirnov
5773065a71
pictordec: break out of both decoding loops when y drops below 0
...
Otherwise picmemset can get called with negative y, resulting in an
invalid write.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5f7aecde02
2013-09-23 19:46:49 -04:00
Luca Barbato
c225c620c6
ac3: Return proper error codes
...
(cherry picked from commit b1f9cdc37f
2013-09-23 19:45:33 -04:00
Luca Barbato
37e69e2dee
ac3: Clean up the error paths
...
(cherry picked from commit 818d1f1a3e
2013-09-23 19:45:22 -04:00
Luca Barbato
3dff283de1
ac3: Do not clash with normal AVERROR
...
The parsing function return AVERROR and AAC_AC3_PARSE_ERROR values,
make sure they are not misunderstood.
(cherry picked from commit 6258d362b8
2013-09-23 19:45:05 -04:00
Luca Barbato
86c169c5b6
dxa: Make sure the reference frame exists
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5ef7c84a93
2013-09-23 19:43:07 -04:00
Luca Barbato
91355bec88
h261: check the mtype index
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c59967fa7c
2013-09-23 19:42:57 -04:00
Luca Barbato
896baaaad8
segafilm: Error out on impossible packet size
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5268bd2900
2013-09-23 19:41:09 -04:00
Luca Barbato
15620c153a
ogg: Always alloc the private context in vorbis_header
...
It is possible to have an initial broken header and then valid packets.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3562684db7
2013-09-23 19:41:09 -04:00
Luca Barbato
75b1b13aff
vc1: check mb_height validity.
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 43bacd5b7d
2013-09-23 19:41:09 -04:00
Luca Barbato
54e0386369
vc1: check the source buffer in vc1_mc functions
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 090cd06311
2013-09-23 19:41:09 -04:00
Luca Barbato
9c779b5dd0
bink: Bound check the quantization matrix.
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9991298f2c
2013-09-23 19:41:08 -04:00
Luca Barbato
8006716f21
xl: Make sure the width is valid
...
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-23 19:25:50 -04:00
Luca Barbato
246e0e2c99
alsdec: Fix the clipping range
...
mcc_weightings is only 32 elements.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 70ecc175c7
2013-09-23 19:22:22 -04:00
Luca Barbato
0d24adbe8d
dsicinav: Bound-check the source buffer when needed
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit dd0bfc3a6a
2013-09-23 19:18:39 -04:00
Martin Storsjö
a593d2e92e
mov: Do not allow updating the time scale after it has been set
...
The time scale is set in mdhd, and later validated in the
enclosing trak atom once all of its children have been parsed.
A loose mdhd atom outside of a trak atom could update the time
scale of the last stream without any validation.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 31931520df
2013-09-23 19:16:04 -04:00
Martin Storsjö
729143e2d2
ac3dec: Don't consume more data than the actual input packet size
...
This was handled properly in the normal return case at the end
of the function, but not in this special case.
Returning a value larger than the input packet size can cause
problems for certain library users.
Returning the actual input buffer size unconditionally, since
it is not guaranteed that frame_size is set to a sensible
value at this point.
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8f24c12be7
2013-09-23 19:14:14 -04:00
Luca Barbato
36921fcdd3
indeo: Reject impossible FRAMETYPE_NULL
...
A frame marked FRAMETYPE_NULL cannot be scalable and requires a
previous frame successfully decoded.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5b2a29552c
2013-09-23 19:11:37 -04:00
Luca Barbato
e2dcb8208e
indeo5: return proper error codes
...
(cherry picked from commit b0eeb9d442
2013-09-23 19:09:10 -04:00
Luca Barbato
609345cd5e
indeo4: Validate scantable dimension
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cd78e934c2
2013-09-23 18:54:13 -04:00
Luca Barbato
06c52faef2
indeo4: Check the quantization matrix index
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6255ccf7d5
2013-09-23 18:53:01 -04:00
Luca Barbato
ba5dfc25ee
indeo4: Do not access missing reference MV
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8435bca087
2013-09-23 18:52:16 -04:00
Luca Barbato
68b1008719
adpcm: Unbreak ima-dk4
...
Was broken by commit b9dea1a085
2013-09-21 15:33:11 +02:00
Justin Ruggles
763519536b
ac3dec: validate channel output mode against channel count
...
Damaged frames can lead to a mismatch, which can cause a segfault
due to using an incorrect channel mapping.
CC:libav-stable@libav.org
(cherry picked from commit d7c450436f
2013-09-21 15:21:54 +02:00
Luca Barbato
521cbcb7d3
dca: Respect the current limits in the downmixing capabilities
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3802833bc1
2013-09-21 15:19:06 +02:00
Luca Barbato
ce3ce08850
dca: Error out on missing DSYNC
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f261e50845
2013-09-21 15:17:28 +02:00
Luca Barbato
62c3547539
pcm: always use codec->id instead of codec_id
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c82da343e6
2013-09-21 15:15:34 +02:00
Luca Barbato
47baf9ca87
mlpdec: Do not set invalid context in read_restart_header
...
The faulty values rippled further down the codepath causing a
hard-to-track segfault in the assembly code.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e9d394f3fa
2013-09-21 15:14:29 +02:00
Luca Barbato
9c3c08ba98
pcx: Do not overread source buffer in pcx_rle_decode
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3abde1a3b4
2013-09-21 15:11:27 +02:00
Luca Barbato
9c05debdcd
wmavoice: conceal clearly corrupted blocks
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d14a26edb7
2013-09-21 15:11:18 +02:00
Luca Barbato
195b9f290c
iff: Do not read over the source buffer
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7d65e960c7
2013-09-21 15:11:07 +02:00
Luca Barbato
57efb6d94c
qdm2: Conceal broken samples
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 4ecdb5ed44
2013-09-21 15:08:50 +02:00
