Commit graph

13727 commits

Author SHA1 Message Date
Mans Rullgard
4ed486dc3a h264: fix detection of optional trailing PPS elements
The PPS may contain a few trailing elements whose presence is
only signalled by data remaining after the the mandatory part
has been parsed.  The current code fails to take into account
the rbsp_trailing_bits() when deciding whether to parse these
optional elements.  Assuming no unnecessary padding bytes are
passed to this function, the optional elements are present if
either more than 8 extra bits remain or the remaining bits do
not form a valid rbsp_trailing_bits() after the mandatory PPS
elements have been parsed.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit be1242a3f2)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2012-02-19 15:08:42 +01:00
Laurent Aimar
ba31a01681 h264: reset h->ref_count in case of errors in ff_h264_decode_ref_pic_list_reordering()
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 4c7a232fc8)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2012-02-19 15:08:42 +01:00
Mans Rullgard
1e809ab887 h264pred: use unsigned types for pixel values, fix signed overflows
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 60f10e0ad3)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2012-02-19 15:08:42 +01:00
Michael Niedermayer
c6bb93dcd9 H264: Only wait before triggering ff_thread_setup_complete() until the next slice that contains a start-of-field/frame macroblock
This allows concurrent decoding of the last field/frame, rather than
only the last slice, of data packets with multiple NAL units packed
together.

This will fix the slowdown reported in e.g. bug 52.

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 14c21c1ff5)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2012-02-19 15:08:42 +01:00
Ronald S. Bultje
485f85aa90 h264: correct implicit_weight for field-interlaced pictures.
(cherry picked from commit 4418aa9cb3)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2012-02-19 15:08:42 +01:00
Laurent Aimar
ec2a1d91e2 h264: check for out of bounds reads in ff_h264_decode_extradata().
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit d1186ff72d)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2012-02-19 15:08:42 +01:00
Chris Evans
b0283ccb9e vorbis: An additional defense in the Vorbis codec.
Fixes Bug: #190
Chromium Bug: #100543
Related to CVE-2011-3893

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit afb2aa5379)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-01-08 09:11:02 +01:00
Reinhard Tartler
97f23c72a3 vorbisdec: Fix decoding bug with channel handling
Fixes Bug: #191
Chromium Bug: #101458
CVE-2011-3895

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit e6d527ff72)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-01-08 09:10:55 +01:00
Chris Evans
4a94678f1b vorbis: Avoid some out-of-bounds reads
Fixes Bug: #190
Chromium Bug: #100543
Related to CVE-2011-3893

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 57cd6d7095)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-01-07 21:59:02 +01:00
Ronald S. Bultje
c624935554 vp3: fix oob read for negative tokens and memleaks on error.
(cherry picked from commit 8370e426e4)

Fixes: #189
Chromium-Bug: 101172,100465
CVE-2011-3892

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-01-07 09:24:52 +01:00
Janne Grunau
82a11fcff2 vp3: fix streams with non-zero last coefficient
Fixes a regression introduced in 8b94df0f20.
(cherry picked from commit 9b4767e478)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-01-05 20:59:29 +01:00
Shitiz Garg
d912a30c7d 4xm: Add a check in decode_i_frame to prevent buffer overreads
Fixes bugzilla #135

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 355d917c0b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-23 22:27:02 +01:00
Justin Ruggles
8dba5608dc wma: initialize prev_block_len_bits, next_block_len_bits, and block_len_bits.
The initial values are not checked against the number of block sizes.
Initializing them to frame_len_bits will result in a block size index of 0
in these cases instead of something that might be out-of-range.

Fixes Bug 81.
(cherry picked from commit 05d1e45d1f)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-23 22:27:02 +01:00
Reinhard Tartler
bba709214a vp3dec: Check coefficient index in vp3_dequant()
Based on a patch by Michael Niedermayer <michaelni@gmx.at>

Fixes NGS00145, CVE-2011-4352

Found-by: Phillip Langlois
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry picked from commit 8b94df0f20)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-23 15:56:01 +01:00
Michael Niedermayer
0eca0da06e svq1dec: call avcodec_set_dimensions() after dimensions changed.
Fixes NGS00148, CVE-2011-4579

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

(cherry picked from commit 6e24b9488e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-23 15:55:38 +01:00
Thierry Foucu
ba4b08b789 vp6: Fix illegal read.
Found with Address Sanitizer

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit e0966eb140)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-04 09:21:09 +01:00
Alex Converse
67a7ed623b vp6: Fix illegal read.
(cherry picked from commit 2a6eb06254)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-04 09:20:49 +01:00
Laurent Aimar
c76505e0de vp6: Reset the internal state when aborting key frames header parsing
It prevents leaving the state only half initialized.

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit a72cad0a6c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-04 09:20:28 +01:00
Laurent Aimar
30c08e2261 vp6: Check for huffman tree build errors
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 066fff755a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-04 09:20:10 +01:00
Dustin Brody
7367cbec1b vp6: partially propagate huffman tree building errors during coeff model parsing and fix misspelling
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit f913eeea43)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-04 09:19:29 +01:00
Justin Ruggles
7347205351 qdm2: check output buffer size before decoding
(cherry picked from commit 7d49f79f1c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-04 08:55:55 +01:00
Laurent Aimar
0d93d5c461 Fix out of bound reads in the QDM2 decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 5a19acb17c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-04 08:55:55 +01:00
Laurent Aimar
a31ccacb1a Check for out of bound writes in the QDM2 decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 291d74a46d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-04 08:44:09 +01:00
Laurent Aimar
494cfacdb9 vmd: fix segfaults on corruped streams
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-12-03 21:07:07 +01:00
Anton Khirnov
07624cfeaa Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info. 2011-11-19 10:22:27 +01:00
Baptiste Coudurier
23f0d0f16b lavc: fix parentheses placement in avcodec_open2().
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 1d36fb13b0)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-11-19 10:22:27 +01:00
Anton Khirnov
47953c33ea lavc: introduce avcodec_open2() as a replacement for avcodec_open().
Adds support for decoder-private options and makes setting other options
simpler.
(cherry picked from commit 0b950fe240)

Conflicts:

	libavcodec/avcodec.h

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-11-19 10:22:26 +01:00
Mans Rullgard
ecda54a640 ppc: fix 32-bit PIC build
On 32-bit ppc, the GOT pointer must be loaded manually.
This adds a "get_got" assembler macro to compute the
GOT address.  The "movrel" macro is updated to take an
additional parameter containing the GOT address since
no register is reserved for this purpose on ppc32.
These changes have no effect on ppc64 builds.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 6e4a35ced9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2011-09-26 19:31:32 +02:00
Laurent Aimar
2bbb142a14 rv34: Check for invalid slice offsets
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4cc7732386)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:33 +02:00
Laurent Aimar
b4a1bf0bbf rv34: Fix potential overreads
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit b4ed3d78cb)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:33 +02:00
Laurent Aimar
f0bcba238a rv34: Avoid NULL dereference on corrupted bitstream
rv34_decode_slice() can return without allocating any pictures.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d0f6ab0298)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:33 +02:00
Laurent Aimar
28d948ac44 rv10: Reject slices that does not have the same type as the first one
This prevents crashes with some corrupted bitstreams.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4a29b47186)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:33 +02:00
Laurent Aimar
54a178f28f Fixed size given to init_get_bits().
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit b59efc9434)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:32 +02:00
Michael Niedermayer
78cd2e18a4 smacker: fix a few off by 1 errors
stereo & 16bit is untested due to lack of samples

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5166376f24)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:32 +02:00
Laurent Aimar
0d93b03e68 Check for invalid VLC value in smacker decoder.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 6489455495)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:32 +02:00
Laurent Aimar
5b1f79b092 Check and propagate errors when VLC trees cannot be built in smacker decoder.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 9676ffba83)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:32 +02:00
Alex Converse
61ddc8271d xan: Add some buffer checks
(cherry picked from commit 0872bb23b4)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:32 +02:00
Laurent Aimar
e6694dce1c Fixed size given to init_get_bits() in xan decoder.
(cherry picked from commit 393d5031c6)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:32 +02:00
Laurent Aimar
9b30b7b9bf Fixed segfault with wavpack decoder on corrupted decorrelation terms sub-blocks.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8bfea4ab4e)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:32 +02:00
Alex Converse
384ed15c2a cljr: init_get_bits size in bits instead of bytes
(cherry picked from commit 0c1f5b93d9)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:32 +02:00
Alex Converse
6550e2b5c5 indeo2: fail if input buffer too small
(cherry picked from commit b7ce4f1d1c)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:31 +02:00
Alex Converse
af32fa929a indeo2: init_get_bits size in bits instead of bytes
(cherry picked from commit 68ca330cbd)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:31 +02:00
Laurent Aimar
07b3c4cde5 ffv1: Fixed size given to init_get_bits() in decoder.
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 46b004959b)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:31 +02:00
Alex Converse
5d4c065476 wavpack: Check error codes rather than working around error conditions.
(cherry picked from commit dba2b63a98)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:31 +02:00
Laurent Aimar
4b84e995ad Fixed invalid access in wavpack decoder on corrupted bitstream.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 55354b7de2)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:31 +02:00
Laurent Aimar
685940da4c Fixed invalid writes in wavpack decoder on corrupted bitstreams.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0aedab0340)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:31 +02:00
Laurent Aimar
aee461277a Fixed invalid access in wavpack decoder on corrupted extra bits sub-blocks.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit beefafda63)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:31 +02:00
Anton Khirnov
a4f2973b2d lavc: fix type for thread_type option
It should be flags, not int.
(cherry picked from commit fb47997edb)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:31 +02:00
Alberto Delmás
db5e27f94e VC1: Fix first/last row checks with slices
In some places 0/mb_height were used in place of start_mb_y/end_mb_y.

Fixes SA00049, SA00058, SA10091, SA10097, SA10131, SA20021, SA30030

Improves PSNR in SA00054, SA00059, SA00060, SA10096, SA10098, SA20022,
SA30031, SA30032, SA40012, SA40013

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 1cf82cab08)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:30 +02:00
Ronald S. Bultje
97ce2a29b6 vc1: properly zero coded_block[] edges on new slice entry.
Previously, we would leave the left edge uninitialized, which led to
CBP prediction errors on slice edges, e.g. in SA10098.vc1.
(cherry picked from commit d4b9974465)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-26 19:26:30 +02:00