* commit '10f77c165c':
pixdesc: mark gray8 as pseudopal
mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
mjpeg: Validate sampling factors
ljpeg: use the correct number of components in yuv
wavpack: validate samples size parsed in wavpack_decode_block
Conflicts:
libavcodec/mjpegdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Otherwise, during error conditions, the caller will be left with
dangling pointers to a destructed packet => boom.
BUG=242786
TEST=ffmpeg_regression_tests
Commit slightly simplified by commiter
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c54a1565f5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes a case where multichannel bitrate isn't accurately
targetted by psy model alone, never achieving the target bitrate.
Now fixed.
Fixes ticket #2625.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
Many functions treat it as such already.
Fixes Bug 499.
CC:libav-stable@libav.org
(cherry picked from commit f36d7831d9)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
They must be non-zero.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8aa3500905)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
When JPEG-LS support is disabled the decoder would feed the
data to the JPEG Lossless decode_*_scan function resulting in
faulty decoding.
CC: libav-stable@libav.org
(cherry picked from commit b25e49b187)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
MPV_decode_mb_internal needs 3 * 16 * linesize bytes of scratch buffer
For interlaced content, linesize is multiplied by two after the allocation
of the scratch buffer, and the dest_cr pointer ends past the buffer.
This patch makes ff_mpv_frame_size_alloc allocate a total of
(aligned line_size) * 2 * 16 * 3 bytes, which suffices even for the
interlaced case.
CC:libav-stable@libav.org
Signed-off-by: Jindrich Makovicka <makovick@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 259af1b923)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Fixes out of array read
Fixes ticket #2609.
Found-by: durandal_1707
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 695a766bff)
Prevents inconsistent state and null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 46cb61819d)
Conflicts:
libavcodec/gifdec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d23b8462b5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ee5e97c46)
Conflicts:
libavcodec/gifdec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad002e1a13)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes integer overflow and out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9dd04f6d8c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Solution based on rational.c, which uses isinf() too
This should fix compilation with msvc
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c25224737c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Should fix pgc warning
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc6f848dba)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes calling a random pointer
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7edb984dd0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes out of array accesses
The code prior to this commit could not have worked, thus obviously
was untested. I was also not able to find a valid sample that uses this
code.
This fix is thus only based on the description of the format
If someone has a sample that uses unpack_rle(), please mail me.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c1f2c4c3b4)
Conflicts:
libavcodec/vmdav.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0baa0a5a02)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8d3c99e825)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b39fd7d63648442c20671c3e4b357268ec5c49f2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes a few green artifacts at the top
Fixes rest of Ticket 2535
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c67bca2b5a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes green trash
Fixes part of Ticket2535
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bca50e5cd5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit adaa7743f5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '1ab4578c88':
lavc: Fix assignments in if() when calling ff_af_queue_add
wav: Always seek to an even offset
swscale: Use alpha from the right row in yuva2rgba_c
Prepare for 9.6 Release
Conflicts:
RELEASE
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '0662967d2b':
hls, segment: fix splitting for audio-only streams.
afifo: fix request_samples on the last frame in certain cases
id3v2: check for end of file while unescaping tags
indeo3: fix off by one in MV validity check
Conflicts:
libavformat/id3v2.c
libavformat/segment.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '46fd6e4f2e':
aac: check the maximum number of channels
update Changelog
riff: check for eof if chunk size and code are 0
oggdec: fix faulty cleanup prototype
Conflicts:
Changelog
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c8462bd17f':
mp3dec: fallback to generic seeking when a TOC is not present
svq1dec: clip motion vectors to the frame size.
svq1dec: check that the reference frame has the same dimensions as the current one
qdm2: check that the FFT size is a power of 2
Conflicts:
libavcodec/svq1dec.c
libavformat/mp3dec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '95db1624ef':
indeo3: switch parsing the header to bytestream2
indeo3: check motion vectors.
rv10: check that extradata is large enough
indeo3: fix data size check
Conflicts:
libavcodec/indeo3.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '8f558c3e10':
af_channelmap: sanity check input channel indices in all cases.
id3v2: pad the APIC packets as required by lavc.
lavf: make sure stream probe data gets freed.
dfa: check for invalid access in decode_wdlt().
Conflicts:
libavformat/id3v2.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '858864d350':
xmv: check audio track parameters validity.
bmv: check for len being valid in bmv_decode_frame().
xmv: do not leak memory in the error paths in xmv_read_header()
matroska: pass the lace size to the matroska_parse_rm_audio
Conflicts:
libavformat/matroskadec.c
libavformat/xmv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '05015d03da':
matroska: fix a corner case in ebml-lace parsing
avfiltergraph: check for sws opts being non-NULL before using them.
configure: Enable hwaccels without external dependencies by default.
oma: Validate sample rates
Conflicts:
libavfilter/avfiltergraph.c
libavfilter/graphparser.c
libavformat/oma.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
