* commit '5af78cc98d':
mlp: store the channel layout for each substream.
mlpdec: TrueHD: use Libav channel order.
mlpdec: set the channel layout.
x86: ac3: Fix HAVE_MMXEXT condition to only refer to external assembly
Conflicts:
libavcodec/mlp_parser.c
libavcodec/mlpdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '1fd2deedcc':
mlpdec: set the channel layout.
Conflicts:
libavcodec/mlpdec.c
(cherry picked from commit 1cf6f6f3da)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '99ccd2ba10':
mlp: store the channel layout for each substream.
Conflicts:
libavcodec/mlp_parser.c
libavcodec/mlpdec.c
(cherry picked from commit fa36270c4c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Also stop storing the channel arrangement in the header info, as it's unused outside of ff_mlp_read_major_sync.
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
CC:libav-stable@libav.org
(cherry picked from commit 99ccd2ba10)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This should fix Ticket2116
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 127ff88639)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes Ticket2154
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ccf9dd00da)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 695af8eed6)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Without any correctly decoded slices, there can be no frame.
Fixes out of array reads
Found-by: Rafaël Carré
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 60af6c3138)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The existing checks are insufficient to detect a pixel format
changes in case of some damaged streams.
Fixes inconsistency and later out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 11c99c78ba)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Prevent out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 96f452ac64)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array writes
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ab6c9332bf)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c10350358d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This prevents a buffer overflow in rle_decode()
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7357ca900e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes vlc decoding for hypothetical files that would contain such cases.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0dfc01c2bb)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Prevents out of array writes
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f67a0d1152)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
arm: vp8: Fix the plain-armv6 version of vp8_luma_dc_wht
Prepare for 9.2 Release
lavr: call mix_function_init() in ff_audio_mix_set_matrix()
rtpenc_chain: Use the original AVFormatContext for getting payload type
rtp: Make sure the output format pointer is set
Conflicts:
RELEASE
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '62de693a17':
rtp: Make sure priv_data is set before reading it
videodsp_armv5te: remove #if HAVE_ARMV5TE_EXTERNAL
get_bits: change the failure condition in init_get_bits
mpegvideo: fix loop condition in draw_line()
Conflicts:
libavcodec/get_bits.h
libavcodec/mpegvideo.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This makes the plain-armv6 version use the same registers as the
armv6t2 version above.
This fixes fate-vp8 on plain-armv6 devices.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 2026eb1408)
Signed-off-by: Martin Storsjö <martin@martin.st>
The fps is stored as a 8 bit value thus 255 is the maximum encodable.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 55d66b2790)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes part of Ticket2045
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9362f31b55)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes part of Ticket2045
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bee044d7c2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Avoids integer overflows and out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 49b729d3af)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
A negative `size' will bypass FFMIN(). In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.
Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e692374f7)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Sanity checks like `data + size >= data_end || data + size < data' are
broken, because `data + size < data' assumes pointer overflow, which is
undefined behavior in C. Many compilers such as gcc/clang optimize such
checks away.
Use `size < 0 || size >= data_end - data' instead.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 902cfe2f74)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The check `start + res < start' is broken since pointer overflow is
undefined behavior in C. Many compilers such as gcc/clang optimize
away this check.
Use `res > end - start' instead. Also change `res' to unsigned int
to avoid signed left-shift overflow.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2f014567cf)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Karcher <ffmpeg@mkarcher.dialup.fu-berlin.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dcbb920f15)
This is needed if a custom matrix is set by the user after opening the
AVAudioResampleContext because the matrix channel count can change if
different mixing coefficients are used.
CC:libav-stable@libav.org
(cherry picked from commit f07ef2d9c9)
Conflicts:
libavresample/audio_mix.c
In ff_rtp_get_payload_type, the AVFormatContext is used for checking
whether the payload_type or rtpflags options are set. In rtpenc_chain,
the rtpctx struct is a newly initialized struct where no options have
been set yet, so no options can be fetched from there.
All muxers that internally chain rtp muxers have the "rtpflags" field
that allows passing such options on (which is how this worked before
8034130e06), so this works just as intended.
This makes it possible to produce H263 in RFC2190 format with chained
RTP muxers.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4a4a7e138c)
Signed-off-by: Martin Storsjö <martin@martin.st>
Not sure if this actually happens, but we do the same check when
checking payload_type further above in the function, so it might
be needed.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 932117171f)
Signed-off-by: Martin Storsjö <martin@martin.st>
