Commit graph

40669 commits

Author SHA1 Message Date
Luca Barbato
7064209096 msrle: Use FFABS to determine the frame size in msrle_decode_pal4
As done in msrle_decode_8_16_24_32.

Bug-Id: CVE-2015-3395
CC: libav-stable@libav.org
2015-05-30 16:30:22 +02:00
Michael Niedermayer
4dc0fbb13c x86: cavs: Remove an unneeded scratch buffer
Simplifies the code and makes it build on certain compilers
running out of registers on x86.

CC: libav-stable@libav.org
Reported-By: mudler
(cherry picked from commit e4610300de)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-05-28 18:42:30 +02:00
Mikulas Patocka
b37bfbfbe5 configure: Disable i686 for i586 and lower CPUs 2015-05-19 12:15:06 +01:00
Shiina Hideaki
5549f693d2 mjpegenc: Fix JFIF header byte ordering
The header had a wrong version description.

Bug-Id: 808
Signed-off-by: Shiina Hideaki <shiina@yndrd.com>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
2015-05-19 12:15:00 +01:00
Luca Barbato
1f64b018cb nut: Make sure to clean up on read_header failure
Based on Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> work.

CC: libav-stable@libav.org
2015-05-19 12:14:55 +01:00
wm4
0f50c53cfb png: Set the color range as full range
The format uses full range for the gray formats.

CC: libav-stable@libav.org
2015-05-19 12:14:50 +01:00
Andreas Cadhalpun
a55a706448 avi: Validate sample_size
And either error out or set it to 0 if it is negative.

CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-05-19 12:14:44 +01:00
Andreas Cadhalpun
21b21aed79 nut: Check chapter creation in decode_info_header
This fixes a segmentation fault when accessing the metadata.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org
2015-05-19 12:14:39 +01:00
Andreas Cadhalpun
cb5324200c alac: Reject rice_limit 0 if compression is used
If in compression mode rice_limit = 0 leads to call
`show_bits(gb, k)` in `decode_scalar` with k = 0.

Request a sample in case it is valid and it should be accepted.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org
2015-05-19 12:14:30 +01:00
Andreas Cadhalpun
ac1660509e ape: Support _0000 files with nblock smaller than 64
The decode_array_0000 assumed that 64 is the minimal block size
while it is not.

CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-05-19 12:14:25 +01:00
Michael Niedermayer
386e80610d mux: Do not leave stale side data pointers in ff_interleave_add_packet()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
2015-05-19 12:14:18 +01:00
Luca Barbato
744d813bcf avresample: Reallocate the internal buffer to the correct size
Fixes the corner case in which the internal buffer size
is larger than input buffer provided and resizing it
before moving the left over samples would make it write
to now unallocated memory.

Bug-Id: 825
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-05-19 12:13:33 +01:00
John Högberg
844201e35f mpegts: Update the PSI/SI table only if the version change
If a PAT is finished while a PMT section filter is opened but
not yet finished, the PMT section filter is closed and all
the received data is discarded.

This is usually not an issue but some multiplexers (With very
quick PAT/PMT repetition settings) consistently emit a PMT
section start, then a PAT, and then the rest of the PMT,
causing the aforementioned behavior to result in no PMT being
finished.

In the most pathologic situation the stream information are lost
and the probe fallback miscategorizes subtitles as mp3 audio.

Avoid the issue through eliminating redundant PSI/SI table
updates by checking their version field, which is required by
the standard to be incremented on every change no matter how
minor.

CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-05-19 12:13:23 +01:00
Martin Storsjö
f77c9d7161 rtsp: Make sure we don't write too many transport entries into a fixed-size array
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
2015-05-19 12:12:57 +01:00
Andrey Utkin
4415d0f3bb rtpenc_jpeg: Handle case of picture dimensions not dividing by 8
This fixes the calculation of the number of needed blocks to make
sure that ALL pixels are represented by the result.

Signed-off-by: Martin Storsjö <martin@martin.st>
2015-05-19 12:12:38 +01:00
Vittorio Giovara
8ae4d4e117 mov: Fix little endian audio detection
Set this field to TRUE if the audio component is to operate on
little-endian data, and FALSE otherwise.

However TRUE and FALSE are not defined. Since this flag is just a boolean,
interpret all values except for 0 as little endian.

Sample-Id: 64bit_FLOAT_Little_Endian.mov
2015-05-19 12:05:23 +01:00
Luca Barbato
2af720fe5f x86: Put COPY3_IF_LT under HAVE_6REGS
It uses 6 registers, unbreaks building on hardened x86 system.

Bug-Id: gentoo/541930
CC: libav-stable@libav.org
2015-05-19 12:04:41 +01:00
Andreas Cadhalpun
9f6c36d961 roqvideoenc: set enc->avctx in roq_encode_init
So far it is only set in roq_encode_frame, but it is used in
roq_encode_end to free the coded_frame. This currently segfaults if
roq_encode_frame is not called between roq_encode_init and
roq_encode_end.

CC:libav-stable@libav.org
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-05-19 12:03:48 +01:00
Vittorio Giovara
78a3a4580c mp3: Properly use AVCodecContext API
Rather than having an unitialized context on the stack, allocate it with
defaults and free it when unneeded.

CC: libav-stable@libav.org
2015-05-19 12:03:20 +01:00
Vittorio Giovara
7244cefd6e libvpx: Fix mixed use of av_malloc() and av_reallocp()
This buffer is resized when vpx_codec_get_cx_data() returns a
VPX_CODEC_STATS_PKT packet.

CC: libav-stable@libav.org
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
2015-05-19 12:00:12 +01:00
Anton Khirnov
8b86c2ed2e Revert "lavfi: always check av_expr_parse_and_eval() return value"
This reverts commit 63be97ec40.

All those calls were unchecked on purpose, as explained in the comments
in the code.

(cherry picked from commit 3735b5c616)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-05-05 21:41:52 +02:00
Andreas Cadhalpun
378ee3bad5 alsdec: only adapt order for positive max_order
For max_order = 0 the clipping range is invalid. (amin = 2, amax = 1)

CC: libav-stable@libav.org
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 60f1cc4a1f)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-05-05 21:41:43 +02:00
Andreas Cadhalpun
41a89cba60 alsdec: check sample pointer range in revert_channel_correlation
Also change the type of begin, end and smp to ptrdiff_t to make the
comparison well-defined.

CC: libav-stable@libav.org
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 94bb1ce882)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-05-05 21:41:40 +02:00
Andreas Cadhalpun
7b66cf5ce7 aacpsy: correct calculation of minath in psy_3gpp_init
The minimum of the ath(x, ATH_ADD) function depends on ATH_ADD.
This patch uses the first order approximation to determine it.

For ATH_ADD = 4 this results in the value at 3407.06812 (-5.24241638)
not the one at 3410 (-5.24237967).

CC: libav-stabl@libav.org
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 110f7f35fb)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-05-05 21:41:36 +02:00
Andreas Cadhalpun
97010c74cb alsdec: limit avctx->bits_per_raw_sample to 32
avctx->bits_per_raw_sample is used in get_sbits_long, which only
supports up to 32 bits.

CC: libav-stable@libav.org
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit e191aaca44)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-05-05 21:41:32 +02:00
Andreas Cadhalpun
0d3a7dd264 aasc: return correct buffer size from aasc_decode_frame
CC: libav-stable@libav.org
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 8fc8024ea5)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-05-05 21:41:26 +02:00
Thomas Guillem
3e1c9da38b matroskadec: fix crash when parsing invalid mkv
CC: libav-stable@libav.org

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit b8d7f3186e)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-04-18 16:50:30 +02:00
Anton Khirnov
420aa06a24 avconv: do not overwrite the stream codec context for streamcopy
Since we are not doing encoding, there is no point in ever touching the
separate encoding context. Always use the stream codec context.

Fixes writing attachments.

CC:libav-devel@libav.org
(cherry picked from commit 3892bdab9b)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	avconv.c
2015-04-05 09:26:54 +02:00
Andreas Cadhalpun
b7c8a1fbbd webp: ensure that each transform is only used once
According to the WebP Lossless Bitstream Specification
"each transform is allowed to be used only once".

If a transform is more than once this can lead to memory
corruption.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 30e6abd1a8)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-21 09:45:30 +01:00
Anton Khirnov
9cef65434e h264_ps: properly check cropping parameters against overflow
CC: libav-stable@libav.org
(cherry picked from commit d8a45d2d49)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-21 09:45:20 +01:00
Anton Khirnov
a529f6648e hevc: zero the correct variables on invalid crop parameters
It's the output_window that is applied to the output frame, not
pic_conf_win

(cherry picked from commit 5127c00b97)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-21 09:45:19 +01:00
Anton Khirnov
a219add4e8 hevc: make the crop sizes unsigned
(cherry picked from commit c929659bdd)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-21 09:45:18 +01:00
Reinhard Tartler
00abc0080d doc: More changelog updates for v11.3 2015-03-08 21:51:11 -04:00
Michael Niedermayer
3a417a86b3 utvideodec: Handle slice_height being zero
Fixes out of array accesses.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-9604
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0ce3a0f9d9)
2015-03-09 00:51:48 +01:00
Andreas Cadhalpun
a73b2c288e adxdec: set avctx->channels in adx_read_header
It is used in adx_read_packet, which currently depends on the
decoder/parser setting this value between reading the file header and
demuxing the first packet.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-08 19:34:38 +00:00
Andreas Cadhalpun
2ef2f60b4f rmenc: limit packet size
The chunk size is limited to UINT16_MAX (written by avio_wb16), so make
sure that the packet size is not too large.

Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-08 19:21:55 +00:00
Andreas Cadhalpun
905172d75c webp: validate the distance prefix code
According to the WebP Lossless Bitstream Specification the highest
allowed value for a prefix code is 39.

If prefix_code is too large, the calculated extra_bits has an invalid
value and triggers an assertion in get_bits.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-08 19:21:49 +00:00
Andreas Cadhalpun
8aee35acb1 rv10: check size of s->mb_width * s->mb_height
If it doesn't fit into 12 bits it triggers an assertion.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-08 19:21:41 +00:00
Federico Tomassetti
e818da7724 eamad: check for out of bounds read
Bug-Id: CID 1257500
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-03-08 19:19:55 +00:00
Federico Tomassetti
2c63081b48 mdec: check for out of bounds read
Bug-Id: CID 1257501
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-03-08 19:19:49 +00:00
Vittorio Giovara
4070e02dfc configure: Properly fail when libcdio/cdparanoia is not found 2015-03-08 19:19:39 +00:00
Anton Khirnov
77eb3d9a60 tiff: Check that there is no aliasing in pixel format selection
Fixes possible issues with unexpected bpp/bppcount values.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-8544
(cherry picked from commit ae5e1f3d66)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-03-08 19:16:16 +01:00
Vittorio Giovara
f3dafb63d0 aic: Fix decoding files with odd dimensions
Normally the aic decoder finds the proper slice combination (multiple of
some number less than 32) but in case of odd width, it resorts to the
default values, which were actually swapped.
The number of slices is modified to account for such odd width cases.

CC: libav-stable@libav.org
(cherry picked from commit e878ec0d47)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-03-08 17:27:53 +01:00
Luca Barbato
7136a0bf88 vorbis: Check the vlc value in setup_classifs
The valid returned values are always at most 11bit.
Remove the previous check that assumed larger values plausible and
use a signed integer to check get_vlc2 return values.

CC: libav-stable@libav.org
(cherry picked from commit 0025f7408a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-03-08 17:24:50 +01:00
Martin Storsjö
450b02307c arm: Suppress tags about used cpu arch and extensions
When all the codepaths using manually set .arch/.fpu code is
behind runtime detection, the elf attributes should be suppressed.

This allows tools to know that the final built binary doesn't
strictly require these extensions.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit dcae2e32f7
and b77e335e44)
Signed-off-by: Martin Storsjö <martin@martin.st>
2015-03-08 18:11:36 +02:00
Reinhard Tartler
fc3c1156e3 doc: Update changelog for v11.3 2015-03-08 11:12:14 -04:00
Reinhard Tartler
7c1fe31617 Prepare for 11.3 Release 2015-03-08 11:06:15 -04:00
Luca Barbato
cf3523c6e7 prores: Extend the padding check to 16bit
Some files produced by the official encoder have up to 16bit of
padding instead of the expected padding to the byte.

Use a self-explanatory macro instead of a simple number.

CC: libav-stable@libav.org

(cherry picked from commit dbc1163b20)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-03-02 15:34:29 +01:00
Mark McGough
e10028431d icecast: Do not use chunked post
Icecast uses HTTP 1.0 while Libav uses HTTP 1.1 and enables by
default chunked post.

Icecast actually forwards the HTTP chunk headers to the listener
as part of the media stream (without the chunk encoding HTTP headers)
causing the players to lose sync.

Disabling the option is enough to feed icecast properly.

(cherry picked from commit 76c70e33d2)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-02-28 15:04:30 +01:00
Vittorio Giovara
4cd54b2f97 img2dec: correctly use the parsed value from -start_number
Previously the image sequence was always starting from the minimum
number rather than the requested one.

CC: libav-stable@libav.org
2015-02-22 23:51:15 +00:00