Commit graph

36268 commits

Author SHA1 Message Date
Luca Barbato
93fbf034c9 wavpack: check packet size early
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit fd06291239)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-31 23:00:31 +02:00
Anton Khirnov
10f77c165c pixdesc: mark gray8 as pseudopal
Many functions treat it as such already.
Fixes Bug 499.

CC:libav-stable@libav.org
(cherry picked from commit f36d7831d9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-31 23:00:31 +02:00
Luca Barbato
aed12df7fe mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
Prevent out of buffer write when decoding broken samples.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cfbd98abe8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-31 23:00:31 +02:00
Luca Barbato
7923a25fdd mjpeg: Validate sampling factors
They must be non-zero.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8aa3500905)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-31 23:00:31 +02:00
Luca Barbato
510a96a211 ljpeg: use the correct number of components in yuv
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit a030279a67)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-31 23:00:31 +02:00
Luca Barbato
c340319559 wavpack: validate samples size parsed in wavpack_decode_block
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit ed50673066)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Conflicts:
	libavcodec/wavpack.c
2013-05-31 23:00:30 +02:00
Luca Barbato
0af5a774eb jpegls: check the scan offset
Prevent an out of array bound write.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit abad374909)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Conflicts:
	libavcodec/jpeglsdec.c
2013-05-31 23:00:30 +02:00
Reinhard Tartler
582aec4989 jpegls: factorize return paths
Conflicts:
	libavcodec/jpeglsdec.c

(cherry picked from commit 4a4107b489)
2013-05-31 23:00:30 +02:00
Luca Barbato
9eecf633f7 jpegls: return meaningful errors
(cherry picked from commit a5a0ef5e13)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Conflicts:
	libavcodec/jpeglsdec.c
2013-05-31 23:00:30 +02:00
Jindrich Makovicka
7f451cb01f mpegvideo: allocate sufficiently large scratch buffer for interlaced vid
MPV_decode_mb_internal needs 3 * 16 * linesize bytes of scratch buffer

For interlaced content, linesize is multiplied by two after the allocation
of the scratch buffer, and the dest_cr pointer ends past the buffer.

This patch makes ff_mpv_frame_size_alloc allocate a total of
(aligned line_size) * 2 * 16 * 3 bytes, which suffices even for the
interlaced case.

CC:libav-stable@libav.org

Signed-off-by: Jindrich Makovicka <makovick@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 259af1b923)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-31 23:00:30 +02:00
Luca Barbato
aaeef7fa0d mjpegdec: properly report unsupported disabled features
When JPEG-LS support is disabled the decoder would feed the
data to the JPEG Lossless decode_*_scan function resulting in
faulty decoding.

CC: libav-stable@libav.org
(cherry picked from commit b25e49b187)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-31 23:00:30 +02:00
Reinhard Tartler
2c23237cb4 Prepare for 9.7 Release 2013-05-31 23:00:30 +02:00
Reinhard Tartler
82c3792a30 update Changelog 2013-05-12 08:39:07 +02:00
Michael Smith
1fa37f2bfa proresdec: support mixed interlaced/non-interlaced content
Set interlaced to false if we don't have an interlaced frame

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0881cbf314)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-12 08:38:36 +02:00
Reinhard Tartler
d2d38531d6 update Changelog 2013-05-11 12:00:54 +02:00
Anton Khirnov
600bc1deba af_asyncts: fix offset calculation
delta is in samples, not bytes. Also the sample format is not guaranteed
to be planar.

CC:libav-stable@libav.org
(cherry picked from commit 16a4a18db0)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-11 12:00:54 +02:00
Luca Barbato
77a2f4cbcf oma: properly forward errors in oma_read_packet
Prevent spurios EIO on EOF.

CC:libav-stable@libav.org
(cherry picked from commit db9aee6ccf)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-11 12:00:54 +02:00
Anton Khirnov
7f8b55b560 indeo3: use unaligned reads on reference blocks.
They are not guaranteed to be aligned.
Fixes Bug 503.

CC:libav-stable@libav.org
(cherry picked from commit a97d8cc16e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-11 12:00:54 +02:00
Michael Niedermayer
1ab4578c88 lavc: Fix assignments in if() when calling ff_af_queue_add
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 1d7ffd06e4)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-05-08 19:05:21 +02:00
Luca Barbato
52ab9e8984 wav: Always seek to an even offset
RIFF chunks are aligned to 16bit according to the specification.

Bug-Id:500
CC:libav-stable@libav.org
(cherry picked from commit ac87eaf856)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-07 21:32:09 +02:00
Martin Storsjö
5772cbb343 swscale: Use alpha from the right row in yuva2rgba_c
Every other pixel had the alpha channel taken from the wrong
row.

This fixes bug 504.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 6e293d111f)

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-05-06 17:44:24 +03:00
Reinhard Tartler
a6f7fc8f3b Prepare for 9.6 Release 2013-05-04 10:54:29 +02:00
Anton Khirnov
0662967d2b hls, segment: fix splitting for audio-only streams.
CC:libav-stable@libav.org
(cherry picked from commit cf679b9476)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-04 10:53:18 +02:00
Anton Khirnov
ddeb6eeeb1 afifo: fix request_samples on the last frame in certain cases
The current code can fail to return the last frame if it contains
exactly the requested number of samples.

Fixes the join filter test, which previously did not include the last
408 samples in most cases.

CC:libav-stable@libav.org

Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 9bfc6e02ba)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Conflicts:
	libavfilter/fifo.c
	tests/fate/filter-audio.mak
2013-05-04 10:44:51 +02:00
Luca Barbato
5aac081110 id3v2: check for end of file while unescaping tags
Prevent an out of buffer bound write.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit af4cc2605c)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-05-03 19:22:07 +02:00
Anton Khirnov
d8745de6ae indeo3: fix off by one in MV validity check
CC:libav-stable@libav.org
(cherry picked from commit 95220be1fa)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-05-03 19:21:45 +02:00
Luca Barbato
46fd6e4f2e aac: check the maximum number of channels
Broken bitstreams could report a larger than specified number of
channels and cause outbound writes.

CC:libav-stable@libav.org
(cherry picked from commit a943a132f3)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-04-28 00:43:43 +02:00
Reinhard Tartler
6cad940989 update Changelog 2013-04-21 22:46:41 +02:00
Luca Barbato
c046890191 riff: check for eof if chunk size and code are 0
Prevent an infinite loop.

Inspired by a patch from Michael Niedermayer

CC: libav-stable@libav.org

Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 8e329dba37)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-21 22:46:41 +02:00
Luca Barbato
d70bad04de oggdec: fix faulty cleanup prototype
(cherry picked from commit fba8e5b608)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-21 18:51:25 +02:00
Michael Niedermayer
c8462bd17f mp3dec: fallback to generic seeking when a TOC is not present
Fixes seeking without a Xing/Info header.

CC: libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 505642f182)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-19 20:26:56 +02:00
Anton Khirnov
a3410b5a1f svq1dec: clip motion vectors to the frame size.
Fixes invalid reads for corrupted files.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit ecff5acb5a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:06:09 +02:00
Anton Khirnov
43039f9386 svq1dec: check that the reference frame has the same dimensions as the current one
They can be different if the last keyframe failed to decode correctly.
Fixes possible invalid reads in such a case.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit b1bb8fb860)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:05:55 +02:00
Anton Khirnov
d0c4d61c8b qdm2: check that the FFT size is a power of 2
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 34f87a5853)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:05:20 +02:00
Anton Khirnov
95db1624ef indeo3: switch parsing the header to bytestream2
Also add an additional sanity check to the alt_quant table.
Fixes invalid reads with corrupted files.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 66531d634e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:05:09 +02:00
Anton Khirnov
b0b33ce148 indeo3: check motion vectors.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit a0a872d073)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:04:53 +02:00
Anton Khirnov
fa4192e31f rv10: check that extradata is large enough
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org

(cherry picked from commit 01d376f598)

Conflicts:

	libavcodec/rv10.c
2013-04-18 22:03:32 +02:00
Anton Khirnov
4c412580fd indeo3: fix data size check
The data offsets are relative to the bistream header, which is 16 bytes
after the start of the data.
Fixes invalid reads with corrupted files.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 34e6af9e20)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:01:24 +02:00
Anton Khirnov
8f558c3e10 af_channelmap: sanity check input channel indices in all cases.
Fixes invalid reads from non-existing channels.

CC:libav-stable@libav.org
(cherry picked from commit aafed1175d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 21:59:28 +02:00
Anton Khirnov
5ebdfbe893 id3v2: pad the APIC packets as required by lavc.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
2013-04-08 22:25:27 +02:00
Anton Khirnov
094a35aeef lavf: make sure stream probe data gets freed.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit dbb1425811)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:48:10 +02:00
Anton Khirnov
62f9253781 dfa: check for invalid access in decode_wdlt().
This can happen when the number of skipped lines is not consistent with
the number of coded lines.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3623589edc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:47:56 +02:00
Anton Khirnov
858864d350 xmv: check audio track parameters validity.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d1016dccdc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:47:41 +02:00
Anton Khirnov
ba31b72f46 bmv: check for len being valid in bmv_decode_frame().
It can be 0 or -1 for invalid files, which may result in invalid memory
access.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b88f902125)

Conflicts:

	libavcodec/bmv.c
2013-04-06 11:47:01 +02:00
Anton Khirnov
7594868296 xmv: do not leak memory in the error paths in xmv_read_header()
CC: libav-stable@libav.org
(cherry picked from commit f8080bd13b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:40:20 +02:00
Luca Barbato
09e391abd8 matroska: pass the lace size to the matroska_parse_rm_audio
Each lace must be independent according to the specification.

Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.

Stricter check than fc43c19a56

CC: libav-stable@libav.org
(cherry picked from commit 25a80a931a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:40:05 +02:00
Dale Curtis
b90816d94b matroska: Update the available size after lace parsing
Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.

CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit fc43c19a56)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:39:39 +02:00
Luca Barbato
05015d03da matroska: fix a corner case in ebml-lace parsing
Make sure we notice when the lace_size[n] is a negative value.

CC: libav-stable@libav.org
(cherry picked from commit 8a96df7b70)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:39:28 +02:00
Anton Khirnov
34ecaf6e88 avfiltergraph: check for sws opts being non-NULL before using them.
Avoid snprintfing a NULL pointer.

CC: libav-stable@libav.org
(cherry picked from commit 6e3c13a559)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:39:11 +02:00
Diego Biurrun
8355383802 configure: Enable hwaccels without external dependencies by default.
(cherry picked from commit 2e2ec66741)

This is a fixup for f074618 to reenable auto-detection of dxva in the
build environment.

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-31 18:08:19 +02:00