Luca Barbato
f21dce6044
indeo: Refactor ff_ivi_dec_huff_desc
...
Spare an indentation level.
(cherry picked from commit f6f36ca8ca
2013-09-29 21:03:27 +02:00
Martin Storsjö
5473d23ece
mpegvideo: Avoid 32-bit wrapping of linesize multiplications
...
This makes sure that linesize * start_y doesn't overflow, so that
emulated_edge_mc can get back the original value if needed.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a711a2cb47
2013-09-23 19:53:02 -04:00
Michael Niedermayer
7a9af1da39
mjpegb: Detect changing number of planes in interlaced video
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit af11fa5409
2013-09-23 19:52:45 -04:00
Anton Khirnov
5773065a71
pictordec: break out of both decoding loops when y drops below 0
...
Otherwise picmemset can get called with negative y, resulting in an
invalid write.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5f7aecde02
2013-09-23 19:46:49 -04:00
Luca Barbato
c225c620c6
ac3: Return proper error codes
...
(cherry picked from commit b1f9cdc37f
2013-09-23 19:45:33 -04:00
Luca Barbato
37e69e2dee
ac3: Clean up the error paths
...
(cherry picked from commit 818d1f1a3e
2013-09-23 19:45:22 -04:00
Luca Barbato
3dff283de1
ac3: Do not clash with normal AVERROR
...
The parsing function return AVERROR and AAC_AC3_PARSE_ERROR values,
make sure they are not misunderstood.
(cherry picked from commit 6258d362b8
2013-09-23 19:45:05 -04:00
Luca Barbato
86c169c5b6
dxa: Make sure the reference frame exists
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5ef7c84a93
2013-09-23 19:43:07 -04:00
Luca Barbato
91355bec88
h261: check the mtype index
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c59967fa7c
2013-09-23 19:42:57 -04:00
Luca Barbato
75b1b13aff
vc1: check mb_height validity.
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 43bacd5b7d
2013-09-23 19:41:09 -04:00
Luca Barbato
54e0386369
vc1: check the source buffer in vc1_mc functions
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 090cd06311
2013-09-23 19:41:09 -04:00
Luca Barbato
9c779b5dd0
bink: Bound check the quantization matrix.
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9991298f2c
2013-09-23 19:41:08 -04:00
Luca Barbato
8006716f21
xl: Make sure the width is valid
...
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-23 19:25:50 -04:00
Luca Barbato
246e0e2c99
alsdec: Fix the clipping range
...
mcc_weightings is only 32 elements.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 70ecc175c7
2013-09-23 19:22:22 -04:00
Luca Barbato
0d24adbe8d
dsicinav: Bound-check the source buffer when needed
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit dd0bfc3a6a
2013-09-23 19:18:39 -04:00
Martin Storsjö
729143e2d2
ac3dec: Don't consume more data than the actual input packet size
...
This was handled properly in the normal return case at the end
of the function, but not in this special case.
Returning a value larger than the input packet size can cause
problems for certain library users.
Returning the actual input buffer size unconditionally, since
it is not guaranteed that frame_size is set to a sensible
value at this point.
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8f24c12be7
2013-09-23 19:14:14 -04:00
Luca Barbato
36921fcdd3
indeo: Reject impossible FRAMETYPE_NULL
...
A frame marked FRAMETYPE_NULL cannot be scalable and requires a
previous frame successfully decoded.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5b2a29552c
2013-09-23 19:11:37 -04:00
Luca Barbato
e2dcb8208e
indeo5: return proper error codes
...
(cherry picked from commit b0eeb9d442
2013-09-23 19:09:10 -04:00
Luca Barbato
609345cd5e
indeo4: Validate scantable dimension
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cd78e934c2
2013-09-23 18:54:13 -04:00
Luca Barbato
06c52faef2
indeo4: Check the quantization matrix index
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6255ccf7d5
2013-09-23 18:53:01 -04:00
Luca Barbato
ba5dfc25ee
indeo4: Do not access missing reference MV
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8435bca087
2013-09-23 18:52:16 -04:00
Luca Barbato
68b1008719
adpcm: Unbreak ima-dk4
...
Was broken by commit b9dea1a085
2013-09-21 15:33:11 +02:00
Justin Ruggles
763519536b
ac3dec: validate channel output mode against channel count
...
Damaged frames can lead to a mismatch, which can cause a segfault
due to using an incorrect channel mapping.
CC:libav-stable@libav.org
(cherry picked from commit d7c450436f
2013-09-21 15:21:54 +02:00
Luca Barbato
521cbcb7d3
dca: Respect the current limits in the downmixing capabilities
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3802833bc1
2013-09-21 15:19:06 +02:00
Luca Barbato
ce3ce08850
dca: Error out on missing DSYNC
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f261e50845
2013-09-21 15:17:28 +02:00
Luca Barbato
62c3547539
pcm: always use codec->id instead of codec_id
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c82da343e6
2013-09-21 15:15:34 +02:00
Luca Barbato
47baf9ca87
mlpdec: Do not set invalid context in read_restart_header
...
The faulty values rippled further down the codepath causing a
hard-to-track segfault in the assembly code.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e9d394f3fa
2013-09-21 15:14:29 +02:00
Luca Barbato
9c3c08ba98
pcx: Do not overread source buffer in pcx_rle_decode
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3abde1a3b4
2013-09-21 15:11:27 +02:00
Luca Barbato
9c05debdcd
wmavoice: conceal clearly corrupted blocks
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d14a26edb7
2013-09-21 15:11:18 +02:00
Luca Barbato
195b9f290c
iff: Do not read over the source buffer
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7d65e960c7
2013-09-21 15:11:07 +02:00
Luca Barbato
57efb6d94c
qdm2: Conceal broken samples
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 4ecdb5ed44
2013-09-21 15:08:50 +02:00
Luca Barbato
b64bd2e18b
qdm2: refactor joined stereo support
...
qdm2 does support only two channels. Loop over the run once.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit adadc3f244
2013-09-21 15:02:49 +02:00
Luca Barbato
b9dea1a085
adpcm: Write the correct number of samples for ima-dk4
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 12576afe20
2013-09-13 15:50:41 +02:00
Luca Barbato
90acd3bfe7
imc: Catch a division by zero
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit bbf6a4aa20
2013-09-13 15:49:23 +02:00
Luca Barbato
40ee4de6a6
atrac3: Error on impossible encoding/channel combinations
...
Joint stereo encoded mono is impossible.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 50cf5a7fb7
2013-09-13 15:47:43 +02:00
Luca Barbato
e06623c480
atrac3: set the getbits context the right buffer_end
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 22e76ec635
2013-09-13 15:44:49 +02:00
Luca Barbato
09a098fb8b
atrac3: fix error handling
...
decode_tonal_components returns a proper AVERROR.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 874c8a17ac
2013-09-13 15:42:08 +02:00
Luca Barbato
7296ee7af1
qdm2: check and reset dithering index per channel
...
Checking per subband would have the index exceed the
dithering noise table size.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 744a11c996
2013-09-13 15:39:06 +02:00
Luca Barbato
c6942a4b03
vqavideo: check the version
...
Prevent out of buffer write.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c4abc9098c
2013-09-13 15:26:52 +02:00
Luca Barbato
79edb9adf6
kmvc: Clip pixel position to valid range
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 4e7f0b082d
2013-07-07 21:11:35 +02:00
Luca Barbato
e22a5d490d
kmvc: use fixed sized arrays in the context
...
Avoid some boilerplate code to dynamically allocate and then free the
buffers.
(cherry picked from commit 8f68977054
2013-07-07 21:11:35 +02:00
Luca Barbato
c9d8424395
indeo: use a typedef for the mc function pointer
...
(cherry picked from commit e6d8acf6a8
2013-07-07 21:11:34 +02:00
Luca Barbato
e6a365b5d2
lavc: check for overflow in init_get_bits
...
Fix an undefined behaviour and make the function return a proper
error in case of overflow.
CC: libav-stable@libav.org
(cherry picked from commit d9cf5f51697a2ee770f5
2013-07-07 21:11:34 +02:00
Luca Barbato
0a1d02ca77
indeo: check for reference when inheriting mvs
...
The same is done already for qdelta.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b36e1893ef
2013-07-06 10:10:18 +02:00
Luca Barbato
7eff48029f
indeo: use proper error code
...
(cherry picked from commit dd3754a488
2013-07-06 10:10:17 +02:00
Luca Barbato
7658333c17
indeo: Properly forward the error codes
...
If the tile data size does not match the buffer size it did not
return an AVERROR_INVALIDDATA causing futher corruption later.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7388c0c586
2013-07-06 10:10:17 +02:00
Luca Barbato
f16aa5843f
wmapro: error out on impossible scale factor offsets
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 02ec656af7
2013-07-06 10:10:17 +02:00
Luca Barbato
bd5ff335ec
wmapro: check the min_samples_per_subframe
...
Must be at least WMAPRO_BLOCK_MIN_SIZE.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d4a217a408
2013-07-06 10:10:17 +02:00
Luca Barbato
46e09894ac
wmapro: return early on unsupported condition
...
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6652338f43
2013-07-06 10:06:11 +02:00
Luca Barbato
4e1999ebcb
wmapro: check num_vec_coeffs against the actual available buffer
...
Prevent yet another buffer overwrite.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3822936252
2013-07-06 10:06:11 +02:00
