Merge commit '43c0a87279e717c1384314c6da7155c306ee7c60' into release/0.10
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 29 Jul 2013 00:29:23 +0000 (02:29 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 29 Jul 2013 00:35:24 +0000 (02:35 +0200)
* commit '43c0a87279e717c1384314c6da7155c306ee7c60':
  qdm2: check that the FFT size is a power of 2
  indeo3: switch parsing the header to bytestream2
  indeo3: check motion vectors.
  rv10: check that extradata is large enough
  indeo3: fix data size check
  lavf: make sure stream probe data gets freed.
  dfa: check for invalid access in decode_wdlt().
  xmv: check audio track parameters validity.
  bmv: check for len being valid in bmv_decode_frame().
  xmv: do not leak memory in the error paths in xmv_read_header()
  avfiltergraph: check for sws opts being non-NULL before using them.
  oma: Validate sample rates
  Prepare for 0.8.7 Release

Conflicts:
RELEASE
libavcodec/indeo3.c
libavfilter/avfiltergraph.c
libavformat/utils.c
libavformat/xmv.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/bmv.c
libavcodec/dfa.c
libavcodec/indeo3.c
libavcodec/qdm2.c
libavcodec/rv10.c
libavfilter/avfiltergraph.c
libavfilter/graphparser.c
libavformat/oma.c
libavformat/omadec.c
libavformat/utils.c
libavformat/xmv.c

Simple merge
Simple merge
@@@ -230,11 -230,18 +230,21 @@@ static int copy_cell(Indeo3DecodeContex
      /* setup output and reference pointers */
      offset_dst  = (cell->ypos << 2) * plane->pitch + (cell->xpos << 2);
      dst         = plane->pixels[ctx->buf_sel] + offset_dst;
 +    if(cell->mv_ptr){
      mv_y        = cell->mv_ptr[0];
      mv_x        = cell->mv_ptr[1];
 +    }else
 +        mv_x= mv_y= 0;
+     /* -1 because there is an extra line on top for prediction */
+     if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 ||
+         ((cell->ypos + cell->height) << 2) + mv_y >= plane->height    ||
+         ((cell->xpos + cell->width)  << 2) + mv_x >= plane->width) {
+         av_log(ctx->avctx, AV_LOG_ERROR,
+                "Motion vectors point out of the frame.\n");
+         return AVERROR_INVALIDDATA;
+     }
      offset      = offset_dst + mv_y * plane->pitch + mv_x;
      src         = plane->pixels[ctx->buf_sel ^ 1] + offset;
  
Simple merge
Simple merge
@@@ -23,7 -23,7 +23,8 @@@
  #include <ctype.h>
  #include <string.h>
  
 +#include "libavutil/audioconvert.h"
+ #include "libavutil/avstring.h"
  #include "avfilter.h"
  #include "avfiltergraph.h"
  #include "internal.h"
@@@ -202,30 -156,36 +203,35 @@@ static int query_formats(AVFilterGraph 
  
          for (j = 0; j < filter->input_count; j++) {
              AVFilterLink *link = filter->inputs[j];
 -            if (link && link->in_formats != link->out_formats) {
 -                if (!avfilter_merge_formats(link->in_formats,
 -                                            link->out_formats)) {
 -                    AVFilterContext *scale;
 -                    char scale_args[256];
 -                    /* couldn't merge format lists. auto-insert scale filter */
 -                    snprintf(inst_name, sizeof(inst_name), "auto-inserted scaler %d",
 -                             scaler_count++);
 -                    av_strlcpy(scale_args, "0:0", sizeof(scale_args));
 -                    if (graph->scale_sws_opts) {
 -                        av_strlcat(scale_args, ":", sizeof(scale_args));
 -                        av_strlcat(scale_args, graph->scale_sws_opts, sizeof(scale_args));
 -                    }
 -                    if ((ret = avfilter_graph_create_filter(&scale, avfilter_get_by_name("scale"),
 -                                                            inst_name, scale_args, NULL, graph)) < 0)
 -                        return ret;
 -                    if ((ret = avfilter_insert_filter(link, scale, 0, 0)) < 0)
 -                        return ret;
 -
 -                    scale->filter->query_formats(scale);
 -                    if (((link = scale-> inputs[0]) &&
 -                         !avfilter_merge_formats(link->in_formats, link->out_formats)) ||
 -                        ((link = scale->outputs[0]) &&
 -                         !avfilter_merge_formats(link->in_formats, link->out_formats))) {
 -                        av_log(log_ctx, AV_LOG_ERROR,
 -                               "Impossible to convert between the formats supported by the filter "
 -                               "'%s' and the filter '%s'\n", link->src->name, link->dst->name);
 -                        return AVERROR(EINVAL);
 -                    }
++
 +            if (!link) continue;
 +
 +            if (!link->in_formats || !link->out_formats)
 +                return AVERROR(EINVAL);
 +
 +            if (link->type == AVMEDIA_TYPE_VIDEO &&
 +                !avfilter_merge_formats(link->in_formats, link->out_formats)) {
 +
 +                /* couldn't merge format lists, auto-insert scale filter */
-                 snprintf(filt_args, sizeof(filt_args), "0:0:%s",
-                          graph->scale_sws_opts);
++                av_strlcpy(filt_args, "0:0", sizeof(filt_args));
++                if (graph->scale_sws_opts) {
++                    av_strlcat(filt_args, ":", sizeof(filt_args));
++                    av_strlcat(filt_args, graph->scale_sws_opts, sizeof(filt_args));
+                 }
++
 +                if (ret = insert_conv_filter(graph, link, "scale", filt_args))
 +                    return ret;
 +            }
 +            else if (link->type == AVMEDIA_TYPE_AUDIO) {
 +                if (!link->in_chlayouts || !link->out_chlayouts ||
 +                    !link->in_packing   || !link->out_packing)
 +                    return AVERROR(EINVAL);
 +
 +                if (!avfilter_merge_formats(link->in_formats,   link->out_formats)   ||
 +                    !avfilter_merge_formats(link->in_chlayouts, link->out_chlayouts) ||
 +                    !avfilter_merge_formats(link->in_packing,   link->out_packing))
 +                    if (ret = insert_conv_filter(graph, link, "aconvert", NULL))
 +                       return ret;
              }
          }
      }
Simple merge
Simple merge
Simple merge
@@@ -2855,13 -2712,14 +2855,14 @@@ void avformat_free_context(AVFormatCont
              av_free_packet(&st->cur_pkt);
          }
          av_dict_free(&st->metadata);
 -        av_free(st->index_entries);
 -        av_free(st->codec->extradata);
 -        av_free(st->codec->subtitle_header);
 -        av_free(st->codec);
 -        av_free(st->priv_data);
 -        av_free(st->info);
 -        av_free(st);
+         av_freep(&st->probe_data.buf);
 +        av_freep(&st->index_entries);
 +        av_freep(&st->codec->extradata);
 +        av_freep(&st->codec->subtitle_header);
 +        av_freep(&st->codec);
 +        av_freep(&st->priv_data);
 +        av_freep(&st->info);
 +        av_freep(&st);
      }
      for(i=s->nb_programs-1; i>=0; i--) {
          av_dict_free(&s->programs[i]->metadata);
@@@ -123,6 -126,16 +123,15 @@@ static int xmv_probe(AVProbeData *p
      return 0;
  }
  
 -    av_free(xmv->audio_tracks);
+ static int xmv_read_close(AVFormatContext *s)
+ {
+     XMVDemuxContext *xmv = s->priv_data;
+     av_free(xmv->audio);
+     return 0;
+ }
  static int xmv_read_header(AVFormatContext *s,
                             AVFormatParameters *ap)
  {
  
      avio_skip(pb, 2); /* Unknown (padding?) */
  
 -    xmv->audio_tracks = av_malloc(xmv->audio_track_count * sizeof(XMVAudioTrack));
 -    if (!xmv->audio_tracks)
 -        return AVERROR(ENOMEM);
 -
      xmv->audio = av_malloc(xmv->audio_track_count * sizeof(XMVAudioPacket));
-     if (!xmv->audio)
-         return AVERROR(ENOMEM);
+     if (!xmv->audio) {
+         ret = AVERROR(ENOMEM);
+         goto fail;
+     }
  
      for (audio_track = 0; audio_track < xmv->audio_track_count; audio_track++) {
 -        XMVAudioTrack  *track  = &xmv->audio_tracks[audio_track];
 -        XMVAudioPacket *packet = &xmv->audio       [audio_track];
 +        XMVAudioPacket *packet = &xmv->audio[audio_track];
          AVStream *ast = NULL;
  
 -        track->compression     = avio_rl16(pb);
 -        track->channels        = avio_rl16(pb);
 -        track->sample_rate     = avio_rl32(pb);
 -        track->bits_per_sample = avio_rl16(pb);
 -        track->flags           = avio_rl16(pb);
 -
 -        track->bit_rate      = track->bits_per_sample *
 -                               track->sample_rate *
 -                               track->channels;
 -        track->block_align   = 36 * track->channels;
 -        track->block_samples = 64;
 -        track->codec_id      = ff_wav_codec_get_id(track->compression,
 -                                                   track->bits_per_sample);
 -
 -        packet->track        = track;
 +        packet->compression     = avio_rl16(pb);
 +        packet->channels        = avio_rl16(pb);
 +        packet->sample_rate     = avio_rl32(pb);
 +        packet->bits_per_sample = avio_rl16(pb);
 +        packet->flags           = avio_rl16(pb);
 +
 +        packet->bit_rate      = packet->bits_per_sample *
 +                                packet->sample_rate *
 +                                packet->channels;
 +        packet->block_align   = 36 * packet->channels;
 +        packet->block_samples = 64;
 +        packet->codec_id      = ff_wav_codec_get_id(packet->compression,
 +                                                    packet->bits_per_sample);
 +
          packet->stream_index = -1;
  
          packet->frame_size  = 0;
  
          /* TODO: ADPCM'd 5.1 sound is encoded in three separate streams.
           *       Those need to be interleaved to a proper 5.1 stream. */
 -        if (track->flags & XMV_AUDIO_ADPCM51)
 +        if (packet->flags & XMV_AUDIO_ADPCM51)
              av_log(s, AV_LOG_WARNING, "Unsupported 5.1 ADPCM audio stream "
 -                                      "(0x%04X)\n", track->flags);
 +                                      "(0x%04X)\n", packet->flags);
  
 -        if (!track->channels || !track->sample_rate) {
++        if (!packet->channels || !packet->sample_rate) {
+             av_log(s, AV_LOG_ERROR, "Invalid parameters for audio track %d.\n",
+                    audio_track);
+             ret = AVERROR_INVALIDDATA;
+             goto fail;
+         }
          ast = avformat_new_stream(s, NULL);
-         if (!ast)
-             return AVERROR(ENOMEM);
+         if (!ast) {
+             ret = AVERROR(ENOMEM);
+             goto fail;
+         }
  
          ast->codec->codec_type            = AVMEDIA_TYPE_AUDIO;
 -        ast->codec->codec_id              = track->codec_id;
 -        ast->codec->codec_tag             = track->compression;
 -        ast->codec->channels              = track->channels;
 -        ast->codec->sample_rate           = track->sample_rate;
 -        ast->codec->bits_per_coded_sample = track->bits_per_sample;
 -        ast->codec->bit_rate              = track->bit_rate;
 -        ast->codec->block_align           = 36 * track->channels;
 +        ast->codec->codec_id              = packet->codec_id;
 +        ast->codec->codec_tag             = packet->compression;
 +        ast->codec->channels              = packet->channels;
 +        ast->codec->sample_rate           = packet->sample_rate;
 +        ast->codec->bits_per_coded_sample = packet->bits_per_sample;
 +        ast->codec->bit_rate              = packet->bit_rate;
 +        ast->codec->block_align           = 36 * packet->channels;
  
 -        avpriv_set_pts_info(ast, 32, track->block_samples, track->sample_rate);
 +        avpriv_set_pts_info(ast, 32, packet->block_samples, packet->sample_rate);
  
          packet->stream_index = ast->index;