ffmpeg.git
6 years agoMerge commit '54e03863691dcae73260f70108b3731b70773e7c' into release/0.10
Michael Niedermayer [Wed, 25 Sep 2013 21:03:08 +0000 (23:03 +0200)]
Merge commit '54e03863691dcae73260f70108b3731b70773e7c' into release/0.10

* commit '54e03863691dcae73260f70108b3731b70773e7c':
  vc1: check the source buffer in vc1_mc functions
  bink: Bound check the quantization matrix.
  xl: Make sure the width is valid
  alsdec: Fix the clipping range
  dsicinav: Bound-check the source buffer when needed
  mov: Do not allow updating the time scale after it has been set
  ac3dec: Don't consume more data than the actual input packet size
  indeo: Reject impossible FRAMETYPE_NULL

Conflicts:
libavcodec/alsdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit 'e2dcb8208e8f6cffef58a85127765047f5ef8868' into release/0.10
Michael Niedermayer [Wed, 25 Sep 2013 20:54:54 +0000 (22:54 +0200)]
Merge commit 'e2dcb8208e8f6cffef58a85127765047f5ef8868' into release/0.10

* commit 'e2dcb8208e8f6cffef58a85127765047f5ef8868':
  indeo5: return proper error codes
  indeo4: Validate scantable dimension

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit '06c52faef27e5bded4ceda7e6d1541f9fb20e84c' into release/0.10
Michael Niedermayer [Wed, 25 Sep 2013 20:30:06 +0000 (22:30 +0200)]
Merge commit '06c52faef27e5bded4ceda7e6d1541f9fb20e84c' into release/0.10

* commit '06c52faef27e5bded4ceda7e6d1541f9fb20e84c':
  indeo4: Check the quantization matrix index
  indeo4: Do not access missing reference MV

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agovc1: check the source buffer in vc1_mc functions
Luca Barbato [Mon, 5 Aug 2013 04:27:12 +0000 (06:27 +0200)]
vc1: check the source buffer in vc1_mc functions

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 090cd0631140ac1a3a795d2adfac5dbf5e381aa2)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/vc1dec.c

6 years agobink: Bound check the quantization matrix.
Luca Barbato [Sun, 4 Aug 2013 16:48:20 +0000 (18:48 +0200)]
bink: Bound check the quantization matrix.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9991298f2c4d9022ad56057f15d037e18d454157)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoxl: Make sure the width is valid
Luca Barbato [Sun, 28 Jul 2013 16:24:15 +0000 (18:24 +0200)]
xl: Make sure the width is valid

CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoalsdec: Fix the clipping range
Luca Barbato [Fri, 12 Jul 2013 21:02:25 +0000 (23:02 +0200)]
alsdec: Fix the clipping range

mcc_weightings is only 32 elements.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 70ecc175c7b513a153ac87d1c5d219556ca55070)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agodsicinav: Bound-check the source buffer when needed
Luca Barbato [Fri, 19 Jul 2013 19:09:40 +0000 (21:09 +0200)]
dsicinav: Bound-check the source buffer when needed

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit dd0bfc3a6a310e3e3674ce7742672d689a9a0e93)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agomov: Do not allow updating the time scale after it has been set
Martin Storsjö [Mon, 15 Jul 2013 14:13:54 +0000 (17:13 +0300)]
mov: Do not allow updating the time scale after it has been set

The time scale is set in mdhd, and later validated in the
enclosing trak atom once all of its children have been parsed.

A loose mdhd atom outside of a trak atom could update the time
scale of the last stream without any validation.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 31931520df35a6f9606fe8293c8a39e2d1fabedf)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoac3dec: Don't consume more data than the actual input packet size
Martin Storsjö [Mon, 15 Jul 2013 08:28:46 +0000 (11:28 +0300)]
ac3dec: Don't consume more data than the actual input packet size

This was handled properly in the normal return case at the end
of the function, but not in this special case.

Returning a value larger than the input packet size can cause
problems for certain library users.

Returning the actual input buffer size unconditionally, since
it is not guaranteed that frame_size is set to a sensible
value at this point.

Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8f24c12be7a3b3ea105e67bba9a867fe210a2333)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoindeo: Reject impossible FRAMETYPE_NULL
Luca Barbato [Sun, 14 Jul 2013 16:16:56 +0000 (18:16 +0200)]
indeo: Reject impossible FRAMETYPE_NULL

A frame marked FRAMETYPE_NULL cannot be scalable and requires a
previous frame successfully decoded.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5b2a29552ca09edd4646b6aa1828b32912b7ab36)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoindeo5: return proper error codes
Luca Barbato [Sun, 14 Jul 2013 12:41:56 +0000 (14:41 +0200)]
indeo5: return proper error codes

(cherry picked from commit b0eeb9d442e4b7e82f6797d74245434ea33110a5)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoindeo4: Validate scantable dimension
Luca Barbato [Fri, 12 Jul 2013 16:10:05 +0000 (18:10 +0200)]
indeo4: Validate scantable dimension

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cd78e934c246d1b2510f8fba0abfe40bb75795f6)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoindeo4: Check the quantization matrix index
Luca Barbato [Fri, 12 Jul 2013 13:02:33 +0000 (15:02 +0200)]
indeo4: Check the quantization matrix index

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6255ccf7d51c82ab79bf0cd47a921f572dda4489)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoindeo4: Do not access missing reference MV
Luca Barbato [Fri, 12 Jul 2013 12:32:03 +0000 (14:32 +0200)]
indeo4: Do not access missing reference MV

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8435bca087c0e79385763c51de009fd89390b6a5)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:

libavcodec/indeo4.c

6 years agoMerge remote-tracking branch 'qatar/release/0.8' into release/0.10
Michael Niedermayer [Sun, 22 Sep 2013 11:50:57 +0000 (13:50 +0200)]
Merge remote-tracking branch 'qatar/release/0.8' into release/0.10

* qatar/release/0.8:
  adpcm: Unbreak ima-dk4
  ac3dec: validate channel output mode against channel count
  dca: Respect the current limits in the downmixing capabilities

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit 'ce3ce08850f1690dff01d9bb4ed6a4274d52771e' into release/0.10
Michael Niedermayer [Sun, 22 Sep 2013 11:28:41 +0000 (13:28 +0200)]
Merge commit 'ce3ce08850f1690dff01d9bb4ed6a4274d52771e' into release/0.10

* commit 'ce3ce08850f1690dff01d9bb4ed6a4274d52771e':
  dca: Error out on missing DSYNC
  pcm: always use codec->id instead of codec_id
  mlpdec: Do not set invalid context in read_restart_header
  pcx: Do not overread source buffer in pcx_rle_decode
  wmavoice: conceal clearly corrupted blocks
  iff: Do not read over the source buffer
  qdm2: Conceal broken samples

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoadpcm: Unbreak ima-dk4
Luca Barbato [Sat, 21 Sep 2013 13:33:11 +0000 (15:33 +0200)]
adpcm: Unbreak ima-dk4

Was broken by commit b9dea1a085c4705e480bd17dfa8c8ce227fdce76

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit 'b64bd2e18bac1bd3e3e0ae4aebcad1c33f031c66' into release/0.10
Michael Niedermayer [Sun, 22 Sep 2013 11:18:18 +0000 (13:18 +0200)]
Merge commit 'b64bd2e18bac1bd3e3e0ae4aebcad1c33f031c66' into release/0.10

* commit 'b64bd2e18bac1bd3e3e0ae4aebcad1c33f031c66':
  qdm2: refactor joined stereo support
  adpcm: Write the correct number of samples for ima-dk4
  imc: Catch a division by zero
  atrac3: Error on impossible encoding/channel combinations

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoimc: Catch a division by zero
Luca Barbato [Tue, 9 Jul 2013 07:18:16 +0000 (09:18 +0200)]
imc: Catch a division by zero

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit bbf6a4aa20bfe3d7869b2218e66063602dfb8aa7)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/imc.c

6 years agoatrac3: Error on impossible encoding/channel combinations
Luca Barbato [Tue, 9 Jul 2013 02:44:26 +0000 (04:44 +0200)]
atrac3: Error on impossible encoding/channel combinations

Joint stereo encoded mono is impossible.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 50cf5a7fb78846fc39b3ecdaa896a10bcd74da2a)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/atrac3.c

6 years agoadpcm: Unbreak ima-dk4
Luca Barbato [Sat, 21 Sep 2013 13:33:11 +0000 (15:33 +0200)]
adpcm: Unbreak ima-dk4

Was broken by commit b9dea1a085c4705e480bd17dfa8c8ce227fdce76

6 years agoac3dec: validate channel output mode against channel count
Justin Ruggles [Wed, 20 Feb 2013 16:41:20 +0000 (11:41 -0500)]
ac3dec: validate channel output mode against channel count

Damaged frames can lead to a mismatch, which can cause a segfault
due to using an incorrect channel mapping.

CC:libav-stable@libav.org
(cherry picked from commit d7c450436fcb9d3ecf59884a574e7684183e753d)

Conflicts:

libavcodec/ac3dec.c

6 years agodca: Respect the current limits in the downmixing capabilities
Luca Barbato [Wed, 10 Jul 2013 17:00:15 +0000 (19:00 +0200)]
dca: Respect the current limits in the downmixing capabilities

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3802833bc1f79775a1547c5e427fed6e92b77e53)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agodca: Error out on missing DSYNC
Luca Barbato [Wed, 10 Jul 2013 16:07:45 +0000 (18:07 +0200)]
dca: Error out on missing DSYNC

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f261e508459e28beca59868a878e1519a44bb678)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agopcm: always use codec->id instead of codec_id
Luca Barbato [Wed, 10 Jul 2013 02:54:49 +0000 (04:54 +0200)]
pcm: always use codec->id instead of codec_id

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c82da343e635663605bd81c59d872bee3182da73)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/pcm.c

6 years agomlpdec: Do not set invalid context in read_restart_header
Luca Barbato [Wed, 10 Jul 2013 02:35:34 +0000 (04:35 +0200)]
mlpdec: Do not set invalid context in read_restart_header

The faulty values rippled further down the codepath causing a
hard-to-track segfault in the assembly code.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e9d394f3fad7e8fd8fc80e3b33cb045bbaceb446)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/mlpdec.c

6 years agopcx: Do not overread source buffer in pcx_rle_decode
Luca Barbato [Sat, 29 Jun 2013 04:37:32 +0000 (06:37 +0200)]
pcx: Do not overread source buffer in pcx_rle_decode

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3abde1a3b49cf299f2aae4eaae6b6cb5270bdc22)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agowmavoice: conceal clearly corrupted blocks
Luca Barbato [Sat, 29 Jun 2013 03:29:54 +0000 (05:29 +0200)]
wmavoice: conceal clearly corrupted blocks

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d14a26edb7c4487df581f11e5c6911dc0e623d08)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoiff: Do not read over the source buffer
Luca Barbato [Sat, 29 Jun 2013 05:26:48 +0000 (07:26 +0200)]
iff: Do not read over the source buffer

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7d65e960c72f36b73ae7fe84f8e427d758e61da9)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/iff.c

6 years agoqdm2: Conceal broken samples
Luca Barbato [Tue, 9 Jul 2013 12:59:33 +0000 (14:59 +0200)]
qdm2: Conceal broken samples

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 4ecdb5ed44591aba8a0ddb7d443cace836f761f6)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/qdm2.c

6 years agoqdm2: refactor joined stereo support
Luca Barbato [Tue, 9 Jul 2013 12:44:02 +0000 (14:44 +0200)]
qdm2: refactor joined stereo support

qdm2 does support only two channels. Loop over the run once.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit adadc3f2443d25b375e21e801516ccfd78e0b080)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoMerge commit 'e06623c48030530b50f00cee26f1a3a33c4b4d4b' into release/0.10
Michael Niedermayer [Sat, 14 Sep 2013 09:30:18 +0000 (11:30 +0200)]
Merge commit 'e06623c48030530b50f00cee26f1a3a33c4b4d4b' into release/0.10

* commit 'e06623c48030530b50f00cee26f1a3a33c4b4d4b':
  atrac3: set the getbits context the right buffer_end

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit '09a098fb8bc7d70a0258b3e8d658833c8d11debe' into release/0.10
Michael Niedermayer [Sat, 14 Sep 2013 09:05:54 +0000 (11:05 +0200)]
Merge commit '09a098fb8bc7d70a0258b3e8d658833c8d11debe' into release/0.10

* commit '09a098fb8bc7d70a0258b3e8d658833c8d11debe':
  atrac3: fix error handling
  qdm2: check and reset dithering index per channel

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit '26589aa81028f42c763c5581a1486a271799890b' into release/0.10
Michael Niedermayer [Sat, 14 Sep 2013 08:59:37 +0000 (10:59 +0200)]
Merge commit '26589aa81028f42c763c5581a1486a271799890b' into release/0.10

* commit '26589aa81028f42c763c5581a1486a271799890b':
  westwood_vqa: do not free extradata on error in read_header
  vqavideo: check the version
  rmdec: Use the AVIOContext given as parameter in rm_read_metadata()
  avio: Handle AVERROR_EOF in the same way as the return value 0

Conflicts:
libavcodec/vqavideo.c
libavformat/westwood_vqa.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit '139f352daf84e005824562e0e0f36e06ac60ee36' into release/0.10
Michael Niedermayer [Sat, 14 Sep 2013 08:26:56 +0000 (10:26 +0200)]
Merge commit '139f352daf84e005824562e0e0f36e06ac60ee36' into release/0.10

* commit '139f352daf84e005824562e0e0f36e06ac60ee36':
  wtv: Mark attachment with a negative stream id
  avidec: Let the inner dv demuxer take care of discarding

Conflicts:
libavformat/wtv.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoadpcm: Write the correct number of samples for ima-dk4
Luca Barbato [Sun, 7 Jul 2013 10:56:12 +0000 (12:56 +0200)]
adpcm: Write the correct number of samples for ima-dk4

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 12576afe206d35231ccd61f9033c5fdab6a11e80)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/adpcm.c

6 years agoimc: Catch a division by zero
Luca Barbato [Tue, 9 Jul 2013 07:18:16 +0000 (09:18 +0200)]
imc: Catch a division by zero

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit bbf6a4aa20bfe3d7869b2218e66063602dfb8aa7)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/imc.c

6 years agoatrac3: Error on impossible encoding/channel combinations
Luca Barbato [Tue, 9 Jul 2013 02:44:26 +0000 (04:44 +0200)]
atrac3: Error on impossible encoding/channel combinations

Joint stereo encoded mono is impossible.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 50cf5a7fb78846fc39b3ecdaa896a10bcd74da2a)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/atrac3.c

6 years agoatrac3: set the getbits context the right buffer_end
Luca Barbato [Tue, 9 Jul 2013 02:20:23 +0000 (04:20 +0200)]
atrac3: set the getbits context the right buffer_end

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 22e76ec635bafdd1d1ec35581a7ac09e69e3c43e)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/atrac3.c

6 years agoatrac3: fix error handling
Luca Barbato [Mon, 8 Jul 2013 23:03:13 +0000 (01:03 +0200)]
atrac3: fix error handling

decode_tonal_components returns a proper AVERROR.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 874c8a17ac9b04fb7ac23d003e54e3662dd23b4e)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/atrac3.c

6 years agoqdm2: check and reset dithering index per channel
Luca Barbato [Thu, 27 Jun 2013 00:50:52 +0000 (02:50 +0200)]
qdm2: check and reset dithering index per channel

Checking per subband would have the index exceed the
dithering noise table size.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 744a11c996641888d477a3981d609e79eeb69ea9)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/qdm2.c

6 years agowestwood_vqa: do not free extradata on error in read_header
Luca Barbato [Thu, 27 Jun 2013 02:30:20 +0000 (04:30 +0200)]
westwood_vqa: do not free extradata on error in read_header

The extradata is already freed by avformat_open_input on
failure.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 76f5dfbfd902178df4a38221a68dc8540189345a)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agovqavideo: check the version
Luca Barbato [Thu, 27 Jun 2013 01:19:05 +0000 (03:19 +0200)]
vqavideo: check the version

Prevent out of buffer write.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c4abc9098cacb227dba39bac6aea16b2bceba0d0)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agormdec: Use the AVIOContext given as parameter in rm_read_metadata()
Michael Niedermayer [Mon, 1 Jul 2013 21:38:08 +0000 (23:38 +0200)]
rmdec: Use the AVIOContext given as parameter in rm_read_metadata()

This fixes crashes when playing back certain RealRTSP streams.

When invoked from the RTP depacketizer, the full realmedia
demuxer isn't invoked, but only certain functions from it, where
a separate AVIOContext is passed in as parameter (for the buffer
containing the data to parse). The functions called from within
those entry points should only be using that parameter, not
s->pb. In the depacketizer case, s is the RTSP context, where ->pb
is null.

Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d35b6cd3775456a23b63e73316e244b671caa02f)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoavio: Handle AVERROR_EOF in the same way as the return value 0
Michael Niedermayer [Mon, 24 Jun 2013 12:23:44 +0000 (14:23 +0200)]
avio: Handle AVERROR_EOF in the same way as the return value 0

This makes sure the ffurl_read_complete function actually
returns the number of bytes read, as the documentation of the
function says, even if the underlying protocol uses AVERROR_EOF
instead of 0.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d876be87a115b93dd2e644049e3ada2cfb5ccb7)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agowtv: Mark attachment with a negative stream id
Luca Barbato [Mon, 24 Jun 2013 16:12:24 +0000 (18:12 +0200)]
wtv: Mark attachment with a negative stream id

A sid 0 would be mismatched to the attachment.

Prevent NULL pointer dereference.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f5e646a00ac21e500dae4bcceded790a0fbc5246)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agoavidec: Let the inner dv demuxer take care of discarding
Luca Barbato [Sat, 27 Jul 2013 13:48:41 +0000 (15:48 +0200)]
avidec: Let the inner dv demuxer take care of discarding

(cherry picked from commit c8f0b20b4a6bb6691928789d83e4b)

CC: libav-stable@libav.org
6 years agoAvoid a deadlock when decoding wma.
Carl Eugen Hoyos [Mon, 2 Sep 2013 06:32:24 +0000 (08:32 +0200)]
Avoid a deadlock when decoding wma.

Fixes ticket #2925.
(cherry picked from commit ec8a4841f7e81040f9a2757f23e70dff5e6b33a4)

6 years agoavformat/avidec: match first index and first packet size=0 handling
Michael Niedermayer [Sat, 31 Aug 2013 01:08:25 +0000 (03:08 +0200)]
avformat/avidec: match first index and first packet size=0 handling

Fixes Ticket2861

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 227a0eb5a92409572f2cecde6137529b83e7d495)

Conflicts:
libavformat/avidec.c

6 years agowmaprodec: tighter check for num_vec_coeffs n0.10.8
Michael Niedermayer [Sun, 22 Apr 2012 01:47:53 +0000 (03:47 +0200)]
wmaprodec: tighter check for num_vec_coeffs

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b21ba20cc83c80fe56192fee3626a8087f37d806)

Conflicts:

libavcodec/wmaprodec.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoffserver: fix order of evaluation bugs
Michael Niedermayer [Sat, 8 Sep 2012 21:56:26 +0000 (23:56 +0200)]
ffserver: fix order of evaluation bugs

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d40c0e4a6733ade9aaafc687bcaccc0cba1183b4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
6 years agodct-test: fix order of evaluation bug
Michael Niedermayer [Sat, 8 Sep 2012 21:57:37 +0000 (23:57 +0200)]
dct-test: fix order of evaluation bug

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dd081f98dded8e268a70468a43b25b077c8c3571)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoupdate for 0.10.8
Michael Niedermayer [Mon, 29 Jul 2013 02:41:57 +0000 (04:41 +0200)]
update for 0.10.8
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge remote-tracking branch 'qatar/release/0.8' into release/0.10
Michael Niedermayer [Mon, 29 Jul 2013 02:05:13 +0000 (04:05 +0200)]
Merge remote-tracking branch 'qatar/release/0.8' into release/0.10

* qatar/release/0.8:
  swfdec: do better validation of tag length
  Changelog for 0.8.8
  kmvc: Clip pixel position to valid range
  kmvc: use fixed sized arrays in the context
  indeo: use a typedef for the mc function pointer
  lavc: check for overflow in init_get_bits
  indeo: check for reference when inheriting mvs
  indeo: use proper error code
  indeo: Properly forward the error codes
  wmapro: error out on impossible scale factor offsets
  wmapro: check the min_samples_per_subframe
  wmapro: return early on unsupported condition
  wmapro: check num_vec_coeffs against the actual available buffer

Conflicts:
Changelog
libavformat/swfdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit '4ff5167ee7fdee6d35c1bb2558172329ae6ec770' into release/0.10
Michael Niedermayer [Mon, 29 Jul 2013 01:55:03 +0000 (03:55 +0200)]
Merge commit '4ff5167ee7fdee6d35c1bb2558172329ae6ec770' into release/0.10

* commit '4ff5167ee7fdee6d35c1bb2558172329ae6ec770':
  wmapro: make sure there is room to store the current packet
  lavc: move put_bits_left in put_bits.h
  4xm: do not overread the source buffer in decode_p_block
  4xm: check bitstream_size boundary before using it
  4xm: reject frames not compatible with the declared version
  4xm: use the correct logging context
  4xm: check the return value of read_huffman_tables().
  4xm: don't rely on get_buffer() initializing the frame.
  vmdav: convert to bytestream2
  smacker: check frame size validity
  smacker: pad the extradata allocation
  smacker: check the return value of smacker_decode_tree
  smacker: fix an off by one in huff.length computation
  Prepare for 0.8.8 Release
  tiff: do not overread the source buffer
  apetag: use int64_t for filesize
  wavpack: return meaningful errors

Conflicts:
RELEASE
libavcodec/4xm.c
libavcodec/vmdav.c
libavformat/smacker.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit '42fed7f433e6d2167ffd4aae31905b583a53b988' into release/0.10
Michael Niedermayer [Mon, 29 Jul 2013 00:54:53 +0000 (02:54 +0200)]
Merge commit '42fed7f433e6d2167ffd4aae31905b583a53b988' into release/0.10

* commit '42fed7f433e6d2167ffd4aae31905b583a53b988':
  wavpack: check packet size early
  mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
  mjpeg: Validate sampling factors
  ljpeg: use the correct number of components in yuv
  wavpack: validate samples size parsed in wavpack_decode_block
  jpegls: check the scan offset
  jpegls: factorize return paths
  jpegls: return meaningful errors
  mjpegdec: properly report unsupported disabled features
  update Changelog
  proresdec: support mixed interlaced/non-interlaced content
  update Changelog
  wav: Always seek to an even offset
  id3v2: check for end of file while unescaping tags
  indeo3: fix off by one in MV validity check
  aac: check the maximum number of channels
  update Changelog
  oggdec: fix faulty cleanup prototype

Conflicts:
Changelog
libavcodec/jpeglsdec.c
libavcodec/mjpegdec.c
libavformat/id3v2.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoMerge commit '43c0a87279e717c1384314c6da7155c306ee7c60' into release/0.10
Michael Niedermayer [Mon, 29 Jul 2013 00:29:23 +0000 (02:29 +0200)]
Merge commit '43c0a87279e717c1384314c6da7155c306ee7c60' into release/0.10

* commit '43c0a87279e717c1384314c6da7155c306ee7c60':
  qdm2: check that the FFT size is a power of 2
  indeo3: switch parsing the header to bytestream2
  indeo3: check motion vectors.
  rv10: check that extradata is large enough
  indeo3: fix data size check
  lavf: make sure stream probe data gets freed.
  dfa: check for invalid access in decode_wdlt().
  xmv: check audio track parameters validity.
  bmv: check for len being valid in bmv_decode_frame().
  xmv: do not leak memory in the error paths in xmv_read_header()
  avfiltergraph: check for sws opts being non-NULL before using them.
  oma: Validate sample rates
  Prepare for 0.8.7 Release

Conflicts:
RELEASE
libavcodec/indeo3.c
libavfilter/avfiltergraph.c
libavformat/utils.c
libavformat/xmv.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoupdate all trac links to use the trac subdomain
Michael Niedermayer [Sat, 29 Jun 2013 17:48:05 +0000 (19:48 +0200)]
update all trac links to use the trac subdomain

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
6 years agoswfdec: do better validation of tag length
Justin Ruggles [Mon, 10 Dec 2012 17:44:09 +0000 (12:44 -0500)]
swfdec: do better validation of tag length

Avoids trying to read a packet with 0 or negative size.
Avoids a potential infinite loop due to seeking backwards.

Partially based on a patch by Michael Niedermayer.

(cherry picked from commit e70c5b034c4787377e82cab2d5565486baec0c2a)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agompeg12dec: avoid reinitialization on PS changes when possible.
Michael Niedermayer [Mon, 8 Jul 2013 19:46:20 +0000 (21:46 +0200)]
mpeg12dec: avoid reinitialization on PS changes when possible.

Fixes Ticket2574

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 970c8df73528659925819dec31c4c8c0887f0321)

Conflicts:
libavcodec/mpeg12dec.c

6 years agoChangelog for 0.8.8
Reinhard Tartler [Sun, 30 Jun 2013 14:50:05 +0000 (16:50 +0200)]
Changelog for 0.8.8

6 years agokmvc: Clip pixel position to valid range
Luca Barbato [Mon, 1 Jul 2013 01:05:41 +0000 (03:05 +0200)]
kmvc: Clip pixel position to valid range

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 4e7f0b082d8c4b360312216b9241bec65ff63b35)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/kmvc.c

6 years agokmvc: use fixed sized arrays in the context
Luca Barbato [Mon, 1 Jul 2013 01:04:15 +0000 (03:04 +0200)]
kmvc: use fixed sized arrays in the context

Avoid some boilerplate code to dynamically allocate and then free the
buffers.
(cherry picked from commit 8f689770548c86151071ef976cf9b6998ba21c2a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/kmvc.c

6 years agoindeo: use a typedef for the mc function pointer
Luca Barbato [Wed, 3 Jul 2013 09:18:30 +0000 (11:18 +0200)]
indeo: use a typedef for the mc function pointer

(cherry picked from commit e6d8acf6a8fba4743eb56eabe72a741d1bbee3cb)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agolavc: check for overflow in init_get_bits
Luca Barbato [Sun, 13 Jan 2013 18:52:45 +0000 (19:52 +0100)]
lavc: check for overflow in init_get_bits

Fix an undefined behaviour and make the function return a proper
error in case of overflow.

CC: libav-stable@libav.org
(cherry picked from commit d9cf5f516974c64e01846ca685301014b38cf224)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 7a2ee770f520ae4fd5f009cfc361a18e993dec91)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years agoavformat/mov: Fix duration of fragmented mov
Michael Niedermayer [Sun, 7 Jul 2013 00:42:40 +0000 (02:42 +0200)]
avformat/mov: Fix duration of fragmented mov

Fixes Ticket2757

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dc2a13aa802fc691c25d5e0194818831058316ee)

Conflicts:
libavformat/mov.c

6 years agompegts: only reopen pmt_cb filter if its different from the previous.
Michael Niedermayer [Fri, 5 Jul 2013 01:27:07 +0000 (03:27 +0200)]
mpegts: only reopen pmt_cb filter if its different from the previous.

Fixes Ticket2632

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b009267910df10c004b5f340a090d45da29089a0)

6 years agormdec: Pass AVIOContext to rm_read_metadata()
Michael Niedermayer [Mon, 1 Jul 2013 21:38:08 +0000 (23:38 +0200)]
rmdec: Pass AVIOContext to rm_read_metadata()

Fix null pointer dereference
Fixes Ticket2588

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bf87908cd8da31e8f8fe75c06577170928ea70a8)

Conflicts:
libavformat/rmdec.c

6 years agoindeo: check for reference when inheriting mvs
Luca Barbato [Sun, 30 Jun 2013 08:40:37 +0000 (10:40 +0200)]
indeo: check for reference when inheriting mvs

The same is done already for qdelta.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b36e1893ef3430f039c1eaddeedcbb378f9c4444)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years agoindeo: use proper error code
Luca Barbato [Sun, 30 Jun 2013 08:11:05 +0000 (10:11 +0200)]
indeo: use proper error code

(cherry picked from commit dd3754a48854cd570d38db72394491aab0f36570)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/ivi_common.c

6 years agoindeo: Properly forward the error codes
Luca Barbato [Sun, 30 Jun 2013 07:57:56 +0000 (09:57 +0200)]
indeo: Properly forward the error codes

If the tile data size does not match the buffer size it did not
return an AVERROR_INVALIDDATA causing futher corruption later.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7388c0c58601477db076e2e74e8b11f8a644384a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/ivi_common.c

6 years agowmapro: error out on impossible scale factor offsets
Luca Barbato [Sat, 29 Jun 2013 00:16:50 +0000 (02:16 +0200)]
wmapro: error out on impossible scale factor offsets

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 02ec656af72030eea4f3d63e30b25625cce6a3df)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years agowmapro: check the min_samples_per_subframe
Luca Barbato [Fri, 28 Jun 2013 23:56:09 +0000 (01:56 +0200)]
wmapro: check the min_samples_per_subframe

Must be at least WMAPRO_BLOCK_MIN_SIZE.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d4a217a408da4bd63acc02cd8f9ebe378a2ad65a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/wmaprodec.c

6 years agowmapro: make sure there is room to store the current packet
Luca Barbato [Fri, 28 Jun 2013 02:03:47 +0000 (04:03 +0200)]
wmapro: make sure there is room to store the current packet

Prevent horrid and hard to trace struct overwrite.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e30b068ef79f604ff439418da07f7e2efd01d4ea)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years agowmapro: return early on unsupported condition
Luca Barbato [Fri, 28 Jun 2013 03:21:33 +0000 (05:21 +0200)]
wmapro: return early on unsupported condition

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6652338f43ef623045912d7f28b61adea05d27ae)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/wmaprodec.c

6 years agolavc: move put_bits_left in put_bits.h
Reinhard Tartler [Sat, 6 Jul 2013 07:46:07 +0000 (09:46 +0200)]
lavc: move put_bits_left in put_bits.h

(cherry picked from commit afe03092dd693d025d43e1620283d8d285c92772)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/dv.c

6 years agowmapro: check num_vec_coeffs against the actual available buffer
Luca Barbato [Fri, 28 Jun 2013 03:23:21 +0000 (05:23 +0200)]
wmapro: check num_vec_coeffs against the actual available buffer

Prevent yet another buffer overwrite.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 38229362529ed1619d8ebcc81ecde85b23b45895)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years ago4xm: do not overread the source buffer in decode_p_block
Luca Barbato [Sun, 9 Jun 2013 16:27:05 +0000 (18:27 +0200)]
4xm: do not overread the source buffer in decode_p_block

Check for out of picture macroblocks before calling mcdc.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 94aefb1932be882fd93f66cf790ceb19ff575c19)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/4xm.c

6 years ago4xm: check bitstream_size boundary before using it
Luca Barbato [Mon, 10 Jun 2013 14:37:43 +0000 (16:37 +0200)]
4xm: check bitstream_size boundary before using it

Prevent buffer overread.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 59d7bb99b6a963b7e11c637228b2203adf535eee)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/4xm.c

6 years ago4xm: reject frames not compatible with the declared version
Luca Barbato [Thu, 6 Jun 2013 14:58:57 +0000 (16:58 +0200)]
4xm: reject frames not compatible with the declared version

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 145023f57262d21474e35b4a6069cf95136339d4)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/4xm.c

6 years ago4xm: use the correct logging context
Luca Barbato [Wed, 5 Jun 2013 15:12:16 +0000 (17:12 +0200)]
4xm: use the correct logging context

(cherry picked from commit 08859d19b429c522d6494c186656f4a2d3ff8e21)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/4xm.c

6 years ago4xm: check the return value of read_huffman_tables().
Anton Khirnov [Wed, 13 Feb 2013 19:46:08 +0000 (20:46 +0100)]
4xm: check the return value of read_huffman_tables().

CC:libav-stable@libav.org
(cherry picked from commit 8097fc9a2dd49d8e467b16c8bafaa96242b7fe46)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit bb3f1cad171b31537b64a9d19cabdbff50aca260)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/4xm.c

6 years ago4xm: don't rely on get_buffer() initializing the frame.
Anton Khirnov [Tue, 13 Nov 2012 21:10:54 +0000 (22:10 +0100)]
4xm: don't rely on get_buffer() initializing the frame.

(cherry picked from commit b047c68783aa4042b322af7af043b643d5daf09c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years agovmdav: convert to bytestream2
Alexandra Khirnova [Wed, 13 Mar 2013 12:54:27 +0000 (13:54 +0100)]
vmdav: convert to bytestream2

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 0afcf97e1ece51d29bb791698b00cd1b7ba97dcf)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/vmdav.c

6 years agosmacker: check frame size validity
Kostya Shishkov [Wed, 12 Jun 2013 12:30:51 +0000 (14:30 +0200)]
smacker: check frame size validity

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 07423ad7836325e03894f2f87ba46a531a1cc0b3)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agosmacker: pad the extradata allocation
Kostya Shishkov [Wed, 12 Jun 2013 12:28:07 +0000 (14:28 +0200)]
smacker: pad the extradata allocation

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 4c22baf65363433f8c20efd1022b4ba2d8cf2288)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agosmacker: check the return value of smacker_decode_tree
Kostya Shishkov [Wed, 12 Jun 2013 12:27:00 +0000 (14:27 +0200)]
smacker: check the return value of smacker_decode_tree

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit a2f9937bb04b23a341b0ec0eb1d923bbeb420277)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agosmacker: fix an off by one in huff.length computation
Kostya Shishkov [Wed, 12 Jun 2013 12:22:24 +0000 (14:22 +0200)]
smacker: fix an off by one in huff.length computation

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit ee205588b250fe5cae0681be8eba51a5403c3272)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
6 years agomathops/x86: work around inline asm miscompilation with GCC 4.8.1
Hendrik Leppkes [Sat, 15 Jun 2013 20:46:01 +0000 (22:46 +0200)]
mathops/x86: work around inline asm miscompilation with GCC 4.8.1

The volatile is not required here, and prevents a miscompilation with GCC
4.8.1 when building on x86 with --cpu=i686

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 659df32a9d8984081ccd54adc3aee7daeb33388d)

6 years agoPrepare for 0.8.8 Release
Anton Khirnov [Wed, 29 May 2013 14:18:40 +0000 (16:18 +0200)]
Prepare for 0.8.8 Release

6 years agowavpack: check packet size early
Luca Barbato [Wed, 22 May 2013 10:51:42 +0000 (12:51 +0200)]
wavpack: check packet size early

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit fd06291239c1bb616bf303b5696cc432710b2530)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years agotiff: do not overread the source buffer
Luca Barbato [Mon, 3 Jun 2013 02:53:02 +0000 (04:53 +0200)]
tiff: do not overread the source buffer

At least 2 bytes from the source are read every loop.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9c2216976907336dfae0e8e38a4d70ca2465a92c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/tiff.c

6 years agoapetag: use int64_t for filesize
Anton Khirnov [Wed, 29 May 2013 14:18:40 +0000 (16:18 +0200)]
apetag: use int64_t for filesize

CC: libav-stable@libav.org
(cherry picked from commit e816aaacd68201b67182f9c70dc680e89a0123e9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years agowavpack: return meaningful errors
Luca Barbato [Fri, 17 May 2013 16:28:33 +0000 (18:28 +0200)]
wavpack: return meaningful errors

And forward those that were already meaningful.
(cherry picked from commit 8c34558131d846d2b10389564caadaa206372fd4)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/wavpack.c

6 years agomjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
Luca Barbato [Wed, 15 May 2013 16:41:41 +0000 (18:41 +0200)]
mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac

Prevent out of buffer write when decoding broken samples.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cfbd98abe82cfcb9984a18d08697251b72b110c8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years agomjpeg: Validate sampling factors
Luca Barbato [Mon, 13 May 2013 17:32:04 +0000 (19:32 +0200)]
mjpeg: Validate sampling factors

They must be non-zero.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8aa3500905fec6c4e657bb291b861d43c34d3de9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/mjpegdec.c

6 years agoljpeg: use the correct number of components in yuv
Luca Barbato [Tue, 14 May 2013 14:20:14 +0000 (16:20 +0200)]
ljpeg: use the correct number of components in yuv

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit a030279a67ef883df8cf3707774656fa1be81078)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
6 years agowavpack: validate samples size parsed in wavpack_decode_block
Luca Barbato [Fri, 17 May 2013 16:29:15 +0000 (18:29 +0200)]
wavpack: validate samples size parsed in wavpack_decode_block

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit ed50673066956d6f2201a57c3254569f2ab08d9d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/wavpack.c

6 years agojpegls: check the scan offset
Luca Barbato [Fri, 17 May 2013 11:08:55 +0000 (13:08 +0200)]
jpegls: check the scan offset

Prevent an out of array bound write.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit abad374909e6416e941351094f4f1446a71f8d23)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/jpeglsdec.c