ffmpeg.git
4 years agonutdec: fix memleaks on error in nut_read_header
Andreas Cadhalpun [Tue, 28 Apr 2015 18:58:21 +0000 (20:58 +0200)]
nutdec: fix memleaks on error in nut_read_header

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361702660d2c37a63b7d6381d39e1e1de8405260)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agortsp: Make sure we don't write too many transport entries into a fixed-size array
Martin Storsjö [Fri, 24 Apr 2015 09:38:09 +0000 (12:38 +0300)]
rtsp: Make sure we don't write too many transport entries into a fixed-size array

(cherry picked from commit b90adb0aba073f9c1b4abca852119947393ced4c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agortpenc_jpeg: handle case of picture dimensions not dividing by 8
Andrey Utkin [Fri, 10 Apr 2015 21:54:10 +0000 (00:54 +0300)]
rtpenc_jpeg: handle case of picture dimensions not dividing by 8

This fixes the calculation of the number of needed blocks to make
sure that ALL pixels are represented by the result.

Reviewed-by: Thomas Volkert <silvo@gmx.net>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7f64a7503b19b39f1251e4380987034c569bebf5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mp3dec: Check for avcodec_alloc_context3() failure
Michael Niedermayer [Thu, 26 Feb 2015 19:11:19 +0000 (20:11 +0100)]
avformat/mp3dec: Check for avcodec_alloc_context3() failure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b851bc20c6931c084710e69f7eec30d8c1bdb68e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mp3dec: properly allocate dummy AVCodecContext
Michael Niedermayer [Thu, 26 Feb 2015 18:59:44 +0000 (19:59 +0100)]
avformat/mp3dec: properly allocate dummy AVCodecContext

Fixes (harmless) use of uninitialized variable

Found-by: jamrial
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6ad42b3e15478284321dd285acaf189a16590854)

Conflicts:

libavformat/mp3dec.c

4 years agolavd/xcbgrab: fix comparison with screen size.
Nicolas George [Wed, 6 May 2015 09:53:19 +0000 (11:53 +0200)]
lavd/xcbgrab: fix comparison with screen size.

Signed-off-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7971fa9ce0ead8d2e8a79dbe422e91dcef8222ba)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/golomb: get_ur_golomb_jpegls: Fix reading huge k values
Michael Niedermayer [Sun, 17 May 2015 17:07:17 +0000 (19:07 +0200)]
avcodec/golomb: get_ur_golomb_jpegls: Fix reading huge k values

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c720b9ce9850710e74a103d9626869e397a89faa)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mov: Fix parsing short loci
Michael Niedermayer [Sat, 16 May 2015 11:51:18 +0000 (13:51 +0200)]
avformat/mov: Fix parsing short loci

Fixes Ticket4557

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 50393bce31a5618f5125aaaf97bb69886fc4261d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mov: Print reason of loci parsing failure
Michael Niedermayer [Sat, 16 May 2015 11:50:38 +0000 (13:50 +0200)]
avformat/mov: Print reason of loci parsing failure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9e4f0cfc8ff4ab635ea12bdbd8d85d8bb1ba25f9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc: Fix typo in num_entry_point_offsets check
Michael Niedermayer [Fri, 15 May 2015 20:12:08 +0000 (22:12 +0200)]
avcodec/hevc: Fix typo in num_entry_point_offsets check

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3051e7fa712dfe2136f19b7157211453895f2a3c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/libtheoraenc: Check for av_malloc failure
Michael Niedermayer [Fri, 15 May 2015 20:02:12 +0000 (22:02 +0200)]
avcodec/libtheoraenc: Check for av_malloc failure

Fixes CID1257799

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c64b2d480b4a35d4face9928b4265a0fda3f3dd9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check active_bands
Michael Niedermayer [Fri, 15 May 2015 16:29:40 +0000 (18:29 +0200)]
avcodec/dcadec: Check active_bands

Fixes CID1297594 part2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc624ec9ba7e5c4e8d905ac10f605a43d123f95a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check scale table index
Michael Niedermayer [Fri, 15 May 2015 16:04:12 +0000 (18:04 +0200)]
avcodec/dcadec: Check scale table index

Fixes CID1297594 part 1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0f3e6959bfa67d12cd5a173b86eb15abd7d9e4d5)

Conflicts:

libavcodec/dcadec.c

4 years agoavcodec/sonic: More completely check sample_rate_index and channels
Michael Niedermayer [Fri, 15 May 2015 15:31:58 +0000 (17:31 +0200)]
avcodec/sonic: More completely check sample_rate_index and channels

Fixes CID1271783

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ade8a46154cb45c88b1cb5c616eaa6320c941187)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/sonic: check memory allocations
Michael Niedermayer [Fri, 15 May 2015 15:26:25 +0000 (17:26 +0200)]
avcodec/sonic: check memory allocations

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c131a9fead5bf63215b6e1172b3c5c183cf90b85)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/smvjpegdec: check avcodec_decode_video2() return code
Michael Niedermayer [Fri, 15 May 2015 15:21:10 +0000 (17:21 +0200)]
avcodec/smvjpegdec: check avcodec_decode_video2() return code

Fixes CID1271810

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cdd25f9a3df3905543a5546cf6076d2eaf895736)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/shorten: More complete pred_order check
Michael Niedermayer [Fri, 15 May 2015 15:02:28 +0000 (17:02 +0200)]
avcodec/shorten: More complete pred_order check

Fixes CID1239055

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 294469416d8193a28710d802bb0c46e5fa09fad7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/shorten: Check skip_bytes()
Michael Niedermayer [Fri, 15 May 2015 14:48:31 +0000 (16:48 +0200)]
avcodec/shorten: Check skip_bytes()

Fixes CID1210526

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d201becfc0d89c6a5dfe44e96f1044fbc2aadb70)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/shorten: Fix code depending on signed overflow behavior
Michael Niedermayer [Fri, 15 May 2015 14:58:51 +0000 (16:58 +0200)]
avcodec/shorten: Fix code depending on signed overflow behavior

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2d15588124ab1d4c0612cab66f02a716f1509211)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/proresdec2: Reset slice_count on deallocation
Michael Niedermayer [Fri, 15 May 2015 13:23:32 +0000 (15:23 +0200)]
avcodec/proresdec2: Reset slice_count on deallocation

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c4c6aea397f62421bf8ef0449b2b465a53e4ab4d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoffmpeg_opt: Fix -timestamp parsing
Michael Niedermayer [Sat, 9 May 2015 11:07:00 +0000 (13:07 +0200)]
ffmpeg_opt: Fix -timestamp parsing

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 107e4da47644fe615ea821d6a19682d73789aca7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check subsubframes
Michael Niedermayer [Thu, 14 May 2015 19:29:19 +0000 (21:29 +0200)]
avcodec/dcadec: Check subsubframes

Fixes: CID1239152

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a9bf628bfdad142763880a3d1ccb6058040dda57)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check nchans
Michael Niedermayer [Thu, 14 May 2015 18:49:25 +0000 (20:49 +0200)]
avcodec/dcadec: Check nchans

Fixes CID1239110

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a6a45774d045007f8262cd7c614804390e53122e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agohevc: make avcodec_decode_video2() fail if get_format() fails
wm4 [Thu, 14 May 2015 16:27:31 +0000 (18:27 +0200)]
hevc: make avcodec_decode_video2() fail if get_format() fails

Personally, I need the decoder to back out if get_format() returns no
usable pixel format. This didn't work because the error code was not
propagated down the call chain. This in turn happened because the
variable declaration removed in this patch shadowed the variable, whose
value is returned at the end of the function. Consequently, failures of
decode_nal_unit() were ignored in this place.

Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc5e4bb48476a89cc8ce0c41bc2bd2e8fda9b37c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/cavsdec: Use ff_set_dimensions()
Michael Niedermayer [Thu, 14 May 2015 16:08:33 +0000 (18:08 +0200)]
avcodec/cavsdec: Use ff_set_dimensions()

Fixes CID1239111 part2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f6b8b966076fcd358f734c6d00ed642edc02b4cd)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/cavsdec: Check esc_code
Michael Niedermayer [Thu, 14 May 2015 15:54:40 +0000 (17:54 +0200)]
avcodec/cavsdec: Check esc_code

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 139e1c8009df7729a53eaaae7036ca01071aced5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/on2avc: Check run more carefully
Michael Niedermayer [Wed, 13 May 2015 23:01:35 +0000 (01:01 +0200)]
avcodec/on2avc: Check run more carefully

Fixes CID1239106

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 22f15f5735389e992ec9aed43b0680e75746b3a1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/mpeg4audio: add some padding/alignment to MAX_PCE_SIZE
Michael Niedermayer [Wed, 13 May 2015 22:09:56 +0000 (00:09 +0200)]
avcodec/mpeg4audio: add some padding/alignment to MAX_PCE_SIZE

This avoids potential accesses over the end

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 93cfa7d1692c25cff045f99ba1af2c9e5772c45e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoswr: fix alignment issue caused by 8ch sse functions
Rainer Hochecker [Wed, 13 May 2015 16:31:27 +0000 (18:31 +0200)]
swr: fix alignment issue caused by 8ch sse functions

Fix crash when doing 8 ch conversion from apps compiled with MSVS
Thanks to Ronald for giving this hint:
https://ffmpeg.org/pipermail/ffmpeg-devel/2015-May/173049.html

Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit adb7372f7495927a226edf9b8e1d0ac9453985ea)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/mjpegdec: fix len computation in ff_mjpeg_decode_dqt()
Michael Niedermayer [Wed, 13 May 2015 16:36:19 +0000 (18:36 +0200)]
avcodec/mjpegdec: fix len computation in ff_mjpeg_decode_dqt()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81cf9108563510dee24f73b2c5d94a7bd07ff747)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/jpeg2000dec: fix boolean operator
Michael Niedermayer [Wed, 13 May 2015 13:15:55 +0000 (15:15 +0200)]
avcodec/jpeg2000dec: fix boolean operator

Fixes CID1271791 #7-6

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f8f155a18ac454e7ff3312e0e0c3a70eb4359143)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc_ps: Explicitly check num_tile_* for negative values
Michael Niedermayer [Wed, 13 May 2015 11:53:33 +0000 (13:53 +0200)]
avcodec/hevc_ps: Explicitly check num_tile_* for negative values

This fixes nothing but maybe helps coverity which does not see that this is failing later

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 65e5032955cb5022f0f39160aa3839f0799456bd)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc_ps: Check vps_num_hrd_parameters
Michael Niedermayer [Wed, 13 May 2015 11:35:57 +0000 (13:35 +0200)]
avcodec/hevc_ps: Check vps_num_hrd_parameters

Fix CID1239052 part2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b195aa5d529040f43ab3acf0079cecbeb111bd57)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc_ps: More completely check vps_num_layer_sets
Michael Niedermayer [Wed, 13 May 2015 11:35:37 +0000 (13:35 +0200)]
avcodec/hevc_ps: More completely check vps_num_layer_sets

Fixes CID1239052  part1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 16c95b107365cdbfcde1945370b59fc7e17e0309)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc: Check num_entry_point_offsets
Michael Niedermayer [Wed, 13 May 2015 11:21:52 +0000 (13:21 +0200)]
avcodec/hevc: Check num_entry_point_offsets

Fixes CID1239099 part 2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1c6ae98d4a9ff9ea607df87908393eda4ebdf4e8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc: Check offset_len
Michael Niedermayer [Wed, 13 May 2015 11:13:07 +0000 (13:13 +0200)]
avcodec/hevc: Check offset_len

Fixes CID1239099 part 1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e9d5e16ad9799f6b6faae4f21120d23146b84c9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolibswscale/x86/hscale_fast_bilinear_simd.c: Include BX in the clobber list on x86_64...
Nick Lewycky [Wed, 13 May 2015 01:07:57 +0000 (18:07 -0700)]
libswscale/x86/hscale_fast_bilinear_simd.c: Include BX in the clobber list on x86_64, because it isn't implicitly included when PIC is on.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 48e9f68384a2af257b9ca7633bf14f0c2748edc6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc_sei: Check num_sps_ids_minus1 value
Michael Niedermayer [Tue, 12 May 2015 23:31:15 +0000 (01:31 +0200)]
avcodec/hevc_sei: Check num_sps_ids_minus1 value

Fixes CID1271794

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 93b0ee21a2f534f6d3b812686f3acde110e94f18)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/vqavideo: Check chunk size
Michael Niedermayer [Tue, 12 May 2015 22:41:38 +0000 (00:41 +0200)]
avcodec/vqavideo: Check chunk size

Fixes CID1239154

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8a62b80ce6c8e87e7937f9a5d68f83882c1c8da2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoaacdec: don't return frames without data
Andreas Cadhalpun [Tue, 12 May 2015 18:27:21 +0000 (20:27 +0200)]
aacdec: don't return frames without data

Since commit 676a395a aac->frame->data is not necessarily allocated at
the end of aac_decode_frame_int if avctx->channels is 0.

In this case a bogus frame without any data, but non-zero nb_samples is
returned.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ec38a1ba404b8cb8d71ccee2b8dcd6f3fcbde273)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/hevc: Check num_negative_pics and num_positive_pics
Michael Niedermayer [Tue, 12 May 2015 17:28:15 +0000 (19:28 +0200)]
avformat/hevc: Check num_negative_pics and num_positive_pics

Fixes CID1238994

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b62b3292d8e25d3240e462c1b1cd8ac69195c46b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/hevc: Check cpb_cnt_minus1
Michael Niedermayer [Tue, 12 May 2015 17:09:06 +0000 (19:09 +0200)]
avformat/hevc: Check cpb_cnt_minus1

Fixes CID1239014

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2cddc0b19a20dd061dbf199bf88005b37c540d2f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/matroskadec: Cleanup error handling for bz2 & zlib
Michael Niedermayer [Tue, 12 May 2015 16:32:12 +0000 (18:32 +0200)]
avformat/matroskadec: Cleanup error handling for bz2 & zlib

Fixes CID703652

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 171af59d58fc67d82dce8ff7ed11fa671108baa5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/nutdec: Fix use of uinitialized value
Michael Niedermayer [Tue, 12 May 2015 16:20:23 +0000 (18:20 +0200)]
avformat/nutdec: Fix use of uinitialized value

Fixes CID1041175

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56abf35151c635caa3eb04bbb90454bae5463a09)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/rtpenc_jpeg: Check remaining buffer size for SOS
Michael Niedermayer [Tue, 12 May 2015 15:55:40 +0000 (17:55 +0200)]
avformat/rtpenc_jpeg: Check remaining buffer size for SOS

Fixes CID1238818

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81198a68370e88f7d02f16de58db36713c2a50b6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Michael Niedermayer [Tue, 12 May 2015 16:03:55 +0000 (18:03 +0200)]
avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()

Larger packets are not supported and would cause problems later

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e160551fb1c290d1397da2f04325817)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agotools/graph2dot: use larger data types than int for array/string sizes
Michael Niedermayer [Tue, 12 May 2015 01:59:30 +0000 (03:59 +0200)]
tools/graph2dot: use larger data types than int for array/string sizes

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit acf4925f444636a828534ab47d0f86c21a7a9b4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoid3v2: catch avio_read errors in check_tag
Andreas Cadhalpun [Mon, 11 May 2015 18:07:49 +0000 (20:07 +0200)]
id3v2: catch avio_read errors in check_tag

Since len is an unsigned int, the comparison is currently treated as
unsigned and thus ignores all errors from avio_read.

Thus cast len to int, which is unproblematic, because at that point len
is between 0 and 4.

This fixes 'Conditional jump or move depends on uninitialised value'
valgrind warnings in is_tag.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0382c94f13b4b20456b7259e90b170dc020419b8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()
Michael Niedermayer [Mon, 11 May 2015 13:37:38 +0000 (15:37 +0200)]
avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()

Its currently guaranteed to be smaller but its safer to check anyway

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f26b3e8ec075298e7ba329a55893d085bafe96)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/oggenc: Check ff_vorbiscomment_length in ogg_write_vorbiscomment()
Michael Niedermayer [Mon, 11 May 2015 13:34:28 +0000 (15:34 +0200)]
avformat/oggenc: Check ff_vorbiscomment_length in ogg_write_vorbiscomment()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0db5b2b9f8a96298eeba7988d43c4eb44220fab3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/flacenc: Check length in flac_write_block_comment()
Michael Niedermayer [Mon, 11 May 2015 13:30:32 +0000 (15:30 +0200)]
avformat/flacenc: Check length in flac_write_block_comment()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a7700b82aec0036622f8673ce64e070a520891)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/subtitles: Use size_t for len
Michael Niedermayer [Sun, 10 May 2015 13:38:40 +0000 (15:38 +0200)]
avformat/subtitles: Use size_t for len

string length could theoretically be larger than int

Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a633928d47057426a9c328da594407d1c7da8a5c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/url: Use size_t for len from strlen()
Michael Niedermayer [Mon, 11 May 2015 01:50:01 +0000 (03:50 +0200)]
avformat/url: Use size_t for len from strlen()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95efc651294b3cf3e5ec4b3ed36e79d7261545ff)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavutil/avstring: Use size_t in av_strlcatf()
Michael Niedermayer [Mon, 11 May 2015 18:01:15 +0000 (20:01 +0200)]
avutil/avstring: Use size_t in av_strlcatf()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ae4eea8be45a0b212fd57ceaac1f11089ab81d98)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()
Michael Niedermayer [Mon, 11 May 2015 13:23:51 +0000 (15:23 +0200)]
avformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eca38864a6ce5053e463b8d3fc22b22bc9a49578)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavutil/dict: Use size_t for appending strings
Michael Niedermayer [Sun, 10 May 2015 14:09:07 +0000 (16:09 +0200)]
avutil/dict: Use size_t for appending strings

the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c128ea1629116fc4936edc5f96bbd18f3ef1647)

Conflicts:

libavutil/dict.c

4 years agolibavutil/mem: use size_t for the length in av_strdup()
Michael Niedermayer [Sun, 10 May 2015 14:06:50 +0000 (16:06 +0200)]
libavutil/mem: use size_t for the length in av_strdup()

the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4950bd4ebedbb6289734234bb2a719820f565c41)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoaacsbr: break infinite loop in sbr_hf_calc_npatches
Andreas Cadhalpun [Wed, 22 Apr 2015 13:23:24 +0000 (15:23 +0200)]
aacsbr: break infinite loop in sbr_hf_calc_npatches

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 584cc1ade10a3297ef9c107ef3a2081c04024156)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agodiracdec: check that block length is valid
Andreas Cadhalpun [Wed, 6 May 2015 13:34:53 +0000 (15:34 +0200)]
diracdec: check that block length is valid

In init_planes p->xblen and p->yblen are set to:
            p->xblen = s->plane[0].xblen >> s->chroma_x_shift;
            p->yblen = s->plane[0].yblen >> s->chroma_y_shift;

These are later used as block_w and block_h arguments of
s->vdsp.emulated_edge_mc. If one of them is 0 it triggers an av_assert2
in emulated_edge_mc:
    av_assert2(start_x < end_x && block_w > 0);
    av_assert2(start_y < end_y && block_h > 0);

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 75fc81c8318505aa7946e05a9bee08d47241fc66)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agodiracdec: check if reference could not be allocated
Andreas Cadhalpun [Tue, 5 May 2015 21:51:48 +0000 (23:51 +0200)]
diracdec: check if reference could not be allocated

s->ref_pics[i] is later used as ref argument of interpolate_refplane,
where it is dereferenced.

If it is NULL, it causes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d93181ef3eacdb862d93448f31c97765a523d1db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agodiracdec: avoid overflow of bytes*8 in decode_lowdelay
Andreas Cadhalpun [Tue, 5 May 2015 20:10:44 +0000 (22:10 +0200)]
diracdec: avoid overflow of bytes*8 in decode_lowdelay

If bytes is large enough, bytes*8 can overflow and become negative.

In that case 'bufsize -= bytes*8' causes bufsize to increase instead of
decrease.

This leads to a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9e66b39aa87eb653a6e5d15f70b792ccbf719de7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agodiracdec: prevent overflow in data_unit_size check
Andreas Cadhalpun [Tue, 5 May 2015 19:33:08 +0000 (21:33 +0200)]
diracdec: prevent overflow in data_unit_size check

buf_idx + data_unit_size can overflow, causing the '> buf_size' check to
wrongly fail.

This causes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 984f50deb2d48f6844d65e10991b996a6d29e87c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavidec: avoid infinite loop due to negative ast->sample_size
Andreas Cadhalpun [Mon, 4 May 2015 21:01:45 +0000 (23:01 +0200)]
avidec: avoid infinite loop due to negative ast->sample_size

If max in clean_index is set to a negative ast->sample_size, the
following loop never ends:
        while (max < 1024)
            max += max;

Thus set ast->sample_size to 0 if it would otherwise be negative.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ca234639ac49a0dc073ac1f10977979acdb94f97)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/matroskadec: Use tracks[k]->stream instead of s->streams[k]
Michael Niedermayer [Mon, 4 May 2015 13:47:54 +0000 (15:47 +0200)]
avformat/matroskadec: Use tracks[k]->stream instead of s->streams[k]

The later is not correct

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5d309d309108684f742bbf5fc2393f1c519cda72)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agomatroskadec: check s->streams[k] before using it
Andreas Cadhalpun [Sun, 3 May 2015 21:55:20 +0000 (23:55 +0200)]
matroskadec: check s->streams[k] before using it

This fixes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e54540655f229d06667dc7fa7005f2a20e101e80)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/ffv1dec: Check chroma shift parameters
Michael Niedermayer [Mon, 4 May 2015 11:37:26 +0000 (13:37 +0200)]
avcodec/ffv1dec: Check chroma shift parameters

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d43cd6b08ed555c303478e3133717fbb2236be6e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agomatroskadec: use uint64_t instead of int for index_scale
Andreas Cadhalpun [Sun, 3 May 2015 21:07:20 +0000 (23:07 +0200)]
matroskadec: use uint64_t instead of int for index_scale

index_scale is set to matroska->time_scale of type uint64_t.

When index_scale is int, the assignment can overflow and e.g. result
in index_scale = 0. This causes a floating point exception due to the
division by index_scale.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eb9fb508b0e09d85d234fe694333b2005e1d7a7e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agopngdec: don't use AV_PIX_FMT_MONOBLACK for apng
Andreas Cadhalpun [Sun, 3 May 2015 18:36:20 +0000 (20:36 +0200)]
pngdec: don't use AV_PIX_FMT_MONOBLACK for apng

AV_PIX_FMT_MONOBLACK has the AV_PIX_FMT_FLAG_BITSTREAM flag, i.e.
linesize can be smaller than width.

Since x_offset is only check against the width, this can lead to
x_offset * bpp >= image_linesize.

In this case ptr could be set to a position outside the image_buf in
png_handle_row, leading to memory corruption and thus crashes.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 372aa0777aaacf726de7cd7dd0e6797026a124ee)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agopngdec: return correct error code from decode_frame_common
Andreas Cadhalpun [Sun, 3 May 2015 15:50:26 +0000 (17:50 +0200)]
pngdec: return correct error code from decode_frame_common

During the loop ret can get changed. Since it is not set on all failure
paths, decode_frame_common can return 0 even though an error occurred.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8f760be4d312bb6e78f80d39b9d0062253332e08)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agopngdec: check s->last_picture.f->data[0] before using it
Andreas Cadhalpun [Sun, 3 May 2015 14:21:39 +0000 (16:21 +0200)]
pngdec: check s->last_picture.f->data[0] before using it

This check was removed in commit 08aec6f6, but
s->last_picture.f->data[0] is still used in handle_p_frame_apng
unconditionally.

This fixes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 287dbb0771d558b336e377d0594e26c0a6291755)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and...
Michael Niedermayer [Sun, 3 May 2015 13:54:21 +0000 (15:54 +0200)]
avcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and undefined behavior in fate

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 042260cde4ecf716438c5fc92d15ad5f037ee2e1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoxcbgrab: Validate the capture area
Luca Barbato [Sat, 14 Mar 2015 11:30:11 +0000 (12:30 +0100)]
xcbgrab: Validate the capture area

And notify why the capture is impossible.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit e8c4db0d4d07738fed716b1d2f20c85aac944641)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoxcbgrab: Do not assume the non shm image data is always available
Luca Barbato [Sat, 14 Mar 2015 11:30:10 +0000 (12:30 +0100)]
xcbgrab: Do not assume the non shm image data is always available

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 82a10225f817b2612fdd2b23af9d4f0a3408df3b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavfilter/lavfutils: disable frame threads when decoding a single image
Michael Niedermayer [Thu, 30 Apr 2015 01:03:31 +0000 (03:03 +0200)]
avfilter/lavfutils: disable frame threads when decoding a single image

The image decoding code does expect the image to be decoded immedeatly

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d2184bf3b65354e44c177e226a6c59c5d6fdbad4)

Conflicts:

libavfilter/lavfutils.c

4 years agonutdec: fix illegal count check in decode_main_header
Andreas Cadhalpun [Tue, 28 Apr 2015 20:37:19 +0000 (22:37 +0200)]
nutdec: fix illegal count check in decode_main_header

The existing check has two problems:
 1) i + count can overflow, so that the check '< 256' returns true.
 2) In the (i == 'N') case occurs a j-- so that the loop runs once more.

This can trigger the assertion 'nut->header_len[0] == 0' or cause
segmentation faults or infinite hangs.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7c24ca1bda2d4df1dc9b2b982941be532d60da21)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agonutdec: check chapter creation in decode_info_header
Andreas Cadhalpun [Tue, 28 Apr 2015 18:57:59 +0000 (20:57 +0200)]
nutdec: check chapter creation in decode_info_header

This fixes a segmentation fault when accessing the metadata.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3ff1af2b0db7132d5717be6395227a94c8abab07)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agonutdec: check for negative frame rate in decode_info_header
Andreas Cadhalpun [Tue, 28 Apr 2015 18:31:56 +0000 (20:31 +0200)]
nutdec: check for negative frame rate in decode_info_header

A negative frame rate triggers an av_assert2 in av_rescale_rnd.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6621105877ce0d65724a8ab60b3a50160adbe65d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoffmpeg: remove incorrect network deinit
Michael Niedermayer [Thu, 23 Apr 2015 12:29:47 +0000 (14:29 +0200)]
ffmpeg: remove incorrect network deinit

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e2877bdf3862325c2982c3237d9bf28f1bbf793f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoapedec: prevent out of array writes in decode_array_0000
Andreas Cadhalpun [Tue, 28 Apr 2015 09:13:43 +0000 (11:13 +0200)]
apedec: prevent out of array writes in decode_array_0000

s->decoded_buffer is allocated with a min_size of:
    2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer)

Then it is assigned to s->decoded[0] (and s->decoded_buffer + FFALIGN(blockstodecode, 8)
to s->decoded[1]) and passed as out buffer to decode_array_0000.

In this function 64 elements of the out buffer are written
unconditionally and outside the array if blockstodecode is too small.

This causes memory corruption, leading to segmentation faults or other
crashes.

Thus change decode_array_0000 to write at most blockstodecode elements
of the out buffer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 699341d647f7af785fb8ceed67604467b0b9ab12)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoOpenCL: Avoid potential buffer overflow in cmdutils_opencl.c
Maneesh Gupta [Tue, 28 Apr 2015 07:38:31 +0000 (13:08 +0530)]
OpenCL: Avoid potential buffer overflow in cmdutils_opencl.c

The opt_opencl_bench function copied the device name using strcpy without checking if the source string was larger.
This patch fixes this by replacing the strcpy with av_strlcpy, with the string copy size capped to the destination buffer size.

Signed-off-by: Maneesh Gupta <maneesh.gupta@amd.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cf234552b83a9503ff96572de2658b921b8842eb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoapedec: set s->samples only when init_frame_decoder succeeded
Andreas Cadhalpun [Mon, 27 Apr 2015 22:30:51 +0000 (00:30 +0200)]
apedec: set s->samples only when init_frame_decoder succeeded

Otherwise range_start_decoding is not necessarily run and thus
ctx->rc.range still 0 in range_dec_normalize leading to an infinite
loop.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 464c49155ce7ffc88ed39eb2511e7a75565c24be)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoswscale/ppc/swscale_altivec.c: POWER LE support in yuv2planeX_8() delete macro GET_VF...
Rong Yan [Mon, 27 Apr 2015 03:19:45 +0000 (03:19 +0000)]
swscale/ppc/swscale_altivec.c: POWER LE support in yuv2planeX_8() delete macro GET_VF() it was wrong

GCC tool had a bug of PPC intrinsic interpret, which has been fixed in GCC 4.9.1. This bug lead to
errors in two of our previous patches. We found this when we update our GCC tools to 4.9.1 and by
reading the related info on GCC website. We fix our previous error in two separate commits

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 603c839398f89d3ef15c47530470fbb0051632c0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolibvpxenc: only set noise reduction w/vp8
James Zern [Tue, 21 Apr 2015 07:03:00 +0000 (00:03 -0700)]
libvpxenc: only set noise reduction w/vp8

this quiets a warning:
Failed to set VP8E_SET_NOISE_SENSITIVITY codec control: Unspecified
internal error

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: James Zern <jzern@google.com>
(cherry picked from commit 238ec505e263e7d0363798a05c1c28f494a6300a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agotests/fate-run: do not attempt to parse tiny_psnrs output if it failed
Michael Niedermayer [Thu, 23 Apr 2015 02:27:56 +0000 (04:27 +0200)]
tests/fate-run: do not attempt to parse tiny_psnrs output if it failed

This avoids confusing syntax errors with awk later

Likely fixes awk errors at:
http://buildd.debian-ports.org/status/fetch.php?pkg=ffmpeg&arch=sparc64&ver=7%3A2.6.2-1&stamp=1428928967

Reviewed-by: Timothy Gu <timothygu99@gmail.com>
Thanks-to: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> for the link
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c0d847e457c1ef72843a63853f1135d52b74131e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoalac: reject rice_limit 0 if compression is used
Andreas Cadhalpun [Thu, 23 Apr 2015 22:01:43 +0000 (00:01 +0200)]
alac: reject rice_limit 0 if compression is used

If rice_limit is 0, k can be 0 in decode_scalar, which calls show_bits(gb, k).

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4b657a1b1eedcf38bcf36e89a2f4be6f76b5ce09)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoalsdec: only adapt order for positive max_order
Andreas Cadhalpun [Wed, 22 Apr 2015 14:03:41 +0000 (16:03 +0200)]
alsdec: only adapt order for positive max_order

For max_order = 0 the clipping range is invalid. (amin = 2, amax = 1)

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 58d605ee9b3277289278dc40e022311f8e083833)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolavf: Reset global flag on deinit
Vittorio Giovara [Wed, 22 Apr 2015 13:59:56 +0000 (14:59 +0100)]
lavf: Reset global flag on deinit

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32da94fa7f73ac749e0a1e2f20499fad2f6f57fe)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agobink: check vst->index_entries before using it
Andreas Cadhalpun [Wed, 22 Apr 2015 15:08:51 +0000 (17:08 +0200)]
bink: check vst->index_entries before using it

This fixes a NULL pointer dereference if vst->duration is 0.

The problem was introduced in commit 0588acaf.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 86d00ede4f9acb02690a0615490173648e1d933c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agompeg4videodec: only allow a positive length
Andreas Cadhalpun [Wed, 22 Apr 2015 14:32:42 +0000 (16:32 +0200)]
mpeg4videodec: only allow a positive length

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b3408ae4c64cb674b1d5f0f30171759113ce722a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoalsdec: check sample pointer range in revert_channel_correlation
Andreas Cadhalpun [Tue, 21 Apr 2015 17:25:50 +0000 (19:25 +0200)]
alsdec: check sample pointer range in revert_channel_correlation

Also change the type of begin, end and smp to ptrdiff_t to make the
comparison well-defined.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit afc7748d1f6abc4b3b1cc957b0fa6941837db3d0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolavfi/fade: Do not overread input buffer.
Carl Eugen Hoyos [Wed, 25 Feb 2015 14:07:18 +0000 (15:07 +0100)]
lavfi/fade: Do not overread input buffer.
(cherry picked from commit ab3ff19f08b7a83e320c39ab066f289c242b8030)

4 years agotests: drop bc dependency
Clément Bœsch [Mon, 19 Jan 2015 21:56:59 +0000 (22:56 +0100)]
tests: drop bc dependency

We already have a dependency on awk and bc is sometimes not found in the
base system.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a982c5d74fbc7ff5bd2f2f73af61ae48e9b1bcc6)
Signed-off-by: Timothy Gu <timothygu99@gmail.com>
Conflicts:
doc/platform.texi

4 years agofate: Include branch information in the payload header
Timothy Gu [Sun, 12 Apr 2015 15:28:42 +0000 (08:28 -0700)]
fate: Include branch information in the payload header

The server is properly equiped not to choke on that now.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ad27f1221562b037178d1fb605510ba349f04cc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/utils: Ensure that AVFMT_FLAG_CUSTOM_IO is set before use
Michael Niedermayer [Mon, 20 Apr 2015 20:22:31 +0000 (22:22 +0200)]
avformat/utils: Ensure that AVFMT_FLAG_CUSTOM_IO is set before use

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ba631b791435c395361e2026fc7419b341e57813)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/img2dec: do not rewind custom io buffers
Michael Niedermayer [Mon, 20 Apr 2015 21:59:53 +0000 (23:59 +0200)]
avformat/img2dec: do not rewind custom io buffers

Fixes double free with some applications

Fixes vlc ticket14121
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e6e8cc8ce9c2a398fbb51254a5067f4bd3c4fa8a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoalsdec: validate time diff index n2.5.6
Andreas Cadhalpun [Sat, 18 Apr 2015 18:09:28 +0000 (20:09 +0200)]
alsdec: validate time diff index

If begin is smaller than t, the subtraction 'begin -= t' wraps around,
because begin is unsigned. The same applies for end < t.

This causes segmentation faults.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit faf9fe2c224ea81a98afd53e2f0be0a2e13aeca9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/alsdec: Use av_mallocz_array() for chan_data to ensure the arrays never conta...
Michael Niedermayer [Sat, 18 Apr 2015 18:50:23 +0000 (20:50 +0200)]
avcodec/alsdec: Use av_mallocz_array() for chan_data to ensure the arrays never contain random data

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7e104647a3556fc61a139483cee1cb7dfa2dc5bd)

Conflicts:

libavcodec/alsdec.c

4 years agoalsdec: ensure channel reordering is reversible
Andreas Cadhalpun [Sat, 18 Apr 2015 16:31:36 +0000 (18:31 +0200)]
alsdec: ensure channel reordering is reversible

If the same idx is used for more than one i, at least one entry in
sconf->chan_pos remains uninitialized.

This can cause segmentation faults.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ef16501aebed43e34a3721336e8bee732eca2877)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoUpdate or 2.5.6
Michael Niedermayer [Fri, 17 Apr 2015 13:48:25 +0000 (15:48 +0200)]
Update or 2.5.6

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/atrac3plusdsp: fix on stack alignment
Michael Niedermayer [Fri, 17 Apr 2015 09:58:41 +0000 (11:58 +0200)]
avcodec/atrac3plusdsp: fix on stack alignment

Fixes fate failure on ARM
(cherry picked from commit 38f67260684aec8a02d87ab4056b1a1fbf964c03)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>