ffmpeg.git
7 years agompegaudiodec: check output data size based on avctx->frame_size
Justin Ruggles [Tue, 27 Sep 2011 18:27:43 +0000 (14:27 -0400)]
mpegaudiodec: check output data size based on avctx->frame_size

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoresample: Fix array size
Michael Niedermayer [Thu, 27 Oct 2011 13:26:45 +0000 (15:26 +0200)]
resample: Fix array size

Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e7db0a9ee758bf0570a141be1fea64f8d9c03db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoresample2: fix potential overflow
Michael Niedermayer [Thu, 27 Oct 2011 12:34:45 +0000 (14:34 +0200)]
resample2: fix potential overflow

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoresample: Fix overflow
Michael Niedermayer [Thu, 27 Oct 2011 12:31:53 +0000 (14:31 +0200)]
resample: Fix overflow

Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agotta: check for extradata allocation failure in tta demuxer
Justin Ruggles [Fri, 23 Sep 2011 23:22:06 +0000 (19:22 -0400)]
tta: check for extradata allocation failure in tta demuxer
(cherry picked from commit f540ca22c5fb4504d959c295f55591a9ec2a8859)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agovorbisdec: check output buffer size before writing output
Justin Ruggles [Fri, 23 Sep 2011 23:56:58 +0000 (19:56 -0400)]
vorbisdec: check output buffer size before writing output
(cherry picked from commit 60aa1a358d9c1c8f891e72246d5dcd897857eca8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agotwinvq: check output buffer size before decoding
Justin Ruggles [Fri, 23 Sep 2011 23:50:41 +0000 (19:50 -0400)]
twinvq: check output buffer size before decoding
(cherry picked from commit e53eecd0e7211973a1a9757f559bdd93a1848901)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agovp6: Fix illegal read.
Alex Converse [Thu, 3 Nov 2011 22:55:52 +0000 (15:55 -0700)]
vp6: Fix illegal read.
(cherry picked from commit 2a6eb06254df79e96b3d791b6b89b2534ced3119)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoshorten: check output buffer size before decoding
Justin Ruggles [Fri, 16 Sep 2011 22:01:28 +0000 (18:01 -0400)]
shorten: check output buffer size before decoding

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoshorten: check for realloc failure
Justin Ruggles [Thu, 15 Sep 2011 22:08:52 +0000 (18:08 -0400)]
shorten: check for realloc failure
(cherry picked from commit 9e5e2c2d010c05c10337e9c1ec9d0d61495e0c9c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agompegts: do not return from ff_mpegts_parse_packet() after having seen the first PMT
Laurent Aimar [Sat, 8 Oct 2011 21:40:41 +0000 (23:40 +0200)]
mpegts: do not return from ff_mpegts_parse_packet() after having seen the first PMT

It prevents leaving the AVPacket uninitialized.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bc38e83793be5f7a184c88be55e556453a25224b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agompegts: fix return value when enough ts packets have been parsed or when the first...
Laurent Aimar [Sat, 8 Oct 2011 21:40:40 +0000 (23:40 +0200)]
mpegts: fix return value when enough ts packets have been parsed or when the first PMT has been seen.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 49ec0c818dc3c1c293a582b57fb58ba611a10b32)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoFixes avpicture_layout to not write past buffer end.
Matthew Einhorn [Thu, 25 Aug 2011 00:14:03 +0000 (20:14 -0400)]
Fixes avpicture_layout to not write past buffer end.

avpicture_get_size() returns the size of buffer required for avpicture_layout.
For pseudo-paletted formats (gray8...) this size does not include the palette.
However, avpicture_layout doesn't know this and still writes the palette. Consequently,
avpicture_layout writes passed the length of the buffer. This fixes it
by fixing avpicture_layout so that it doesn't write the palette for these formats.

Signed-off-by: Matthew Einhorn <moiein2000@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e662b263d9c500270a8f1dc7e1b81b51d5bdfd4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoavio: Check for invalid buffer length.
Alex Converse [Sat, 15 Oct 2011 01:27:59 +0000 (18:27 -0700)]
avio: Check for invalid buffer length.
(cherry picked from commit ab2940691ba76e1a9b0ce608db0dfc45021d741e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agopthread: copy coded frame dimensions in update_context_from_thread
Ronald S. Bultje [Fri, 14 Oct 2011 21:46:06 +0000 (23:46 +0200)]
pthread: copy coded frame dimensions in update_context_from_thread

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit feadcd1bdcbb4601f4ff01878027264fde985ee1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agovp8: prevent read from uninitialized memory in decode_mvs
Ronald S. Bultje [Fri, 14 Oct 2011 21:43:29 +0000 (23:43 +0200)]
vp8: prevent read from uninitialized memory in decode_mvs

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 0f0b5d643401d4d83322eeee0e57eb5a226ef9ab)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agovp8: force reallocation in update_thread_context after frame size change
Ronald S. Bultje [Fri, 14 Oct 2011 21:27:52 +0000 (23:27 +0200)]
vp8: force reallocation in update_thread_context after frame size change

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 56535793810584f5b3ae59e62cea66fe22d0307d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agovp8: fix return value if update_dimensions fails
Ronald S. Bultje [Fri, 14 Oct 2011 21:21:46 +0000 (23:21 +0200)]
vp8: fix return value if update_dimensions fails

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit f05c2fb6eb1f9ddaec3c07d1874ba62ec0891269)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agomatroskadec: fix out of bounds write
Ronald S. Bultje [Fri, 14 Oct 2011 22:03:55 +0000 (00:03 +0200)]
matroskadec: fix out of bounds write

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 723229c11f1400e6a09c8a1c9c27193f376eb1d1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agomov: 10l: Terminate string with 0 not '0'
Alex Converse [Fri, 14 Oct 2011 17:38:42 +0000 (10:38 -0700)]
mov: 10l: Terminate string with 0 not '0'
(cherry picked from commit 7ad06beb2cf31d8a96f475361425d6cc95e8f176)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agomov: Prevent illegal writes when chapter titles are very short.
Alex Converse [Thu, 13 Oct 2011 21:47:06 +0000 (14:47 -0700)]
mov: Prevent illegal writes when chapter titles are very short.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agotruespeech: check to make sure channels == 1
Justin Ruggles [Thu, 13 Oct 2011 03:23:18 +0000 (23:23 -0400)]
truespeech: check to make sure channels == 1
(cherry picked from commit 3e7a176759e8a8e66d65c779b47b5bba793dfd4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agomlpdec: validate that the reported channel count matches the actual output
Justin Ruggles [Thu, 13 Oct 2011 02:30:44 +0000 (22:30 -0400)]
mlpdec: validate that the reported channel count matches the actual output
channel count
(cherry picked from commit caa845851d790f894a2ccbe12580934f75545f92)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agortpdec: Read the packet length for all RTCP packet types
John Brooks [Wed, 12 Oct 2011 06:53:12 +0000 (00:53 -0600)]
rtpdec: Read the packet length for all RTCP packet types

This allows skipping past unsupported RTCP packet types, as
RFC 3550 section 6.1 mandates.

Currently this only has any practical effect if a sender puts
an unrecognized type before RTCP_BYE in a compounded packet, or
(incorrectly) does not put RTCP_SR first.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 07b77fe3871f86b87e35876d38f1969da5ece4b2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agortpdec: Fix the minimum packet length for RTCP SR packets
John Brooks [Wed, 12 Oct 2011 08:06:26 +0000 (11:06 +0300)]
rtpdec: Fix the minimum packet length for RTCP SR packets

We actually read 20 bytes of these packets.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d6ecf5345c0913e2b66427ea062e7989201a139)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agomem: fix memalign hack av_realloc()
Michael Niedermayer [Tue, 11 Oct 2011 20:03:19 +0000 (22:03 +0200)]
mem: fix memalign hack av_realloc()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc11927890f38445a950b453d24928525da0e61a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoarm: fix av_clipl_int32() asm
Michael Niedermayer [Tue, 11 Oct 2011 18:09:53 +0000 (20:09 +0200)]
arm: fix av_clipl_int32() asm

Note, the other arm asm code is likely affected too and should be changed as well.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 96bc6485bc929741827fc0f08ef06bea662a3eea)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoh264: fix HRD parameters parsing
Mans Rullgard [Tue, 11 Oct 2011 15:00:21 +0000 (16:00 +0100)]
h264: fix HRD parameters parsing

The bit_rate_value_minus1 and cpb_size_value_minus1 elements
allow a wider range than get_ue_golomb() supports.  This
adds a get_ue_golomb_long() function supporting up to 31
leading zeros, which is the maximum for these syntax
elements, and uses it in decode_hrd_parameters().

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit fdba370f8a1bdfc22ecbdf3c7148c2f8680a4ac4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agosmacker: validate channels and sample format.
Justin Ruggles [Wed, 21 Sep 2011 15:49:33 +0000 (11:49 -0400)]
smacker: validate channels and sample format.
(cherry picked from commit ff1f89de2da3472d133e2c95bf7c9ad2d88df33d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agosmacker: check buffer size before reading output size
Justin Ruggles [Wed, 21 Sep 2011 15:42:55 +0000 (11:42 -0400)]
smacker: check buffer size before reading output size
(cherry picked from commit cf044f8bff0d28dbc34492f18b0d18b3ba8bad9d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agosmacker: validate number of channels
Justin Ruggles [Wed, 21 Sep 2011 15:37:51 +0000 (11:37 -0400)]
smacker: validate number of channels
(cherry picked from commit e190e453bd1e4d4b409ed3556b3a50d1087c15d7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agosipr: fix get_bits(0) calls
Mans Rullgard [Mon, 10 Oct 2011 19:41:31 +0000 (20:41 +0100)]
sipr: fix get_bits(0) calls

Zero-length get_bits() is undefined, must check before calling.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit c79d2a20bad59298188171f1316a830d563a41ee)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agomxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions.
Alex Converse [Sat, 8 Oct 2011 01:41:06 +0000 (18:41 -0700)]
mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions.
(cherry picked from commit 0c46e958d1fd3817b8e9fa048d0450d509c80378)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years ago4xm: fix signed overflow
Mans Rullgard [Sun, 9 Oct 2011 19:38:01 +0000 (20:38 +0100)]
4xm: fix signed overflow

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 84dda407628e298f33d610e9e04a8b2945d24665)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agowmavoice: fix a signed overflow
Mans Rullgard [Sun, 9 Oct 2011 19:46:22 +0000 (20:46 +0100)]
wmavoice: fix a signed overflow

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit ba3f07d0611d9a6c10eaa90b3c058ecdffe76676)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agompegvideo_enc: fix a signed overflow
Mans Rullgard [Sun, 9 Oct 2011 19:32:58 +0000 (20:32 +0100)]
mpegvideo_enc: fix a signed overflow

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 05795f35be4b479bfa8d60ed3eb13e0f89e439c0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agocrc: fix signed overflow
Mans Rullgard [Sat, 8 Oct 2011 00:59:51 +0000 (01:59 +0100)]
crc: fix signed overflow

This fixes a signed overflow from i << 24 when i == 255 by
making i unsigned.  The result of the shift is already
assigned to an variable of unsigned type.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 8b19ae07616bbd18969b94cbf5d74308a8f2bbdf)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoh264pred: use unsigned types for pixel values, fix signed overflows
Mans Rullgard [Sat, 8 Oct 2011 20:22:06 +0000 (21:22 +0100)]
h264pred: use unsigned types for pixel values, fix signed overflows

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 60f10e0ad37418cc697765d85b0bc22db70f726a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoqtrle: check for out of bound writes.
Laurent Aimar [Sat, 8 Oct 2011 21:40:36 +0000 (23:40 +0200)]
qtrle: check for out of bound writes.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7fb92be7e50ea4ba5712804326c6814ae02dd190)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoxxan: check for out of bound accesses
Laurent Aimar [Sat, 8 Oct 2011 21:40:34 +0000 (23:40 +0200)]
xxan: check for out of bound accesses

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a68a6a4fb19caecc91d5f7fe3ef4f83f6d3c4586)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agotxd: check for out of bound reads.
Laurent Aimar [Sat, 8 Oct 2011 19:57:27 +0000 (21:57 +0200)]
txd: check for out of bound reads.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e182de9a98272fbe4f368000911191aaeb0d6fb3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoqtrle: check for invalid line offset
Laurent Aimar [Sat, 8 Oct 2011 21:01:33 +0000 (23:01 +0200)]
qtrle: check for invalid line offset

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9f99b89f86b65710d8855dc572f1a25)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agovqavideo: check for out of bound reads.
Laurent Aimar [Sat, 8 Oct 2011 23:54:41 +0000 (01:54 +0200)]
vqavideo: check for out of bound reads.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6d45702f7f257c1cfcd3ce3287bf258854528a4a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agovqa: fix double free on corrupted streams
Laurent Aimar [Sat, 8 Oct 2011 21:40:37 +0000 (23:40 +0200)]
vqa: fix double free on corrupted streams

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e3123856c79c36507772ada1bcda6cfe36a1e297)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agovqavideo: check for invalid/unsupported version
Laurent Aimar [Sat, 8 Oct 2011 21:40:39 +0000 (23:40 +0200)]
vqavideo: check for invalid/unsupported version

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b226af39107f09cd650875388250f4968eea54db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoeamad: release the reference frame on video size changes
Laurent Aimar [Sat, 8 Oct 2011 21:40:33 +0000 (23:40 +0200)]
eamad: release the reference frame on video size changes

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6c1fb3e7631178c2a45c6c41b9b8d9ee3a5298fc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoeamad: check for out of bound reads when doing MC
Laurent Aimar [Sat, 8 Oct 2011 21:40:31 +0000 (23:40 +0200)]
eamad: check for out of bound reads when doing MC

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit da35797359cec148f3fe59894c62727b0422d75a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoeamad: avoid NULL derefence when missing the reference frame.
Laurent Aimar [Sat, 8 Oct 2011 21:40:32 +0000 (23:40 +0200)]
eamad: avoid NULL derefence when missing the reference frame.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6e20554a6d33e92b81dc3cfed6082e03bff2a7f8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoeatgv: fix pointer arithmetic overflows.
Laurent Aimar [Sat, 8 Oct 2011 21:40:28 +0000 (23:40 +0200)]
eatgv: fix pointer arithmetic overflows.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6bfe0d4c3d7de11e859ea6720b011cf5fdf5ef03)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoeatgv: fix out of bound reads on corrupted motions vectors.
Laurent Aimar [Sat, 8 Oct 2011 21:40:27 +0000 (23:40 +0200)]
eatgv: fix out of bound reads on corrupted motions vectors.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 09302a897d1990b1338f049fcd29638d736b8823)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoeamad: clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffer
Laurent Aimar [Sat, 8 Oct 2011 21:40:30 +0000 (23:40 +0200)]
eamad: clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffer

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 74b9c598396f76407c6b3841c10bc67ddddb2a98)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agolavf: fix signed overflow in avformat_find_stream_info()
Mans Rullgard [Sat, 8 Oct 2011 01:06:26 +0000 (02:06 +0100)]
lavf: fix signed overflow in avformat_find_stream_info()

On the first iteration through this code, last_dts is always
INT64_MIN (AV_NOPTS_VALUE) and the subtraction overflows in
an invalid manner.  Although the result is only used if the
input values are valid, performing the subtraction is still
not allowed in a strict environment.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit a31e9f68a426f634e002282885c6c2eb1bfbea44)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agovp8: fix signed overflows
Mans Rullgard [Sat, 8 Oct 2011 14:03:51 +0000 (15:03 +0100)]
vp8: fix signed overflows

In addition to avoiding undefined behaviour, an unsigned type
makes more sense for packing multiple 8-bit values.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit bb59156606e00057a706ed30165bc7329db3823f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agomotion_est: fix some signed overflows
Mans Rullgard [Sat, 8 Oct 2011 12:52:44 +0000 (13:52 +0100)]
motion_est: fix some signed overflows

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit e708afd3c026a9eb547dab07781320a7e2564312)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agodca: fix signed overflow in shift
Mans Rullgard [Sat, 8 Oct 2011 12:49:42 +0000 (13:49 +0100)]
dca: fix signed overflow in shift

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 559c244d42be7a02c23976216b47fd63b80d6c7f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoaacdec: fix undefined shifts
Mans Rullgard [Sat, 8 Oct 2011 12:41:23 +0000 (13:41 +0100)]
aacdec: fix undefined shifts

Since nnz can be zero, this is needed to avoid a shift by 32.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit d12294304acd82cb219e3f66ca9cd6efb2194fa4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoput_bits: fix invalid shift by 32 in flush_put_bits()
Mans Rullgard [Sat, 8 Oct 2011 01:09:42 +0000 (02:09 +0100)]
put_bits: fix invalid shift by 32 in flush_put_bits()

If flush_put_bits() is called when the 32-bit buffer is empty,
e.g. after writing a multiple of 32 bits, and invalid shift by
32 is performed.  Since flush_put_bits() is called infrequently,
this additional check should have negligible performance impact.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit ac6eab1496aad6f8b09deabbef4fe5fd829e142d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoh264: fix the size of PPS::chroma_qp_table
Laurent Aimar [Thu, 6 Oct 2011 19:55:44 +0000 (21:55 +0200)]
h264: fix the size of PPS::chroma_qp_table

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e588a5c2d418fdcf08ece076a2642de44f444d55)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoh264: fix fill_colmap() to not store entries mbaff style when the reference is not...
Michael Niedermayer [Thu, 6 Oct 2011 20:54:00 +0000 (22:54 +0200)]
h264: fix fill_colmap() to not store entries mbaff style when the reference is not mbaff at all

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a3ba542af39ba4425cbb44d2a0ae09c212b40001)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agompegvideo: fix position of bottom edge.
Ronald S. Bultje [Mon, 3 Oct 2011 14:37:24 +0000 (07:37 -0700)]
mpegvideo: fix position of bottom edge.

It was wrong in colorspaces where horizontal and vertical chroma
subsampling are not the same, e.g. 422.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoh254: explicitly initialize bit depth/chroma idc
Laurent Aimar [Tue, 4 Oct 2011 20:13:56 +0000 (22:13 +0200)]
h254: explicitly initialize bit depth/chroma idc

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoqcelp: check output buffer size before decoding
Justin Ruggles [Wed, 14 Sep 2011 17:38:07 +0000 (13:38 -0400)]
qcelp: check output buffer size before decoding
(cherry picked from commit e43dd3d2a8e106169e707484090a2d973ece2184)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agosipr: fix the output data size check and only calculate it once.
Justin Ruggles [Tue, 20 Sep 2011 19:27:44 +0000 (15:27 -0400)]
sipr: fix the output data size check and only calculate it once.
(cherry picked from commit 1b5a189f06879338088809b3049ea7620f4e7e78)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoff_dv_frame_profile2: Check input buffer size.
Michael Niedermayer [Tue, 4 Oct 2011 02:21:19 +0000 (04:21 +0200)]
ff_dv_frame_profile2: Check input buffer size.

Based on code by DivX, Inc. / drffmpeg

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 51b0694bc051cda2bfed048a35e694d1047c6ef0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoqdm2: check output buffer size before decoding
Justin Ruggles [Wed, 14 Sep 2011 17:57:04 +0000 (13:57 -0400)]
qdm2: check output buffer size before decoding
(cherry picked from commit 7d49f79f1cd47783a963a757a6563b9cac29db62)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoMAINTAINERS: new ffplay maintainer
Michael Niedermayer [Sun, 2 Oct 2011 22:38:50 +0000 (00:38 +0200)]
MAINTAINERS: new ffplay maintainer

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cffd20b90ee6f35e37cdb51dd94e6b2174fd31b6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agoriff: map 0x0038 to amrnb, works on http://video.mopoto.com/4/40/407/40709.avi
Compn [Sun, 2 Oct 2011 21:39:03 +0000 (17:39 -0400)]
riff: map 0x0038 to amrnb, works on video.mopoto.com/4/40/407/40709.avi
(cherry picked from commit 3ebab62fc67591fd9313fad32892d7d32e805422)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agompc8: check output buffer size before decoding
Justin Ruggles [Wed, 14 Sep 2011 15:39:21 +0000 (11:39 -0400)]
mpc8: check output buffer size before decoding
(cherry picked from commit 5674d4b0a35a34b75e3533a8580e0b5a0a8895a7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agompc7: return error if packet is too small.
Justin Ruggles [Wed, 14 Sep 2011 15:16:42 +0000 (11:16 -0400)]
mpc7: return error if packet is too small.
(cherry picked from commit 8290d1f38b438f1b070de67645c8b4a42014c7ac)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
7 years agompc7: check output buffer size before decoding
Justin Ruggles [Tue, 13 Sep 2011 22:53:18 +0000 (18:53 -0400)]
mpc7: check output buffer size before decoding
(cherry picked from commit c8b5c4d27409dfdcec80868686b173ba446c998b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
8 years agovaapi: fix VC-1 decoding (reconstruct bitstream TTFRM correctly).
Gwenole Beauchesne [Thu, 6 Oct 2011 13:19:33 +0000 (15:19 +0200)]
vaapi: fix VC-1 decoding (reconstruct bitstream TTFRM correctly).
(cherry picked from commit 825dd135d829d85778e6c37f685a6088fef01b2e)

8 years agoh264: do not let invalid values in h->ref_count after a decoder reset.
Laurent Aimar [Tue, 4 Oct 2011 20:13:58 +0000 (22:13 +0200)]
h264: do not let invalid values in h->ref_count after a decoder reset.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0333d234b0355b375762447e93674e3fe3c5bff1)

8 years agolibx264: Fix loop failure due to bufsize becoming 0
Michael Niedermayer [Tue, 4 Oct 2011 21:21:52 +0000 (23:21 +0200)]
libx264: Fix loop failure due to bufsize becoming 0

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 751a4efd4d754b15ebc6027b09051f27860bb1e8)

8 years agoconfigure: remove bashism equality check for target_os.
Clément Bœsch [Tue, 4 Oct 2011 19:34:55 +0000 (21:34 +0200)]
configure: remove bashism equality check for target_os.
(cherry picked from commit e39be59b85de63e036bd6db9b79a9a9f29a838f7)

8 years agoH264: hotfix for speedloss on frame threading and h264 files with slices.
Michael Niedermayer [Mon, 3 Oct 2011 22:14:48 +0000 (00:14 +0200)]
H264: hotfix for speedloss on frame threading and h264 files with slices.

This fix is not ideal as it still limits the multithreading on field pictures
to the 2nd field only.
Ill try to fix it properly to allow both fields to decode concurrently but this
needs more work.

This bug exists since and was caused by:
commit ea6331f8bbaf3343faec6ffe77a6218a016a3af5
Author: Ronald S. Bultje <rsbultje@gmail.com>
Date:   Mon Jun 20 10:24:33 2011 -0400

    h264-mt: fix deadlock in packets with multiple slices (e.g. MP4).
(cherry picked from commit eaa21b6870ba8bba4b0370e91f1941307c1c9681)

8 years agompegtsenc: Lift limit on PMT PID
Loren Osborn [Mon, 3 Oct 2011 14:03:29 +0000 (16:03 +0200)]
mpegtsenc: Lift limit on PMT PID
Fixes Ticket518
(cherry picked from commit bf5c3bac51e422580aad011fcd927c818542f054)

8 years agoDo not set codec_tag property for matroska muxers.
Carl Eugen Hoyos [Sun, 28 Aug 2011 21:13:17 +0000 (23:13 +0200)]
Do not set codec_tag property for matroska muxers.

Fixes ticket #8, #537.

8 years agolavf/utils: fix overestimation of the rational number density.
Michael Niedermayer [Mon, 3 Oct 2011 14:32:17 +0000 (16:32 +0200)]
lavf/utils: fix overestimation of the rational number density.
Fixes Ticket498

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
8 years agoUpdate for 0.8.5 n0.8.5
Michael Niedermayer [Sun, 2 Oct 2011 20:02:45 +0000 (22:02 +0200)]
Update for 0.8.5

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
8 years agoh264: fix intra 16x16 mode check when using mbaff and constrained_intra_pred.
Laurent Aimar [Sun, 2 Oct 2011 19:07:41 +0000 (21:07 +0200)]
h264: fix intra 16x16 mode check when using mbaff and constrained_intra_pred.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4fd95b5d511384ed3ce388d8d20a16b1c4c0530)

8 years agoh264: check for invalid bit depth value.
Laurent Aimar [Sun, 2 Oct 2011 16:29:31 +0000 (18:29 +0200)]
h264: check for invalid bit depth value.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c2b7f7748be447e1446f63b13da472ba7e00f329)

8 years agoh264: add entries for 11 and 12 bits in ff_h264_chroma_qp[][]
Laurent Aimar [Sun, 2 Oct 2011 16:29:30 +0000 (18:29 +0200)]
h264: add entries for 11 and 12 bits in ff_h264_chroma_qp[][]

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 27d3361e34cf19ad5c0bfb7cfacae0db99b26064)

8 years agoh264: fix the check for invalid SPS:num_ref_frames.
Laurent Aimar [Sun, 2 Oct 2011 14:06:38 +0000 (16:06 +0200)]
h264: fix the check for invalid SPS:num_ref_frames.

This patch set the limit to 16.

For information, thoses previous commits:
41f7e2d11d2dca23842ee89d530ca9fa15cec9d8
5cbb0e70a0a2ee99eb3cb09e837b9a1f7355b9bc
assumed it was either 30 or 32.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bcf881a6858760ecbd9ff4352a38813dc4232dd6)

8 years agoh264: do not let invalid values in h->ref_count on ff_h264_decode_ref_pic_list_reorde...
Laurent Aimar [Sun, 2 Oct 2011 14:06:37 +0000 (16:06 +0200)]
h264: do not let invalid values in h->ref_count on ff_h264_decode_ref_pic_list_reordering() errors.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2428b53f6d306d8d71dec34fa7b0af733d76cfac)

8 years agoReject video with non multiple of 16 width/height in the 4xm decoder.
Laurent Aimar [Sat, 1 Oct 2011 00:04:45 +0000 (02:04 +0200)]
Reject video with non multiple of 16 width/height in the 4xm decoder.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit db5b4875514eb7740844f514dbf236c9179a6a93)

8 years ago4xm decoder: fix data size for i2 frames.
Michael Niedermayer [Sun, 2 Oct 2011 01:40:26 +0000 (03:40 +0200)]
4xm decoder: fix data size for i2 frames.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0a19b4b0bae772cac7f8341e94c319c96356ee69)

8 years ago4xm decoder: print some error messages in case of errors.
Michael Niedermayer [Sun, 2 Oct 2011 01:39:59 +0000 (03:39 +0200)]
4xm decoder: print some error messages in case of errors.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1008f639e2ebaa2b3d48ac765ca49c8869042d75)

8 years agoCheck for out of bound accesses in the 4xm decoder.
Laurent Aimar [Sat, 1 Oct 2011 22:38:27 +0000 (00:38 +0200)]
Check for out of bound accesses in the 4xm decoder.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9c661e952fbcbf044709f9a7031c68cc4860336b)

8 years agoPrevent block size from inreasing in the shorten decoder.
Laurent Aimar [Fri, 30 Sep 2011 22:43:05 +0000 (00:43 +0200)]
Prevent block size from inreasing in the shorten decoder.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b399cbfba5d901608c18e1a2d48a24c30541a634)

8 years agoCheck for out of bound reads in PTX decoder.
Laurent Aimar [Sat, 1 Oct 2011 22:38:32 +0000 (00:38 +0200)]
Check for out of bound reads in PTX decoder.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 581898ae882dc37967b689b6ea5f2b2a9acd257a)

8 years agoClear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffers used...
Laurent Aimar [Sat, 1 Oct 2011 22:38:30 +0000 (00:38 +0200)]
Clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffers used in 4xm decoder.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 90a69b2f61cbd2d58723d712bdf283e5e56b2ea2)

8 years agoFix the check for missing references in ff_er_frame_end() for H264.
Laurent Aimar [Sat, 1 Oct 2011 22:38:31 +0000 (00:38 +0200)]
Fix the check for missing references in ff_er_frame_end() for H264.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
8 years agoPrevent NULL dereference when the huffman table is invalid in the 4xm decoder.
Laurent Aimar [Sat, 1 Oct 2011 22:38:28 +0000 (00:38 +0200)]
Prevent NULL dereference when the huffman table is invalid in the 4xm decoder.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4a8ff0636d67c6df059f2ae2df49ad1181de14ca)

8 years agoFix use of uninitialized memory in 4X Technologies demuxer.
Laurent Aimar [Sat, 1 Oct 2011 22:38:26 +0000 (00:38 +0200)]
Fix use of uninitialized memory in 4X Technologies demuxer.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a1876e0072aa0c69f037e0cafaca1a54bf2e189b)

8 years agoh264: increase ref_poc size to 32 as it can be per field.
Michael Niedermayer [Sat, 1 Oct 2011 22:47:54 +0000 (00:47 +0200)]
h264: increase ref_poc size to 32 as it can be per field.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8c851ef5a81fb0429453c43fdcfc974ce1b6e447)

8 years agoh264: set unused ref_counts to 0 as a precautionary meassure.
Michael Niedermayer [Sat, 1 Oct 2011 22:45:41 +0000 (00:45 +0200)]
h264: set unused ref_counts to 0 as a precautionary meassure.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3af2de76ac8b7aa762e4ee129ec29140e6247d81)

8 years agoRemove Chnagelog it has nothing to do with reality
Michael Niedermayer [Sat, 1 Oct 2011 20:12:01 +0000 (22:12 +0200)]
Remove Chnagelog it has nothing to do with reality

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
8 years agoMerge remote-tracking branch 'qatar/release/0.7' into release/0.8
Michael Niedermayer [Sat, 1 Oct 2011 20:42:41 +0000 (22:42 +0200)]
Merge remote-tracking branch 'qatar/release/0.7' into release/0.8

* qatar/release/0.7: (73 commits)
  Update Changelog for 0.7.2 release
  Update RELEASE file for 0.7.2
  lavf: do not set codec_tag for rawvideo
  fate: allow testing with libavfilter disabled
  fate: separate lavf-mxf_d10 test from lavf-mxf
  Fix memory (re)allocation in matroskadec.c, related to MSVR-11-0080.
  movenc: fix NULL reference in mov_write_tkhd_tag
  movenc: create an alternate group for each media type
  flvdec: Check for overflow before allocating arrays
  ppc: fix some pointer to integer casts
  ppc: fix 32-bit PIC build
  rv34: Check for invalid slice offsets
  rv34: Fix potential overreads
  rv34: Avoid NULL dereference on corrupted bitstream
  rv10: Reject slices that does not have the same type as the first one
  lavf: Fix context pointer in av_open_input_stream when avformat_open_input fails
  oggdec: fix out of bound write in the ogg demuxer
  Fixed size given to init_get_bits().
  smacker: fix a few off by 1 errors
  Check for invalid VLC value in smacker decoder.
  ...

Conflicts:
RELEASE
libavcodec/avs.c
libavcodec/ppc/asm.S
libavcodec/rv34.c
libavcodec/xan.c
libavdevice/alsa-audio.h
libavformat/flvdec.c
libavformat/gxf.c
libavformat/utils.c
libswscale/x86/swscale_template.c
tests/ref/lavf/mov
tests/ref/lavf/mxf

Merged-by: Michael Niedermayer <michaelni@gmx.at>
8 years agofate: fix motion pixels checksum change caused by backported bugfix
Michael Niedermayer [Sat, 1 Oct 2011 20:28:16 +0000 (22:28 +0200)]
fate: fix motion pixels checksum change caused by backported bugfix

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
8 years agoavienc: Add a limit on the number of skiped frames muxed in a row.
Michael Niedermayer [Sat, 1 Oct 2011 01:48:33 +0000 (03:48 +0200)]
avienc: Add a limit on the number of skiped frames muxed in a row.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9cb9e39c41959961bdb5a1fd51cdd25e10c050f3)