ffmpeg.git
7 years agolibx264: add 'stats' private option for setting 2pass stats filename.
Anton Khirnov [Mon, 12 Mar 2012 16:20:20 +0000 (17:20 +0100)]
libx264: add 'stats' private option for setting 2pass stats filename.

x264 always opens the file itself with fopen, so we cannot use the
standard lavc stats mechanism.

CC: libav-stable@libav.org
(cherry picked from commit d533e395e14d403948ca2424efbcee92429ef8e1)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agolibx264: fix help text for slice-max-size option.
Anton Khirnov [Mon, 12 Mar 2012 16:09:22 +0000 (17:09 +0100)]
libx264: fix help text for slice-max-size option.

CC: libav-stable@libav.org
(cherry picked from commit 9d5c131ecec75fcfb1b4b56f74f2b2756bf0027a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoavconv: reindent
Anton Khirnov [Mon, 12 Mar 2012 16:43:48 +0000 (17:43 +0100)]
avconv: reindent

CC: libav-stable@libav.org
(cherry picked from commit 64334ddbbc7fce490c895c54106291d0b128e830)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoavconv: link '-passlogfile' option to libx264 'stats' AVOption.
Anton Khirnov [Mon, 12 Mar 2012 16:42:57 +0000 (17:42 +0100)]
avconv: link '-passlogfile' option to libx264 'stats' AVOption.

Fixes bug 204.

CC: libav-stable@libav.org
(cherry picked from commit 6e8be949f12734f38d360aad0f5c503a0f9606fa)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoRevert "h264: clear trailing bits in partially parsed NAL units"
Janne Grunau [Mon, 12 Mar 2012 21:01:02 +0000 (22:01 +0100)]
Revert "h264: clear trailing bits in partially parsed NAL units"

This reverts commit 729ebb2f185244b0ff06d48edbbbbb02ceb4ed4e.

There was an off-by-one error in the bit mask calculation clearing
actually the last valid bit and causing
http://bugzilla.libav.org/show_bug.cgi?id=227

The broken sample (Mr_MrsSmith-h264_aac.mp4) the commit was fixing
does not work after correcting the off-by-one error.

CC: libav-stable@libav.org
(cherry picked from commit 8a6037c3900875ccab8d553d2cc659bdef2c9d0e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agompc: pad mpc_CC/SCF[] tables to allow for negative indices.
Ronald S. Bultje [Sat, 10 Mar 2012 22:28:08 +0000 (14:28 -0800)]
mpc: pad mpc_CC/SCF[] tables to allow for negative indices.

MPC8 allows indices of mpc_CC up to -1, and mpc_SCF up to -6, thus pad
the tables by that much on the left end.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d7eabd50425a61b31e90c763a0c3e4316a725404)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoxxan: protect against chroma LUT overreads.
Ronald S. Bultje [Sat, 10 Mar 2012 19:57:17 +0000 (11:57 -0800)]
xxan: protect against chroma LUT overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f77bfa837636a99a4034d31916a76f7d1688cf5a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoxxan: convert to bytestream2 API.
Ronald S. Bultje [Fri, 9 Mar 2012 00:32:47 +0000 (16:32 -0800)]
xxan: convert to bytestream2 API.

Protects against overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 55188278169c3a1838334d7aa47a1f7a40741690)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoxxan: don't read before start of buffer in av_memcpy_backptr().
Ronald S. Bultje [Fri, 9 Mar 2012 00:32:46 +0000 (16:32 -0800)]
xxan: don't read before start of buffer in av_memcpy_backptr().

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f1279e286b00e99f343adb51e251f036a3df6f32)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agodsicinvideo: validate buffer offset before copying pixels.
Ronald S. Bultje [Sun, 11 Mar 2012 14:28:54 +0000 (07:28 -0700)]
dsicinvideo: validate buffer offset before copying pixels.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c95fefa0420be9cc0f09a95041acf11114aaacd0)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agocook: error out on quant_index values outside [-63, 63] range.
Ronald S. Bultje [Sun, 11 Mar 2012 01:51:28 +0000 (17:51 -0800)]
cook: error out on quant_index values outside [-63, 63] range.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 97e48b2f541396ef6e8816a555bac1bb993d7a6a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agocook: extend channel uncoupling tables so the full bit range is covered.
Ronald S. Bultje [Tue, 6 Mar 2012 21:45:32 +0000 (13:45 -0800)]
cook: extend channel uncoupling tables so the full bit range is covered.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 37cc8600d0313838cab5b886b9d373e5819aa24f)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agocook: expand dither_tab[], and make sure indexes into it don't overflow.
Ronald S. Bultje [Fri, 9 Mar 2012 01:09:27 +0000 (17:09 -0800)]
cook: expand dither_tab[], and make sure indexes into it don't overflow.

Fixes overflows in accessing dither_tab[].

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 442c3a8cb1785d74f8e2d7ab35b1862b7088436b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agohuffyuv: add padding to classic (v1) huffman tables.
Ronald S. Bultje [Thu, 8 Mar 2012 00:29:23 +0000 (16:29 -0800)]
huffyuv: add padding to classic (v1) huffman tables.

We slightly overread the input buffer, so we require
padding at the end of the buffer, as is documented in the
get_bits API. Without padding, we'll read uninitialized
data or beyond the end of the .rodata, which may crash.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 4ffe5e2aa5241f8da9afd2c8fbc854dcc916c5f9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoavs: fix infinite loop on end-of-stream.
Ronald S. Bultje [Thu, 16 Feb 2012 00:21:34 +0000 (16:21 -0800)]
avs: fix infinite loop on end-of-stream.

The codec would keep returning the last decoded frame if the stream
contains B-frames, since it wouldn't clear that frame from the list of
frames to be returned to the user.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 83f15a1228895434a982c840b09edccd1c64e800)

Conflicts:

libavcodec/cavsdec.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agotiffdec: Prevent illegal memory access caused by recycled pointers.
Alex Converse [Wed, 7 Mar 2012 01:00:29 +0000 (17:00 -0800)]
tiffdec: Prevent illegal memory access caused by recycled pointers.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit fd0be63049ed46660993d0550a4f0847a0b942ea)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowma: fix off-by-one in array bounds check.
Ronald S. Bultje [Wed, 7 Mar 2012 22:18:14 +0000 (14:18 -0800)]
wma: fix off-by-one in array bounds check.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b4bccf3e4e58f6fe58043791ca09db01a4343fac)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agodv: check buffer size before reading profile.
Ronald S. Bultje [Wed, 7 Mar 2012 21:48:41 +0000 (13:48 -0800)]
dv: check buffer size before reading profile.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e97efecec82ca8458a9bbd75a91ebf556abde362)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoraw: move buffer size check up.
Ronald S. Bultje [Wed, 7 Mar 2012 00:08:10 +0000 (16:08 -0800)]
raw: move buffer size check up.

This way, it protects against overreads for 4bpp/2bpp content also.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cc5dd632cecc5114717d0b90f8c2be162b1c6ee8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agodca: prevent accessing static arrays with invalid indexes.
Ronald S. Bultje [Wed, 29 Feb 2012 02:11:59 +0000 (18:11 -0800)]
dca: prevent accessing static arrays with invalid indexes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e6ffd997cbc06426e75d3fa291b991866c84a79b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agolpcm: fix sample size calculation for 20bit LCPM.
Ronald S. Bultje [Wed, 7 Mar 2012 04:08:17 +0000 (20:08 -0800)]
lpcm: fix sample size calculation for 20bit LCPM.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f1320dc3bed281bb2f3c5531c52b6a6246e2394a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agosmacker: error out if palette copy-with-offset overruns palette size.
Ronald S. Bultje [Wed, 7 Mar 2012 01:24:20 +0000 (17:24 -0800)]
smacker: error out if palette copy-with-offset overruns palette size.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit a93b572ae4f517ce0c35cf085167c318e9215908)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoDon't use ff_cropTbl[] for IDCT.
Ronald S. Bultje [Tue, 6 Mar 2012 00:01:19 +0000 (16:01 -0800)]
Don't use ff_cropTbl[] for IDCT.

Results of IDCT can by far outreach the range of ff_cropTbl[], leading
to overreads and potentially crashes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c23acbaed40101c677dfcfbbfe0d2c230a8e8f44)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoswscale: make filterPos 32bit.
Ronald S. Bultje [Mon, 5 Mar 2012 20:26:42 +0000 (12:26 -0800)]
swscale: make filterPos 32bit.

Fixes overflows for large image sizes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2254b559cbcfc0418135f09add37c0a5866b1981)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoerror_resilience: initialize s->block_index[].
Ronald S. Bultje [Tue, 6 Mar 2012 18:27:05 +0000 (10:27 -0800)]
error_resilience: initialize s->block_index[].

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6193ff68549ecbaf1a4d63a0e06964ec580ac620)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agosvq3: protect against negative quantizers.
Ronald S. Bultje [Tue, 6 Mar 2012 01:03:32 +0000 (17:03 -0800)]
svq3: protect against negative quantizers.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 11b940a1a8e7e5d5b212935a3ce78aeda577f5f2)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoPrepare for 0.8.1 Release
Reinhard Tartler [Mon, 5 Mar 2012 19:40:37 +0000 (20:40 +0100)]
Prepare for 0.8.1 Release

7 years agomov: set channel layout for AC-3 streams based on the 'dac3' atom info
Justin Ruggles [Sun, 12 Feb 2012 20:06:58 +0000 (15:06 -0500)]
mov: set channel layout for AC-3 streams based on the 'dac3' atom info

fixes Bug 225
(cherry picked from commit 3798205a77ce275613098ecb48645e6029811f14)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agorv34: handle size changes during frame multithreading
Janne Grunau [Mon, 13 Feb 2012 20:10:48 +0000 (21:10 +0100)]
rv34: handle size changes during frame multithreading

Factors all context dynamic memory handling to its own functions.
Fixes bug 220.
(cherry picked from commit 2bd730010da24d035639586bb13862abe36cc1b8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agomov: Add more HDV and XDCAM FourCCs.
Alex Converse [Tue, 21 Feb 2012 23:37:35 +0000 (15:37 -0800)]
mov: Add more HDV and XDCAM FourCCs.

Reference: VLC
(cherry picked from commit b142496c5630b9bc88fb9eaccae7f6bd62fb23e7)

7 years agomov: Add support for MPEG2 HDV 720p24 (hdv4)
Alex Converse [Tue, 21 Feb 2012 22:08:02 +0000 (14:08 -0800)]
mov: Add support for MPEG2 HDV 720p24 (hdv4)

(cherry picked from commit 0ad522afb3a3b3d22402ecb82dd4609f7655031b)

7 years agorv10/20: Fix slice overflow with checked bitstream reader.
Alex Converse [Thu, 1 Mar 2012 21:24:55 +0000 (13:24 -0800)]
rv10/20: Fix slice overflow with checked bitstream reader.

(cherry picked from commit 9243ec4a508c81a621e941bb7e012e2d45d93659)

7 years agoh263dec: Disallow width/height changing with frame threads.
Michael Niedermayer [Fri, 17 Feb 2012 21:35:10 +0000 (13:35 -0800)]
h263dec: Disallow width/height changing with frame threads.

Fixes CVE-2011-3937

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 71db86d53b5c6872cea31bf714a1a38ec78feaba)

Conflicts:

libavcodec/h263dec.c

Signed-off-by: Alex Converse <alex.converse@gmail.com>
7 years agoadpcm: Clip step_index values read from the bitstream at the beginning of each frame.
Alex Converse [Tue, 28 Feb 2012 19:50:22 +0000 (11:50 -0800)]
adpcm: Clip step_index values read from the bitstream at the beginning of each frame.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit bbeb29133b55b7256d18f5aaab8b5c8e919a173a)

7 years agotiff: Make the TIFF_LONG and TIFF_SHORT types unsigned.
Alex Converse [Thu, 23 Feb 2012 18:22:51 +0000 (10:22 -0800)]
tiff: Make the TIFF_LONG and TIFF_SHORT types unsigned.

TIFF v6.0 (unimplemented) adds signed equivalents.
(cherry picked from commit e32548d1331ce05a054f1028fcdda8823a4f215a)

7 years agodpcm: ignore extra unpaired bytes in stereo streams.
Alex Converse [Fri, 17 Feb 2012 22:13:40 +0000 (14:13 -0800)]
dpcm: ignore extra unpaired bytes in stereo streams.

Fixes: CVE-2011-3951

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ce7aee9b733134649a6ce2fa743e51733f33e67e)

7 years agosvq3: Prevent illegal reads while parsing extradata.
Alex Converse [Fri, 10 Feb 2012 04:21:47 +0000 (20:21 -0800)]
svq3: Prevent illegal reads while parsing extradata.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 9e1db721c4329f4ac166a0bcc002c8d75f831aba)

7 years agodv: Fix small overread in audio frequency table.
Alex Converse [Fri, 10 Feb 2012 01:11:55 +0000 (17:11 -0800)]
dv: Fix small overread in audio frequency table.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 0ab3687924457cb4fd81897bd39ab3cc5b699588)

7 years agoac3dec: Move center and surround mix level tables to the parser.
Michael Niedermayer [Fri, 3 Feb 2012 03:27:27 +0000 (22:27 -0500)]
ac3dec: Move center and surround mix level tables to the parser.

That way all mix levels as exported by avpriv_ac3_parse_header()
will have the same meaning.

Previously the 3-bit center mix level for E-AC-3 was used to index in a
4-entry table, leading to out-of-array reads.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit e6d9fa66f12cf5a3024c9bc7c4c608f7fc59207e)

7 years agomovdec: Avoid av_malloc(0) in stss
Alex Converse [Fri, 3 Feb 2012 18:43:21 +0000 (10:43 -0800)]
movdec: Avoid av_malloc(0) in stss

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 29a20ac4a19df5acc0eef306ca5a737778a31358)

7 years agoac3: Do not read past the end of ff_ac3_band_start_tab.
Mans Rullgard [Tue, 31 Jan 2012 18:20:33 +0000 (10:20 -0800)]
ac3: Do not read past the end of ff_ac3_band_start_tab.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 034b03e7a0e8e4f8f66c82b736f2c0aa7c063ec0)

7 years agodv: Fix small stack overread related to CVE-2011-3929 and CVE-2011-3936.
Alex Converse [Thu, 26 Jan 2012 23:08:26 +0000 (15:08 -0800)]
dv: Fix small stack overread related to CVE-2011-3929 and CVE-2011-3936.

Found with asan.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 2d1c0dea5f6b91bec7f5fa53ec050913d851e366)

7 years agodv: Fix null pointer dereference due to ach=0
Michael Niedermayer [Tue, 24 Jan 2012 16:51:40 +0000 (17:51 +0100)]
dv: Fix null pointer dereference due to ach=0

dv: Fix null pointer dereference due to ach=0

Fixes part2 of CVE-2011-3929

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Roman Shaposhnik <roman@shaposhnik.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 5a396bb3a66a61a68b80f2369d0249729bf85e04)

7 years agodv: check stype
Michael Niedermayer [Tue, 24 Jan 2012 16:48:23 +0000 (17:48 +0100)]
dv: check stype

dv: check stype

Fixes part1 of CVE-2011-3929
Possibly fixes part of CVE-2011-3936

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Roman Shaposhnik <roman@shaposhnik.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 635bcfccd439480003b74a665b5aa7c872c1ad6b)

7 years agompegaudiodec: Prevent premature clipping of mp3 input buffer.
Dale Curtis [Fri, 24 Feb 2012 18:17:39 +0000 (13:17 -0500)]
mpegaudiodec: Prevent premature clipping of mp3 input buffer.

Instead of clipping extrasize based on EXTRABYTES, clip based on the
amount of buffer actually left. Without this fix, there are warbles
and other distortions in the test case below.

http://kevincennis.com/mix/assets/sounds/1901_voxfx.mp3
(cherry picked from commit b7165426917f91ebcad84bdff366824f03b32bfe)

Signed-off-by: Alex Converse <alex.converse@gmail.com>
7 years agomp3dec: Fix a heap-buffer-overflow
Alex Converse [Wed, 25 Jan 2012 23:46:14 +0000 (15:46 -0800)]
mp3dec: Fix a heap-buffer-overflow

In some cases, what is left to read from ptr is smaller than EXTRABYTES.

Based on a patch by Thierry Foucu <tfoucu@gmail.com>.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit f372ce119bd2458fa0b4ddfb2af3a36621df99f7)

7 years agompeg12: Pad framerate tab to 16 entries.
Alex Converse [Fri, 27 Jan 2012 23:50:24 +0000 (15:50 -0800)]
mpeg12: Pad framerate tab to 16 entries.

There are many places where we read an unchecked 4-bit index into it.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit dfa37fe8a3d9243dd339d94befa065e2c90b29e6)

7 years agokgv1dec: Increase offsets array size so it is large enough.
Michael Niedermayer [Wed, 25 Jan 2012 22:23:35 +0000 (23:23 +0100)]
kgv1dec: Increase offsets array size so it is large enough.

Fixes CVE-2011-3945

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 807a045ab7f51993a2c1b3116016cbbd4f3d20d6)

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit a02e8df973f5478ec82f4c507f5b5b191a5ecb6b)

7 years agokmvc: Check palsize.
Alex Converse [Thu, 26 Jan 2012 16:30:49 +0000 (17:30 +0100)]
kmvc: Check palsize.

Fixes: CVE-2011-3952

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Based on fix by Michael Niedermayer
(cherry picked from commit 386741f887714d3e46c9e8fe577e326a7964037b)

7 years agonsvdec: Propagate errors
Alex Converse [Fri, 27 Jan 2012 01:23:09 +0000 (17:23 -0800)]
nsvdec: Propagate errors

Related to CVE-2011-3940.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit c898431ca5ef2a997fe9388b650f658fb60783e5)

Conflicts:

libavformat/nsvdec.c

7 years agonsvdec: Be more careful with av_malloc().
Alex Converse [Fri, 27 Jan 2012 01:21:46 +0000 (17:21 -0800)]
nsvdec: Be more careful with av_malloc().

Check results for av_malloc() and fix an overflow in one call.

Related to CVE-2011-3940.

Based in part on work from Michael Niedermayer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a)

7 years agonsvdec: Fix use of uninitialized streams.
Michael Niedermayer [Tue, 24 Jan 2012 21:20:26 +0000 (22:20 +0100)]
nsvdec: Fix use of uninitialized streams.

Fixes CVE-2011-3940 (Out of bounds read resulting in out of bounds write)

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c011706bc752d34bc6ada31d7df2ca0c9af7c6b)

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 6a89b41d9780325ba6d89a37f2aeb925aa68e6a3)

7 years agog722: Fix the QMF scaling
Martin Storsjö [Fri, 2 Mar 2012 15:03:06 +0000 (17:03 +0200)]
g722: Fix the QMF scaling

This fixes clipping if the encoder input used the full 16 bit
input range (samples with a magnitude below 16383 worked fine).
The filtered subband samples should be 15 bit maximum, while
the code earlier produced them scaled to 16 bit.

This makes the decoder output have double the magnitude
compared to before.

The spec reference samples doesn't test the QMF at all, which
was why this part slipped past initially.

(cherry picked from commit b087ce2bee81db8cc5caffb8f0a4f6c7c92a30fe)

Signed-off-by: Martin Storsjö <martin@martin.st>
7 years agoac3dsp: do not use pshufb in ac3_extract_exponents_ssse3()
Justin Ruggles [Thu, 9 Feb 2012 18:00:30 +0000 (13:00 -0500)]
ac3dsp: do not use pshufb in ac3_extract_exponents_ssse3()

We need to do unsigned saturation in order to cover the corner case when the
absolute coefficient value is 16777215 (the maximum value).

Fixes Bug #216
(cherry picked from commit d483bb58c318b0a6152709cf28263d72200b98f9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoFix format string vulnerability detected by -Wformat-security.
Fabian Greffrath [Mon, 5 Mar 2012 15:06:01 +0000 (16:06 +0100)]
Fix format string vulnerability detected by -Wformat-security.

Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit c9dbac36ad4bac07f6c1d06d465e361ab55bcb95)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoh264: fix mmxext chroma deblock to use correct TC values.
Ronald S. Bultje [Sun, 26 Feb 2012 16:57:14 +0000 (08:57 -0800)]
h264: fix mmxext chroma deblock to use correct TC values.
(cherry picked from commit b0c4f04338234ee011d7b704621347ef232294fe)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoh264: change underread for 10bit QPEL to overread.
Ronald S. Bultje [Sun, 26 Feb 2012 01:24:56 +0000 (17:24 -0800)]
h264: change underread for 10bit QPEL to overread.

This prevents us from reading before the start of the buffer, and thus
prevents crashes resulting from this behaviour. Fixes bug 237.
(cherry picked from commit 291c9b62855d555ac5385e23219461b6080da7db)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agocscd: use negative error values to indicate decode_init() failures.
Ronald S. Bultje [Wed, 29 Feb 2012 21:55:09 +0000 (13:55 -0800)]
cscd: use negative error values to indicate decode_init() failures.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8a9faf33f2b4f40afbc3393b2be49867cea0c92d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoamrnbdec: check frame size before decoding.
Vitor Sessak [Wed, 29 Feb 2012 21:09:10 +0000 (22:09 +0100)]
amrnbdec: check frame size before decoding.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 882abda5a26ffb8e3d1c5852dfa7cdad0a291d2d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoh264: prevent overreads in intra PCM decoding.
Ronald S. Bultje [Wed, 29 Feb 2012 02:48:27 +0000 (18:48 -0800)]
h264: prevent overreads in intra PCM decoding.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d1604b3de96575195b219028e2c4f08b2259aa7d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmaenc: fix m/s stereo encoding for the first frame
Justin Ruggles [Fri, 2 Mar 2012 22:11:25 +0000 (17:11 -0500)]
wmaenc: fix m/s stereo encoding for the first frame

We need to set ms_stereo in encode_init() in order to avoid incorrectly
encoding the first frame as non-m/s while flagging it as m/s. Fixes an
uncomfortable pop in the left channel at the start of playback.

CC:libav-stable@libav.org
(cherry picked from commit 51ddf35c9017018e58c15275ff5b129647a0c94d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmaenc: limit allowed sample rate to 48kHz
Justin Ruggles [Fri, 2 Mar 2012 21:27:57 +0000 (16:27 -0500)]
wmaenc: limit allowed sample rate to 48kHz

ff_wma_init() allows up to 50kHz, but this generates an exponent band
size table that requires 65 bands. The code assumes 25 bands in many
places, and using sample rates higher than 48kHz will lead to buffer
overwrites.

CC:libav-stable@libav.org
(cherry picked from commit 1ec075cfecac01f9a289965db06f76365b0b1737)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmaenc: limit block_align to MAX_CODED_SUPERFRAME_SIZE
Justin Ruggles [Fri, 2 Mar 2012 21:10:00 +0000 (16:10 -0500)]
wmaenc: limit block_align to MAX_CODED_SUPERFRAME_SIZE

This is near the theoretical limit for wma frame size and is the most that
our decoder can handle. Allowing higher bit rates will just end up padding
each frame with empty bytes.

Fixes invalid writes for avconv when using very high bit rates.

CC:libav-stable@libav.org
(cherry picked from commit c2b8dea1828f35c808adcf12615893d5c740bc0a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmaenc: require a large enough output buffer to prevent overwrites
Justin Ruggles [Fri, 2 Mar 2012 21:33:33 +0000 (16:33 -0500)]
wmaenc: require a large enough output buffer to prevent overwrites

The maximum theoretical frame size is around 17000 bytes. Although in
practice it will generally be much smaller, we require a larger buffer
just to be safe.

CC: libav-stable@libav.org
(cherry picked from commit dfc4fdedf8cfc56a505579b1f2c1c5efbce4b97e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agompegts: Do not call read_sl_header() when no bytes remain in the buffer.
Alex Converse [Fri, 2 Mar 2012 18:12:11 +0000 (10:12 -0800)]
mpegts: Do not call read_sl_header() when no bytes remain in the buffer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 4df369692ea8aee7094ac0f233cef8d1bee139a3)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agompegts: Pad the packet buffer in handle_packet().
Alex Converse [Fri, 2 Mar 2012 18:13:07 +0000 (10:13 -0800)]
mpegts: Pad the packet buffer in handle_packet().

This allows it to be used with get_bits without the thread of overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 1aa708988ac131cf7d5c8bd59aca256a7c974df9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoamrwb: remove duplicate arguments from extrapolate_isf().
Ronald S. Bultje [Thu, 1 Mar 2012 23:44:25 +0000 (15:44 -0800)]
amrwb: remove duplicate arguments from extrapolate_isf().

Prevents warnings because the dst and src overlap (are the same) in the
memcpy() inside the function.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9d87374ec0f382c8394ad511243db6980afa42af)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoamrwb: error out early if mode is invalid.
Ronald S. Bultje [Thu, 1 Mar 2012 21:51:21 +0000 (13:51 -0800)]
amrwb: error out early if mode is invalid.

Prevents using the invalid mode as an index in a static array, which
would generate invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 154b8bb80029e71d562e8936164266300dd35a0e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agomatroska: check buffer size for RM-style byte reordering.
Ronald S. Bultje [Fri, 2 Mar 2012 01:01:22 +0000 (17:01 -0800)]
matroska: check buffer size for RM-style byte reordering.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9c239f6026a170866a4a0c96908980ac2cfaa8b3)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowma: fix invalid buffer size assumptions causing random overreads.
Ronald S. Bultje [Fri, 2 Mar 2012 00:19:51 +0000 (16:19 -0800)]
wma: fix invalid buffer size assumptions causing random overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 349b7977e408f18cff01ab31dfa66c8249b6584a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmadec: Verify bitstream size makes sense before calling init_get_bits.
Alex Converse [Fri, 27 Jan 2012 22:24:07 +0000 (14:24 -0800)]
wmadec: Verify bitstream size makes sense before calling init_get_bits.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 48f1e5212c90b511c90fa0449655abb06a9edda2)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agorv10/20: Fix a buffer overread caused by losing track of the remaining buffer size.
Alex Converse [Thu, 1 Mar 2012 22:07:22 +0000 (14:07 -0800)]
rv10/20: Fix a buffer overread caused by losing track of the remaining buffer size.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2f6528537fdd88820f3a4683d5e595d7b3a62689)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agolcl: return negative error codes on decode_init() errors.
Ronald S. Bultje [Thu, 1 Mar 2012 01:50:28 +0000 (17:50 -0800)]
lcl: return negative error codes on decode_init() errors.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit bd17a40a7e0eba21b5d27c67aff795e2910766e4)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoavutil: add AVERROR_UNKNOWN
Justin Ruggles [Sat, 25 Feb 2012 04:27:14 +0000 (23:27 -0500)]
avutil: add AVERROR_UNKNOWN

Useful to return instead of -1 when the cause of the error is unknown,
typically from an external library.
(cherry picked from commit c9bca801324f03746757aef8549ebd26599adec2)

Conflicts:

doc/APIchanges
libavutil/avutil.h

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoh264: error out on invalid bitdepth.
Ronald S. Bultje [Thu, 1 Mar 2012 19:56:05 +0000 (11:56 -0800)]
h264: error out on invalid bitdepth.

Fixes invalid reads while initializing the dequant tables, which uses
the bit depth to determine the QP table size.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 0ce4fe482c27abfa7eac503a52fdc50b70ccd871)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agohuffyuv: do not abort on unknown pix_fmt; instead, return an error.
Ronald S. Bultje [Thu, 1 Mar 2012 17:41:22 +0000 (09:41 -0800)]
huffyuv: do not abort on unknown pix_fmt; instead, return an error.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 63c9de6469005974288f4e4d89fc79a590e38c06)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agovmnc: return error on decode_init() failure.
Ronald S. Bultje [Wed, 29 Feb 2012 03:00:48 +0000 (19:00 -0800)]
vmnc: return error on decode_init() failure.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 07a180972fb369bb59bf6d4f8edb4598c51e80d2)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agorpza: error out on buffer overreads.
Ronald S. Bultje [Wed, 29 Feb 2012 01:04:33 +0000 (17:04 -0800)]
rpza: error out on buffer overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 78e9852a2e3b198ecd69ffa0deab3fa22a8e5378)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoqtrle: return error on decode_init() failure.
Ronald S. Bultje [Wed, 29 Feb 2012 03:00:39 +0000 (19:00 -0800)]
qtrle: return error on decode_init() failure.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e54ae60e46f737b8e9a96548971091f7ab6b8f7c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoswscale: fix another integer overflow.
Ronald S. Bultje [Wed, 29 Feb 2012 02:21:31 +0000 (18:21 -0800)]
swscale: fix another integer overflow.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 791de61bbb0d2bceb1037597b310e2a4a94494fd)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agovp56: error out on invalid stream dimensions.
Ronald S. Bultje [Thu, 23 Feb 2012 19:19:33 +0000 (11:19 -0800)]
vp56: error out on invalid stream dimensions.

Prevents crashes when playing corrupt vp5/6 streams.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8bc396fc0e8769a056375c1c211f389ce0e3ecc5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoasf: don't seek back on EOF.
Ronald S. Bultje [Wed, 29 Feb 2012 00:13:46 +0000 (16:13 -0800)]
asf: don't seek back on EOF.

Seeking back on EOF will reset the EOF flag, causing us to re-enter
the loop to find the next marker in the ASF file, thus potentially
causing an infinite loop.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit bb6d5411e1e1a8e0608b1af1c4addee654dcbac5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoasf: error out on ridiculously large minpktsize values.
Ronald S. Bultje [Fri, 17 Feb 2012 20:21:22 +0000 (12:21 -0800)]
asf: error out on ridiculously large minpktsize values.

They cause various issues further down in demuxing.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6e57a02b9f639af53acfa9fc742c1341400818f8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agolavf: add functions for accessing the fourcc<->CodecID mapping tables.
Anton Khirnov [Fri, 27 Jan 2012 12:33:09 +0000 (13:33 +0100)]
lavf: add functions for accessing the fourcc<->CodecID mapping tables.

Fixes bug 212.
(cherry picked from commit dd6d3b0e025cb2a16022665dbb8ab1be18dc05e8)

Conflicts:

doc/APIchanges

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoavutil: make intfloat api public
Paul B Mahol [Sun, 29 Jan 2012 20:09:22 +0000 (20:09 +0000)]
avutil: make intfloat api public

The functions are already av_ prefixed and intfloat header is already provided.
Install libavutil/intfloat.h

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 8b933129b932f523a746e921a0a20b8dd8816971)

Conflicts:

doc/APIchanges

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agomjpegbdec: Fix overflow in SOS.
Alex Converse [Wed, 25 Jan 2012 21:39:24 +0000 (13:39 -0800)]
mjpegbdec: Fix overflow in SOS.

Based in part by a fix from Michael Niedermayer <michaelni@gmx.at>

Fixes CVE-2011-3947

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit b57d262412204e54a7ef8fa1b23ff4dcede622e5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agooma: don't read beyond end of leaf_table.
Ronald S. Bultje [Tue, 28 Feb 2012 19:35:36 +0000 (11:35 -0800)]
oma: don't read beyond end of leaf_table.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 934cd18a43151ba4b819d9270d539cdb26f6e079)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoIndeo3: fix crashes on corrupt bitstreams.
Ronald S. Bultje [Tue, 28 Feb 2012 18:22:28 +0000 (10:22 -0800)]
Indeo3: fix crashes on corrupt bitstreams.

Splits at borders of cells are invalid, since it leaves one of the
cells with a width/height of zero. Also, propagate errors on buffer
allocation failures, so we don't continue decoding (which crashes).

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit fc9bc08dca9ac32526251e19fcf738d23b8c68d1)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agovorbis: fix overflows in floor1[] vector and inverse db table index.
Ronald S. Bultje [Wed, 11 Jan 2012 01:01:26 +0000 (17:01 -0800)]
vorbis: fix overflows in floor1[] vector and inverse db table index.

(cherry picked from commit 24947d4988012f1f0fd467c83418615adc11c3e8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoFix parser not to clobber has_b_frames when extradata is set.
Reinhard Tartler [Sun, 26 Feb 2012 09:50:45 +0000 (10:50 +0100)]
Fix parser not to clobber has_b_frames when extradata is set.

Because in contrast to the decoder, the parser does not setup low_delay.
The code in parse_nal_units would always end up setting has_b_frames
to "1", except when stream is explicitly marked as low delay.
Since the parser itself would create 'extradata', simply reopening
the parser would cause this.

This happens for instance in estimate_timings_from_pts(), which causes the
parser to be reopened on the same stream.

This fixes Libav #22 and FFmpeg (trac) #360

CC: libav-stable@libav.org
Based on a patch by Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(commit 31ac0ac29b6bba744493f7d1040757a3f51b9ad7)

Comments and description adapted by Reinhard Tartler.

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 790a367d9ecd04360f78616765ee723f3fe65645)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agorm: prevent infinite loops for index parsing.
Ronald S. Bultje [Wed, 22 Feb 2012 19:33:24 +0000 (11:33 -0800)]
rm: prevent infinite loops for index parsing.

Specifically, prevent jumping back in the file for the next index, since
this can lead to infinite loops where we jump between indexes referring
to each other, and don't read indexes that don't fit in the file.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit aac07a7a4c2c7a4a29cf6dbc88c1b9fdd191b99d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agofraps: release reference buffer on pix_fmt change.
Ronald S. Bultje [Fri, 24 Feb 2012 22:11:04 +0000 (14:11 -0800)]
fraps: release reference buffer on pix_fmt change.

Prevents crash when trying to copy from a non-existing plane in e.g.
a RGB32 reference image to a YUV420P target image

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 830f70442a87a31f7c75565e9380e3caf8333b8a)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agokgv1: release reference picture on size change.
Ronald S. Bultje [Sat, 25 Feb 2012 00:27:53 +0000 (16:27 -0800)]
kgv1: release reference picture on size change.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6c4c27adb61b2881a94ce5c7d97ee1c8adadb5fe)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agokgv1: use avctx->get/release_buffer().
Ronald S. Bultje [Thu, 29 Dec 2011 17:07:32 +0000 (09:07 -0800)]
kgv1: use avctx->get/release_buffer().

Also fixes crashes on corrupt bitstreams.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 33cd32b389864f2437c94e6fd7dc109ff5f0ed06)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agolcl: error out if uncompressed input buffer is smaller than framesize.
Ronald S. Bultje [Fri, 24 Feb 2012 00:09:36 +0000 (16:09 -0800)]
lcl: error out if uncompressed input buffer is smaller than framesize.

This prevents crashes when trying to read beyond the end of the buffer
while decoding frame data.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit be129271eac04f91393bf42a490ec631e1a9abea)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agomjpeg: abort decoding if packet is too large.
Ronald S. Bultje [Thu, 23 Feb 2012 20:22:40 +0000 (12:22 -0800)]
mjpeg: abort decoding if packet is too large.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit ab492ca2ab105aeb24d955f3f03756bdb3139ee1)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agotiff: Prevent overreads in the type_sizes array.
Alex Converse [Thu, 23 Feb 2012 18:47:50 +0000 (10:47 -0800)]
tiff: Prevent overreads in the type_sizes array.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 447363870f2f91e125e07ac2d0820359a5d86b06)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoswf: check return values for av_get/new_packet().
Ronald S. Bultje [Thu, 23 Feb 2012 19:53:27 +0000 (11:53 -0800)]
swf: check return values for av_get/new_packet().

Prevents crashers when using the packet if allocation failed.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 31632e73f47d25e2077fce729571259ee6354854)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agotruemotion2: error out if the huffman tree has no nodes.
Ronald S. Bultje [Wed, 22 Feb 2012 20:19:52 +0000 (12:19 -0800)]
truemotion2: error out if the huffman tree has no nodes.

This prevents crashers and errors further down when reading nodes in the
empty tree.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2b83e8b7005d531bc78b0fd4f699e9faa54ce9bb)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agormdec: when using INT4 deinterleaving, error out if sub_packet_h <= 1.
Ronald S. Bultje [Tue, 21 Feb 2012 18:36:27 +0000 (10:36 -0800)]
rmdec: when using INT4 deinterleaving, error out if sub_packet_h <= 1.

We read sub_packet_h / 2 packets per line of data (during deinterleaving),
which equals zero if sub_packet_h <= 1, thus causing us to not read any
data, leading to an infinite loop.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e30b3e59a4f3004337cb1623b2aac988ce52b93f)

Signed-off-by: Anton Khirnov <anton@khirnov.net>