ffmpeg.git
3 years agoavcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()
Michael Niedermayer [Fri, 27 Nov 2015 19:52:39 +0000 (20:52 +0100)]
avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()

Fixes out of array access
Fixes: 01859c9a9ac6cd60a008274123275574/asan_heap-oob_1dff571_8250_50d3d1611e294c3519fd1fa82198b69b.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75422280fbcdfbe9dc56bde5525b4d8b280f1bc5)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/hevc: Check entry_point_offsets
Michael Niedermayer [Fri, 27 Nov 2015 17:30:05 +0000 (18:30 +0100)]
avcodec/hevc: Check entry_point_offsets

Fixes out of array read
Fixes: 007c4a36608ebdf27ee260ad60a81184/asan_heap-oob_32076b4_2243_116b1cb29d91cc4974d6680e3d10bd91.bit

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef9f7bbfa47317f9d46bf46982a394d2be78503c)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agolavf/rtpenc_jpeg: Less strict check for standard Huffman tables.
Carl Eugen Hoyos [Wed, 2 Dec 2015 13:56:53 +0000 (14:56 +0100)]
lavf/rtpenc_jpeg: Less strict check for standard Huffman tables.

There can be one or more Huffman table segments DHT.

Reported-by: Andrey Utkin
3 years agoavcodec/ffv1dec: Clear quant_table_count if its invalid
Michael Niedermayer [Sat, 14 Nov 2015 12:21:58 +0000 (13:21 +0100)]
avcodec/ffv1dec: Clear quant_table_count if its invalid

Fixes deallocation of corrupted pointer
Fixes: 343dfbe142a38b521ed069dc4ea7c03b/signal_sigsegv_421427_4074_ffb11959610278cd40dbc153464aa254.avi
No releases affected

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e04126072e984f8db5db9da9303c89ae01f7d6bb)

Fixes ticket #5052.

3 years agoavcodec/ffv1dec: Print an error if the quant table count is invalid
Michael Niedermayer [Thu, 5 Nov 2015 00:25:50 +0000 (01:25 +0100)]
avcodec/ffv1dec: Print an error if the quant table count is invalid

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a8b254e436dce2f5c8c6459108dab4b02cc6b79b)

3 years agodoc/filters/drawtext: fix centering example
Andrey Utkin [Tue, 1 Dec 2015 19:15:53 +0000 (21:15 +0200)]
doc/filters/drawtext: fix centering example

Signed-off-by: Andrey Utkin <andrey.od.utkin@gmail.com>
Signed-off-by: Lou Logan <lou@lrcd.com>
(cherry picked from commit 648b26acc5e25ab40c43fddc54b50e9f0b13ebd8)
Signed-off-by: Timothy Gu <timothygu99@gmail.com>
3 years agoavutil/softfloat: use abort() instead of av_assert0(0) n2.8.3
James Almer [Tue, 10 Nov 2015 02:16:17 +0000 (23:16 -0300)]
avutil/softfloat: use abort() instead of av_assert0(0)

Fixes compilation of host tool aacps_fixed_tablegen.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 9f4a41bf991916e105be9d78ed38612d3ffa4881)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoUpdate for 2.8.3
Michael Niedermayer [Fri, 27 Nov 2015 13:29:04 +0000 (14:29 +0100)]
Update for 2.8.3

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/cabac: Check initial cabac decoder state
Michael Niedermayer [Fri, 27 Nov 2015 12:37:50 +0000 (13:37 +0100)]
avcodec/cabac: Check initial cabac decoder state

Fixes integer overflows
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2340_591e9810c7b09efe501ad84638c9e9f8.264

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Found-by: xiedingbao (Ticket4727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8000d484b83aafa752d84fbdbfb352ffe0dc64f8)

Conflicts:

libavcodec/cabac.h

3 years agoavcodec/cabac_functions: Fix "left shift of negative value -31767"
Michael Niedermayer [Fri, 27 Nov 2015 11:11:29 +0000 (12:11 +0100)]
avcodec/cabac_functions: Fix "left shift of negative value -31767"

Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2340_591e9810c7b09efe501ad84638c9e9f8.264

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Found-by: xiedingbao (Ticket4727)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1f6b05f5228979dab0e149deca7a30d22e98af5)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/h264_slice: Limit max_contexts when slice_context_count is initialized
Michael Niedermayer [Tue, 24 Nov 2015 21:12:37 +0000 (22:12 +0100)]
avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized

Fixes out of array access
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2049_f2192b6829ab6e0eefcb035329c03c60.264

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4ea4d2f438c9a7eba37980c9a87be4b34943e4d5)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agortmpcrypt: Do the xtea decryption in little endian mode
Martin Storsjö [Wed, 11 Nov 2015 19:42:02 +0000 (21:42 +0200)]
rtmpcrypt: Do the xtea decryption in little endian mode

The XTEA algorithm operates on 32 bit numbers, not on byte sequences.
The XTEA implementation in libavutil is written assuming big endian
numbers, while the rtmpe signature encryption assumes little endian.

This fixes rtmpe communication with rtmpe servers that use signature
type 8 (XTEA), e.g. crunchyroll.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e7728319b92dbb4fb949155e33de7ff5358ddff3)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavformat/matroskadec: Check subtitle stream before dereferencing
Michael Niedermayer [Tue, 17 Nov 2015 17:19:01 +0000 (18:19 +0100)]
avformat/matroskadec: Check subtitle stream before dereferencing

Unrecognized streams are not allocated
Fixes: flicker-1.color1.vp91447030769.08.webm

Found-by: Chris Cunningham <chcunningham@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a5034b324cad4c29d47ef285a30b0705e6eb0384)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/pngdec: Replace assert by request for sample for unsupported TRNS cases
Michael Niedermayer [Mon, 16 Nov 2015 17:34:44 +0000 (18:34 +0100)]
avcodec/pngdec: Replace assert by request for sample for unsupported TRNS cases

Fixes assertion failure
Fixes: 7f646252a30ee28b583aac1f82e7985e/signal_sigabrt_7ffff6ae7cc9_7353_62fc077bf2f454d39e188c69807193a6.png

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a62178be80dd6a643973f62002fc0ed42495c358)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavformat/utils: Do not init parser if probing is unfinished
Michael Niedermayer [Sun, 15 Nov 2015 22:41:14 +0000 (23:41 +0100)]
avformat/utils: Do not init parser if probing is unfinished

Fixes assertion failure
Fixes: 136f8b8d47af7892306625e597dee655/signal_sigabrt_7ffff6ae7cc9_8941_ab11bea57c84796418f481f873dc31ba.dvr_ms

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1ef336e912a7a3a13a9933825a56c421f891e44b)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/jpeg2000dec: Fix potential integer overflow with tile dimensions
Michael Niedermayer [Sun, 15 Nov 2015 20:17:05 +0000 (21:17 +0100)]
avcodec/jpeg2000dec: Fix potential integer overflow with tile dimensions

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 65d3359fb366ea265a8468d76a111cb7352f0b55)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/jpeg2000: Use av_image_check_size() in ff_jpeg2000_init_component()
Michael Niedermayer [Sun, 15 Nov 2015 19:03:39 +0000 (20:03 +0100)]
avcodec/jpeg2000: Use av_image_check_size() in ff_jpeg2000_init_component()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 016fd413f9168816924f21c0c1ffb578f7226221)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/wmaprodec: Check for overread in decode_packet()
Michael Niedermayer [Sun, 15 Nov 2015 17:18:40 +0000 (18:18 +0100)]
avcodec/wmaprodec: Check for overread in decode_packet()

Fixes assertion failure
Fixes: 0256e92df2df7e933b43a2c70e4c8040/signal_sigabrt_7ffff6ae7cc9_1358_999ac18684788221490757582ce9af84.wma

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ad698e24e6b9dde57c4e01c145bcddfe9d6e4a3)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/smacker: Check that the data size is a multiple of a sample vector
Michael Niedermayer [Sun, 15 Nov 2015 13:52:08 +0000 (14:52 +0100)]
avcodec/smacker: Check that the data size is a multiple of a sample vector

Fixes out of array access
Fixes: ce19e41f0ef1e52a23edc488faecdb58/asan_heap-oob_2504e97_4202_ffa0df1baed14022b9bfd4f8ac23d0cb.smk

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4a9af07a49295e014b059c1ab624c40345af5892)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/takdec: Skip last p2 sample (which is unused)
Michael Niedermayer [Sun, 15 Nov 2015 00:22:31 +0000 (01:22 +0100)]
avcodec/takdec: Skip last p2 sample (which is unused)

Fixes out of array read
Fixes: cb3f38b08b4541523974667c7d1eee9e/asan_heap-oob_2659e18_9838_021fd5cd635bf76cede6398cd9ecbcdd.tak

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 08b520636e96ba6888b669b9b3f4c414631ea1d2)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/dxtory: Fix input size check in dxtory_decode_v1_410()
Michael Niedermayer [Sat, 14 Nov 2015 23:25:11 +0000 (00:25 +0100)]
avcodec/dxtory: Fix input size check in dxtory_decode_v1_410()

Fixes potential out of array read

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 76b6f4b7d91901929177cc61d9810dcca0bb40c1)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/dxtory: Fix input size check in dxtory_decode_v1_420()
Michael Niedermayer [Sat, 14 Nov 2015 23:25:11 +0000 (00:25 +0100)]
avcodec/dxtory: Fix input size check in dxtory_decode_v1_420()

Fixes out of array read
Fixes: c50c4aa6cefda71b19a31ea12302980c/asan_heap-oob_12be5fd_7011_33ebd015a74976215934add72b9c8352.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9caa9414ccf2dcf8aee2695377dee830a5024c82)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/error_resilience: avoid accessing previous or next frames tables beyond height
Michael Niedermayer [Sat, 14 Nov 2015 20:11:52 +0000 (21:11 +0100)]
avcodec/error_resilience: avoid accessing previous or next frames tables beyond height

The height of tables can be rounded up for MBAFF but this does not imply that is also true
for the previous frames

Fixes out of array reads
Fixes: c106b36fa36db8ff8f3ed0c82be7bea2/asan_heap-oob_32699f0_6321_467b9a1d7e03d7cfd310b7e65dc53bcc.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a105f52855d08e4ab1ed7306da8e32fc90d6d647)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/dpx: Move need_align to act per line
Michael Niedermayer [Sat, 14 Nov 2015 13:29:02 +0000 (14:29 +0100)]
avcodec/dpx: Move need_align to act per line

Fixes out of array read
Fixes: 61cf123c081ee2bb774d307c75bdb99e/asan_heap-oob_1224f76_5546_bee833ffae73f752b489b9eeaac52db7.dpx

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8aaae8e0f1519bc99bd717ea3067c9cfdb68def)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/flashsv: Check size before updating it
Michael Niedermayer [Sat, 14 Nov 2015 12:34:02 +0000 (13:34 +0100)]
avcodec/flashsv: Check size before updating it

Fixes out of array read
Fixes: 3c857d4d90365731524716e6d051e43a/signal_sigsegv_7f4f59bcc29e_1386_20abd2c8e655cb9c75b24368e65fe3b1.flv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 17705f5d4f57c15f9b9bb9cfcbbb4621fed2fc70)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/ivi: Check image dimensions
Michael Niedermayer [Sat, 14 Nov 2015 01:36:22 +0000 (02:36 +0100)]
avcodec/ivi: Check image dimensions

Fixes integer overflow
Fixes: 1e32c6c591d940337c20b197ec1c4d3d/asan_heap-oob_4a52e5_8946_0bb0d9e863def56005e49f1d89bdc94d.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df91aa034b82b77a3c4e01791f4a2b2ff6c82066)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/utils: Better check for channels in av_get_audio_frame_duration()
Michael Niedermayer [Sat, 14 Nov 2015 00:35:08 +0000 (01:35 +0100)]
avcodec/utils: Better check for channels in av_get_audio_frame_duration()

Fixes integer overflow
Fixes: 0c2625f236ced104d402b4a03c0d65c7/asan_generic_274e1ce_5990_9314e7a67c26aecf011b178ade9f217c.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4e16ad2868a1819de6680fc355a8eb20164adaea)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/jpeg2000dec: Check for duplicate SIZ marker
Michael Niedermayer [Fri, 13 Nov 2015 23:51:56 +0000 (00:51 +0100)]
avcodec/jpeg2000dec: Check for duplicate SIZ marker

Fixes: 0231a17345734228011c6f35a64e4594/asan_heap-oob_1d92a72_3218_1213809a9e3affec77e4c191fdfdc0a9.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 44a7f17d0b20e6f8d836b2957e3e357b639f19a2)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoaacsbr: don't call sbr_dequant twice without intermediate read_sbr_data
Andreas Cadhalpun [Fri, 20 Nov 2015 19:15:21 +0000 (20:15 +0100)]
aacsbr: don't call sbr_dequant twice without intermediate read_sbr_data

Doing that doesn't make sense, because the only purpose of sbr_dequant
is to process the data from read_sbr_data.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1c3e43a6273822e1369818b80f34c8464e1009d5)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agohqx: correct type and size check of info_offset
Andreas Cadhalpun [Sun, 15 Nov 2015 09:33:40 +0000 (10:33 +0100)]
hqx: correct type and size check of info_offset

It is used as size argument of ff_canopus_parse_info_tag, which uses it
as size argument to bytestream2_init, which only supports sizes up to
INT_MAX.
Changing it's type to unsigned simplifies the check.

Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1ed7fcd42af956979abf4e32cd3c9ee17622bbcb)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agomxfdec: check edit_rate also for physical_track
Andreas Cadhalpun [Sun, 15 Nov 2015 16:46:08 +0000 (17:46 +0100)]
mxfdec: check edit_rate also for physical_track

Previously only the edit_rate of material_track was checked.
If it's negative, it causes assertion failures in av_rescale_rnd.

Reviewed-by: Tim Nicholson <nichot20-at-yahoo.com@ffmpeg.org>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 047bf82c181c1220b3087b37f28445f8b87a7a23)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agoavcodec/jpeg2000: Change coord to 32bit to support larger than 32k width or height
Michael Niedermayer [Sun, 15 Nov 2015 21:05:04 +0000 (22:05 +0100)]
avcodec/jpeg2000: Change coord to 32bit to support larger than 32k width or height

Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0eb7de19736891a9386ab66549f780e904a3b6a7)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agoavcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range
Michael Niedermayer [Sun, 15 Nov 2015 20:12:50 +0000 (21:12 +0100)]
avcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range

Fixes potential integer overflows
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi

This fix is choosen to be simple to backport, better solution
for master is planed

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6ef819c40bcc2175edba7ce9e20c3036c01b36b9)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agoavcodec/jpeg2000: Check comp coords to be within the supported size
Michael Niedermayer [Sun, 15 Nov 2015 19:49:17 +0000 (20:49 +0100)]
avcodec/jpeg2000: Check comp coords to be within the supported size

Fixes assertion failure
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi

This fix is choosen to be simple to backport, better solution
for master is planed

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1a8cbcb35ef2759a66b4f0875785e4b3f277057)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agompegvideo: clear overread in clear_context
Andreas Cadhalpun [Sat, 14 Nov 2015 21:46:46 +0000 (22:46 +0100)]
mpegvideo: clear overread in clear_context

Otherwise the h263p decoder can try to copy overread bytes, even though
buffer is NULL.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 6a69a175e7b5c5393528ed0f5753e41573fa0df2)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agoavcodec/avrndec: Use the AVFrame format instead of the context
Michael Niedermayer [Sat, 14 Nov 2015 12:04:54 +0000 (13:04 +0100)]
avcodec/avrndec: Use the AVFrame format instead of the context

Fixes out of array read
Fixes: 20dd01398dee0f6d83d7e5410a2ae8eb/signal_sigsegv_39eeb1f_4001_62efbdf1c60748dabf1ec310b59525fd.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ccba8aaff2ef5649495ae48bc5c90bd8ff32e6f3)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agodds: disable palette flag for compressed images
Andreas Cadhalpun [Fri, 13 Nov 2015 20:48:27 +0000 (21:48 +0100)]
dds: disable palette flag for compressed images

Having both is not valid and can cause a NULL pointer dereference of
frame->data[1] later.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
(cherry picked from commit 0a8bff788b0a9f96b863f0e836a235cb1d223f55)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agodds: validate compressed source buffer size
Andreas Cadhalpun [Tue, 10 Nov 2015 23:20:18 +0000 (00:20 +0100)]
dds: validate compressed source buffer size

A too small buffer will cause segfaults somewhere below
decompress_texture_thread.

Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 9a37d476440d9edaa26e6ed946d79cedde9d9e93)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agodds: validate source buffer size before copying
Andreas Cadhalpun [Tue, 10 Nov 2015 23:05:02 +0000 (00:05 +0100)]
dds: validate source buffer size before copying

If it is too small av_image_copy_plane segfaults.

Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1675809d2df76b1a185c78ca0a7a1c8ccb493167)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agodvdsubdec: validate offset2 similar to offset1
Andreas Cadhalpun [Tue, 10 Nov 2015 21:14:39 +0000 (22:14 +0100)]
dvdsubdec: validate offset2 similar to offset1

If it is negative, it causes segmentation faults in decode_rle.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit f621749d1181987b3f815c6766ea66d6c5d55198)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agobrstm: reject negative sample rate
Andreas Cadhalpun [Tue, 10 Nov 2015 19:10:23 +0000 (20:10 +0100)]
brstm: reject negative sample rate

A negative sample rate causes assertion failures in av_rescale_rnd.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 7b67fe20f6c5ce21ed1cac01fdb1906e515bc87e)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agoaacps: avoid division by zero in stereo_processing
Andreas Cadhalpun [Sun, 8 Nov 2015 21:04:08 +0000 (22:04 +0100)]
aacps: avoid division by zero in stereo_processing

This fixes a SIGFPE crash in the aac_fixed decoder.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
(cherry picked from commit ef7fe9851e0913a2e8d27d55bcb84847a6efa7ca)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agosoftfloat: assert when the argument of av_sqrt_sf is negative
Andreas Cadhalpun [Sun, 8 Nov 2015 14:15:24 +0000 (15:15 +0100)]
softfloat: assert when the argument of av_sqrt_sf is negative

The correct result can't be expressed in SoftFloat.
Currently it returns a random value from an out of bounds read.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit f3866a14c3c2949fad16267e9f2977ba9d7b5504)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agoavcodec/takdec: Use memove, avoid undefined memcpy() use
Michael Niedermayer [Sat, 7 Nov 2015 19:05:27 +0000 (20:05 +0100)]
avcodec/takdec: Use memove, avoid undefined memcpy() use

Fixes: e214333cbd94c91228e624ff39329ce6/asan_generic_4a5159_6412_96cda2530e80607210ab41ccae3d456d.tak

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cea3430a56fb0ff6ef60f08620fd3875e7bfeb6)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
3 years agoUpdate Changelog n2.8.2
Michael Niedermayer [Thu, 12 Nov 2015 00:04:05 +0000 (01:04 +0100)]
Update Changelog

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoaacsbr_fixed: check for envelope scalefactors overflowing
Andreas Cadhalpun [Mon, 9 Nov 2015 19:41:16 +0000 (20:41 +0100)]
aacsbr_fixed: check for envelope scalefactors overflowing

This prevents various values from getting an insanely huge exponent.
If someone knows a cleaner solution, thats welcome!

This is similar to commit 8978c74 for aacsbr.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 0e36a14a423b7cb32d54d1b621cc9136cccc3dc5)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoaacdec: don't return frames without data from aac_decode_er_frame
Andreas Cadhalpun [Mon, 9 Nov 2015 21:16:01 +0000 (22:16 +0100)]
aacdec: don't return frames without data from aac_decode_er_frame

This is similar to commit ec38a1b for aac_decode_frame_int.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d7f29bfa6985e3eea2033dba0449e47b41b85928)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/aacsbr_fixed: Try to initialize sum[0..1] differently to fix build with VS2012
Michael Niedermayer [Tue, 10 Nov 2015 12:33:38 +0000 (13:33 +0100)]
avcodec/aacsbr_fixed: Try to initialize sum[0..1] differently to fix build with VS2012

Found-by: Hendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8a024f6a43444a73a3cd8d70abedde426b4e1986)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/aacsbr: Use FLOAT_0
Michael Niedermayer [Sun, 8 Nov 2015 10:05:48 +0000 (11:05 +0100)]
avcodec/aacsbr: Use FLOAT_0

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dcf1cf5d24c85d848eabac90720d7f77d594a88c)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agosoftfloat: handle INT_MIN correctly in av_int2sf
Andreas Cadhalpun [Sun, 8 Nov 2015 16:19:10 +0000 (17:19 +0100)]
softfloat: handle INT_MIN correctly in av_int2sf

Otherwise v=INT_MIN doesn't get normalized and thus triggers av_assert2
in other functions.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 9ac61e73d0843ec4b83f4e3d47eded73234e406e)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Include negative numbers in cmp/gt tests
Michael Niedermayer [Sun, 8 Nov 2015 14:04:05 +0000 (15:04 +0100)]
avutil/softfloat: Include negative numbers in cmp/gt tests

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 955cdc43a35a850afe36537c2d8739c1991ac7ec)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Fix av_gt_sf() with large exponents try #2
Michael Niedermayer [Sun, 8 Nov 2015 14:03:28 +0000 (15:03 +0100)]
avutil/softfloat: Fix av_gt_sf() with large exponents try #2

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 05b05a7a841c0c67cce319941104d6f11b9ecd84)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Add test for av_gt_sf()
Michael Niedermayer [Sun, 8 Nov 2015 14:02:05 +0000 (15:02 +0100)]
avutil/softfloat: Add test for av_gt_sf()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 791ea23e57f134559ba66fd8f1664346abbc9314)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Extend the av_cmp_sf() test to cover a wider range of exponents
Michael Niedermayer [Sun, 8 Nov 2015 13:45:19 +0000 (14:45 +0100)]
avutil/softfloat: Extend the av_cmp_sf() test to cover a wider range of exponents

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ecfb076141d0243212143f0d7c9d4e47b56bec15)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Fix overflows in shifts in av_cmp_sf() and av_gt_sf()
Michael Niedermayer [Sun, 8 Nov 2015 13:13:42 +0000 (14:13 +0100)]
avutil/softfloat: Fix overflows in shifts in av_cmp_sf() and av_gt_sf()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cee3c9d29aceec8cddd829acd6dfb56dc5f60322)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Add test for av_cmp_sf()
Michael Niedermayer [Sun, 8 Nov 2015 13:39:46 +0000 (14:39 +0100)]
avutil/softfloat: Add test for av_cmp_sf()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df2a2117d280a1579500034a8a3c79dc64b90c78)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/common: add FFDIFFSIGN macro
Ganesh Ajjanagadde [Fri, 30 Oct 2015 18:21:15 +0000 (14:21 -0400)]
avutil/common: add FFDIFFSIGN macro

This is of use for defining comparator callbacks. Common approaches like
return x-y are not safe due to the risks of overflow.
Furthermore, the (x > y) - (x < y) trick is optimized to branchless
code.
This also documents this macro accordingly.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Ganesh Ajjanagadde <gajjanagadde@gmail.com>
(cherry picked from commit 265f83fd35977a80e93b3cc13ceb65f52f129a3c)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Add tests for exponent underflows
Michael Niedermayer [Sun, 8 Nov 2015 13:07:22 +0000 (14:07 +0100)]
avutil/softfloat: Add tests for exponent underflows

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 596dfe7d6c6bf355aca4eca0a2386f9c5679887d)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Fix exponent underflow in av_div_sf()
Michael Niedermayer [Sun, 8 Nov 2015 12:59:21 +0000 (13:59 +0100)]
avutil/softfloat: Fix exponent underflow in av_div_sf()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 046218b212a076b92ed88a280457db871dafd377)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Fix exponent underflow in av_mul_sf()
Michael Niedermayer [Sun, 8 Nov 2015 12:57:19 +0000 (13:57 +0100)]
avutil/softfloat: Fix exponent underflow in av_mul_sf()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a1e3303fc01b95623d7a6963686c81b076690efd)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Fix typo in av_mul_sf() doxy
Michael Niedermayer [Sun, 8 Nov 2015 12:54:15 +0000 (13:54 +0100)]
avutil/softfloat: Fix typo in av_mul_sf() doxy

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4135a2bfd6d0a835f57031de57ae42363d455574)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: Correctly set the exponent for 0.0 in av_sqrt_sf()
Michael Niedermayer [Sun, 8 Nov 2015 12:25:21 +0000 (13:25 +0100)]
avutil/softfloat: Correctly set the exponent for 0.0 in av_sqrt_sf()

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 107db5abf3211dc7579bbb67c1af5c25b0e280f6)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/softfloat: FLOAT_0 should use MIN_EXP
Michael Niedermayer [Sun, 8 Nov 2015 02:04:33 +0000 (03:04 +0100)]
avutil/softfloat: FLOAT_0 should use MIN_EXP

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a66b243d522344e12e3970e72e02183185a29ebe)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoswresample/resample: increase precision for compensation
Michael Niedermayer [Wed, 11 Nov 2015 15:49:21 +0000 (16:49 +0100)]
swresample/resample: increase precision for compensation

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 351e625d60165be67c362af6e96ead6c9262623f)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agolavf/mov: add support for sidx fragment indexes
Rodger Combs [Mon, 20 Jul 2015 20:00:35 +0000 (15:00 -0500)]
lavf/mov: add support for sidx fragment indexes

Fixes trac #3842
(cherry picked from commit 4ab56667594842283dc5ae07f0daba2a2cb4d3af)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoupdate versions for 2.8.2
Michael Niedermayer [Wed, 11 Nov 2015 01:46:19 +0000 (02:46 +0100)]
update versions for 2.8.2

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavformat/mxfenc: Only store user comment related tags when needed
Michael Niedermayer [Mon, 9 Nov 2015 13:24:26 +0000 (14:24 +0100)]
avformat/mxfenc: Only store user comment related tags when needed

Also support disabling them as they seem to cause problems to some
Users. They are also not allowed in IRT D-10 thus the default for
mxf_d10 is not to write them

This also decreases the filesize when no user comment are stored

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d9726893f311b7bbbc9887db2c3ffbefaad78ca3)

Conflicts:

libavformat/mxfenc.c

3 years agotests/fate/avformat: Fix fate-lavf
Michael Niedermayer [Tue, 10 Nov 2015 03:14:55 +0000 (04:14 +0100)]
tests/fate/avformat: Fix fate-lavf

The CMP variable seems to have been inherited from fate-api-seek which set it to null

the mxf reference needed a change due to c7e14a279fa7348db10ec824bb2d67858cb1c1ca

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b83c849e8797fbb972ebd7f2919e0f085061f37f)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agodoc/ffmpeg: Clarify that the sdp_file option requires an rtp output.
Simon Thelen [Mon, 2 Nov 2015 14:57:50 +0000 (15:57 +0100)]
doc/ffmpeg: Clarify that the sdp_file option requires an rtp output.

Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b02201efb531348406e48f9252bd39a6acebd2b7)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoffmpeg: Don't try and write sdp info if none of the outputs had an rtp format.
Simon Thelen [Mon, 2 Nov 2015 15:36:16 +0000 (16:36 +0100)]
ffmpeg: Don't try and write sdp info if none of the outputs had an rtp format.

Fixes a segfault when trying to write nonexistent rtp information.

Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 70fb5eadc580a82c4b977a1233d70ad0041faba0)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoapng: use correct size for output buffer
Andreas Cadhalpun [Fri, 6 Nov 2015 22:44:01 +0000 (23:44 +0100)]
apng: use correct size for output buffer

The buffer needs s->bpp bytes, at maximum currently 10.
Assert that s->bpp is not larger.

This fixes a stack buffer overflow.

Reviewed-by: wm4 <nfxjfg@googlemail.com>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 3e8e1a660ea182111057d56ec1cfad2c62250f4c)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agojvdec: avoid unsigned overflow in comparison
Andreas Cadhalpun [Fri, 6 Nov 2015 20:04:34 +0000 (21:04 +0100)]
jvdec: avoid unsigned overflow in comparison

The return type of strlen is size_t, i.e. unsigned, so if pd->buf_size
is 3, the right side overflows leading to a wrong result of the
comparison and subsequently a heap buffer overflow.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit db374790c75fa4ef947abcb5019fcf21d0b2de85)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/jpeg2000dec: Clip all tile coordinates
Michael Niedermayer [Sat, 7 Nov 2015 01:16:11 +0000 (02:16 +0100)]
avcodec/jpeg2000dec: Clip all tile coordinates

Fixes out of array access
Fixes: b877a6b788a25c70e8b1d014f8628549/asan_heap-oob_1da2c3f_2324_5a1b329b0b3c4bb6b1d775660ac56717.r3d

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 43492ff3ab68a343c1264801baa1d5a02de10167)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/microdvddec: Check for string end in 'P' case
Michael Niedermayer [Fri, 6 Nov 2015 21:24:23 +0000 (22:24 +0100)]
avcodec/microdvddec: Check for string end in 'P' case

Fixes out of array read
Fixes: a9502b60f4cecc19475382aee255f73c/asan_heap-oob_1e87fba_2548_a8ad47f6dde36644fe9cdc444d4632d0.sub

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c719cd6cf79ec21d974b81ba874580f4b8e9eb90)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/dirac_parser: Fix undefined memcpy() use
Michael Niedermayer [Fri, 6 Nov 2015 20:58:42 +0000 (21:58 +0100)]
avcodec/dirac_parser: Fix undefined memcpy() use

Fixes: 9d375e415486edd1a0c826f2307d89a4/asan_generic_4a5159_1577_faa333e83dacdd9e4dd322380aeed537.iss

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit daefd8ab2f2aeb90cd53cb75445faffdc7a3cc79)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavformat/xmv: Discard remainder of packet on error
Michael Niedermayer [Fri, 6 Nov 2015 01:13:36 +0000 (02:13 +0100)]
avformat/xmv: Discard remainder of packet on error

Fixes infinite loop
Fixes: 9c48ae2680c5f23bca3d20ff0f325fd8/asan_generic_4c254d_1374_993f1e5967dd6f844b8d72f978ce2a6c.pss

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79c4a338e4b2bf0bc6f81c9f455994f673a92f78)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavformat/xmv: factor return check out of if/else
Michael Niedermayer [Fri, 6 Nov 2015 01:11:01 +0000 (02:11 +0100)]
avformat/xmv: factor return check out of if/else

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9b6fac11da470274d4b93d46ef66527aa1824179)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/mpeg12dec: Do not call show_bits() with invalid bits
Michael Niedermayer [Thu, 5 Nov 2015 23:56:04 +0000 (00:56 +0100)]
avcodec/mpeg12dec: Do not call show_bits() with invalid bits

Fixes assertion failure
Fixes: 63e50545709a6440d3d59f6426d58db9/signal_sigabrt_7ffff6ae7cc9_8189_3272a3010fd98ddf947c662bbde1ac13.ts

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 973c3dba27d0b1a88c70f6661b6a90d2f2e50665)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/faxcompr: Add missing runs check in decode_uncompressed()
Michael Niedermayer [Thu, 5 Nov 2015 20:35:23 +0000 (21:35 +0100)]
avcodec/faxcompr: Add missing runs check in decode_uncompressed()

Fixes out of array access
Fixes: 54e488b9da4abbceaf405d6492515697/asan_heap-oob_32769b0_160_a8755eb08ee8f9579348501945a33955.TIF

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4a731b84a08f0f3839eaaaf82e97d8d9c67da46)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agolibavutil/channel_layout: Check strtol*() for failure
Michael Niedermayer [Thu, 5 Nov 2015 18:24:33 +0000 (19:24 +0100)]
libavutil/channel_layout: Check strtol*() for failure

Fixes assertion failure
Fixes: 4f5814bb15d2dda6fc18ef9791b13816/signal_sigabrt_7ffff6ae7cc9_65_7209d160d168b76f311be6cd64a548eb.wv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c9bfd6a8c35a2102e730aca12f6e09d1627f76b3)

Conflicts:

libavutil/channel_layout.c

3 years agoavformat/mpegts: Only start probing data streams within probe_packets
Michael Niedermayer [Thu, 5 Nov 2015 16:04:37 +0000 (17:04 +0100)]
avformat/mpegts: Only start probing data streams within probe_packets

Fixes assertion failure
Fixes: 4321db8ac331f5967ebfbfe80ce5eb78/signal_sigabrt_7ffff6ae7cc9_7213_0d6457b9d6897fa7c78507fa5de53510.ts

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3692d859f45fa8765fa5a330e79108b03c17c6bd)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/hevc_ps: Check chroma_format_idc
Michael Niedermayer [Thu, 5 Nov 2015 13:52:33 +0000 (14:52 +0100)]
avcodec/hevc_ps: Check chroma_format_idc

Fixes out of array access
Fixes: 24d05e8b84676799c735c9e27d97895e/asan_heap-oob_1b70f6a_2955_7c3652a7f370f9f3ef40642bc2c99bb2.bit

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93f30f825c08477fe8f76be00539e96014cc83c8)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/ffv1dec: Check for 0 quant tables
Michael Niedermayer [Wed, 4 Nov 2015 23:36:59 +0000 (00:36 +0100)]
avcodec/ffv1dec: Check for 0 quant tables

Fixes assertion failure
Fixes: 07ec1fc3c1cbf2d3edcd7d9b52ca156c/asan_heap-oob_13624c5_491_ecd4720a03e697ba750b235690656c8f.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5745cf799a4389bc5d14f2b4daf32fe4631c50bc)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/mjpegdec: Reinitialize IDCT on BPP changes
Michael Niedermayer [Wed, 4 Nov 2015 20:27:04 +0000 (21:27 +0100)]
avcodec/mjpegdec: Reinitialize IDCT on BPP changes

Fixes misaligned access
Fixes: dc9262a469f6f315f74c087a7b3a7f35/signal_sigsegv_2e95bcd_9_9c0f9f4a9ba82aa9b3ab2b91ce4d5277.jpg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc35f6f4768ffe57cc4fcfa56ecb89aee409e3d5)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it
Michael Niedermayer [Wed, 4 Nov 2015 17:08:52 +0000 (18:08 +0100)]
avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it

Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d24888ef19ba38b787b11d1ee091a3d94920c76a)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavutil/file_open: avoid file handle inheritance on Windows
Tobias Rapp [Thu, 29 Oct 2015 08:11:37 +0000 (09:11 +0100)]
avutil/file_open: avoid file handle inheritance on Windows

Avoids inheritance of file handles on Windows systems similar to the
O_CLOEXEC/FD_CLOEXEC flag on Linux.

Fixes file lock issues in Windows applications when a child process
is started with handle inheritance enabled (standard input/output
redirection) while a FFmpeg transcoding is running in the parent
process.

Links relevant to the subject:

https://msdn.microsoft.com/en-us/library/w7sa2b22.aspx

Describes the _wsopen() function and the O_NOINHERIT flag. File handles
opened by _wsopen() are inheritable by default.

https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425%28v=vs.85%29.aspx

Describes handle inheritance when creating new processes. Handle
inheritance must be enabled (bInheritHandles = TRUE) e.g. when you want
to pass handles for stdin/stdout via lpStartupInfo.

Signed-off-by: Tobias Rapp <t.rapp@noa-audio.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 474665346616e446ecd1407002fdf5f88201bf72)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/h264_slice: Disable slice threads if there are multiple access units in a...
Michael Niedermayer [Sat, 31 Oct 2015 20:36:00 +0000 (21:36 +0100)]
avcodec/h264_slice: Disable slice threads if there are multiple access units in a packet

Fixes null pointer dereference
Fixes part of Ticket4977

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9368d2da3d33cac845f2fdf663df500b53625c5e)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavformat/hls: update cookies on setcookie response
Lucas de Andrade [Fri, 30 Oct 2015 11:51:26 +0000 (09:51 -0200)]
avformat/hls: update cookies on setcookie response

Context cookies must be updated when a playlist response return Setcookie header.

See: 770dd105044d00263da041f509a08b316296a78e
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoopusdec: Don't run vector_fmul_scalar on zero length arrays
Kieran Kunhya [Mon, 26 Oct 2015 23:09:44 +0000 (23:09 +0000)]
opusdec: Don't run vector_fmul_scalar on zero length arrays

Fixes crashes on fuzzed files
Fixes Ticket4969 part2

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b3e5f15b95f04a35821f63f6fd89ddd60f666a59)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/opusdec: Fix extra samples read index
Michael Niedermayer [Tue, 27 Oct 2015 00:18:22 +0000 (01:18 +0100)]
avcodec/opusdec: Fix extra samples read index

Fixes crash
Fixes Ticket4969 part 1

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 07225fa74f2cdb29d6d85fd33675539bfdfe9ea5)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/ffv1: Initialize vlc_state on allocation
Michael Niedermayer [Sat, 17 Oct 2015 00:13:42 +0000 (02:13 +0200)]
avcodec/ffv1: Initialize vlc_state on allocation

This ensures that they are always set to valid values
Fixes Ticket4939

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a878dfa4f57d068eb69fb6614f7a4a20f769ee7b)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/ffv1dec: update progress in case of broken pointer chains
Michael Niedermayer [Fri, 16 Oct 2015 20:25:20 +0000 (22:25 +0200)]
avcodec/ffv1dec: update progress in case of broken pointer chains

Fixes deadlock
Fixes Ticket4932

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5063a18f5635008b2a45ada1f8c1e21e20450029)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agoavcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding...
Michael Niedermayer [Fri, 16 Oct 2015 18:15:48 +0000 (20:15 +0200)]
avcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding fails for other reasons

Fixes Ticket4931

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c2d4e8700cd3db59bc11ab196c0002215cf601f)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
3 years agortsp: Allow $ as interleaved packet indicator before a complete response header
Martin Storsjö [Wed, 21 Oct 2015 08:56:36 +0000 (11:56 +0300)]
rtsp: Allow $ as interleaved packet indicator before a complete response header

Some RTSP servers ("HiIpcam/V100R003 VodServer/1.0.0") respond to
our keepalive GET_PARAMETER request by a truncated RTSP header
(lacking the final empty line to indicate a complete response
header). Prior to 764ec70149, this worked just fine since we
reacted to the $ as interleaved packet indicator anywhere.

Since $ is a valid character within the response header lines,
764ec70149 changed it to be ignored there. But to keep
compatibility with such broken servers, we need to at least
allow reacting to it at the start of lines.

Fixes ticket #4952.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e02dcdf6bb6835ef4b49986b85a67efcb3495a7f)

3 years agovideodsp: don't overread edges in vfix3 emu_edge.
Ronald S. Bultje [Fri, 23 Oct 2015 15:11:53 +0000 (11:11 -0400)]
videodsp: don't overread edges in vfix3 emu_edge.

Fixes trac ticket 3226. Also see Andreas' analysis in
https://bugs.debian.org/801745, which was very helpful.
(cherry picked from commit 52f84d82bdf1851ecfcc412c1719e5f6f3396209)

3 years agoavformat/mp3dec: improve junk skipping heuristic
wm4 [Tue, 20 Oct 2015 10:17:21 +0000 (12:17 +0200)]
avformat/mp3dec: improve junk skipping heuristic

Commit 2b3e9bbfb529e6bde238aeb511b55ebe461664c8 caused problems for a
certain API user:

https://code.google.com/p/chromium/issues/detail?id=537725
https://code.google.com/p/chromium/issues/detail?id=542032

The problem seems rather arbitrary, because if there's junk, anything
can happen. In this case, the imperfect junk skipping just caused it to
read different junk, from what I can see.

We can improve the accuracy of junk detection by a lot by checking if 2
consecutive frames use the same configuration. While in theory it might
be completely fine for the 1st frame to have a different format than the
2nd frame, it's exceedingly unlikely, and I can't think of a legitimate
use-case.

This is approximately the same mpg123 does for junk skipping. The
set of compared header bits is the same as the libavcodec mp3 parser
uses for similar purposes.
(cherry picked from commit de1b1a7da9e6ddf42447271e519099a88b389e4a)

4 years agoconcatdec: fix file_start_time calculation regression
Marton Balint [Tue, 13 Oct 2015 20:56:00 +0000 (22:56 +0200)]
concatdec: fix file_start_time calculation regression

Fixes ticket #4924.

Found-by: Jaroslav Šnajdr <jsnajdr@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit df239b76195156f179618ddb8b167d5bf1245247)

4 years agoavcodec: loongson optimize h264dsp idct and loop filter with mmi
周晓勇 [Wed, 2 Sep 2015 10:02:24 +0000 (18:02 +0800)]
avcodec: loongson optimize h264dsp idct and loop filter with mmi

Change-Id: Ic87fb8f5cd22a502ff9dbbc5a5a8ea97cfc8a1dd
Signed-off-by: ZhouXiaoyong <zhouxiaoyong@loongson.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
4 years agoavcodec/jpeg2000dec: Clear properties in jpeg2000_dec_cleanup() too
Michael Niedermayer [Thu, 15 Oct 2015 19:48:42 +0000 (21:48 +0200)]
avcodec/jpeg2000dec: Clear properties in jpeg2000_dec_cleanup() too

Fixes: Ticket4878

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c980c5e54dfe83ce8b631845ce750c38cec56873)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
4 years agoavformat/hls: add support for EXT-X-MAP
Anssi Hannula [Thu, 15 Oct 2015 11:23:00 +0000 (14:23 +0300)]
avformat/hls: add support for EXT-X-MAP

Without EXT-X-MAP support we miss the first bytes of some streams.

These streams worked by luck before byte-ranged segment support was added in
da7759b3579de3e98deb1ac58e642b861280ba54

Fixes ticket #4797.
(cherry picked from commit 909907948846dedf57a730a4d115d04d1117f9e5)

Conflicts:
libavformat/hls.c