ffmpeg.git
4 years agoavcodec/dcadec: Check active_bands
Michael Niedermayer [Fri, 15 May 2015 16:29:40 +0000 (18:29 +0200)]
avcodec/dcadec: Check active_bands

Fixes CID1297594 part2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc624ec9ba7e5c4e8d905ac10f605a43d123f95a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check scale table index
Michael Niedermayer [Fri, 15 May 2015 16:04:12 +0000 (18:04 +0200)]
avcodec/dcadec: Check scale table index

Fixes CID1297594 part 1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0f3e6959bfa67d12cd5a173b86eb15abd7d9e4d5)

Conflicts:

libavcodec/dcadec.c

4 years agoavcodec/sonic: More completely check sample_rate_index and channels
Michael Niedermayer [Fri, 15 May 2015 15:31:58 +0000 (17:31 +0200)]
avcodec/sonic: More completely check sample_rate_index and channels

Fixes CID1271783

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ade8a46154cb45c88b1cb5c616eaa6320c941187)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/smvjpegdec: check avcodec_decode_video2() return code
Michael Niedermayer [Fri, 15 May 2015 15:21:10 +0000 (17:21 +0200)]
avcodec/smvjpegdec: check avcodec_decode_video2() return code

Fixes CID1271810

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cdd25f9a3df3905543a5546cf6076d2eaf895736)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/shorten: More complete pred_order check
Michael Niedermayer [Fri, 15 May 2015 15:02:28 +0000 (17:02 +0200)]
avcodec/shorten: More complete pred_order check

Fixes CID1239055

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 294469416d8193a28710d802bb0c46e5fa09fad7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/shorten: Check skip_bytes()
Michael Niedermayer [Fri, 15 May 2015 14:48:31 +0000 (16:48 +0200)]
avcodec/shorten: Check skip_bytes()

Fixes CID1210526

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d201becfc0d89c6a5dfe44e96f1044fbc2aadb70)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/shorten: Fix code depending on signed overflow behavior
Michael Niedermayer [Fri, 15 May 2015 14:58:51 +0000 (16:58 +0200)]
avcodec/shorten: Fix code depending on signed overflow behavior

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2d15588124ab1d4c0612cab66f02a716f1509211)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/proresdec2: Reset slice_count on deallocation
Michael Niedermayer [Fri, 15 May 2015 13:23:32 +0000 (15:23 +0200)]
avcodec/proresdec2: Reset slice_count on deallocation

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c4c6aea397f62421bf8ef0449b2b465a53e4ab4d)

Conflicts:

libavcodec/proresdec2.c

4 years agoffmpeg_opt: Fix -timestamp parsing
Michael Niedermayer [Sat, 9 May 2015 11:07:00 +0000 (13:07 +0200)]
ffmpeg_opt: Fix -timestamp parsing

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 107e4da47644fe615ea821d6a19682d73789aca7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check subsubframes
Michael Niedermayer [Thu, 14 May 2015 19:29:19 +0000 (21:29 +0200)]
avcodec/dcadec: Check subsubframes

Fixes: CID1239152

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a9bf628bfdad142763880a3d1ccb6058040dda57)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check nchans
Michael Niedermayer [Thu, 14 May 2015 18:49:25 +0000 (20:49 +0200)]
avcodec/dcadec: Check nchans

Fixes CID1239110

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a6a45774d045007f8262cd7c614804390e53122e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/cavsdec: Check esc_code
Michael Niedermayer [Thu, 14 May 2015 15:54:40 +0000 (17:54 +0200)]
avcodec/cavsdec: Check esc_code

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 139e1c8009df7729a53eaaae7036ca01071aced5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/mpeg4audio: add some padding/alignment to MAX_PCE_SIZE
Michael Niedermayer [Wed, 13 May 2015 22:09:56 +0000 (00:09 +0200)]
avcodec/mpeg4audio: add some padding/alignment to MAX_PCE_SIZE

This avoids potential accesses over the end

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 93cfa7d1692c25cff045f99ba1af2c9e5772c45e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/mjpegdec: fix len computation in ff_mjpeg_decode_dqt()
Michael Niedermayer [Wed, 13 May 2015 16:36:19 +0000 (18:36 +0200)]
avcodec/mjpegdec: fix len computation in ff_mjpeg_decode_dqt()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81cf9108563510dee24f73b2c5d94a7bd07ff747)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/jpeg2000dec: fix boolean operator
Michael Niedermayer [Wed, 13 May 2015 13:15:55 +0000 (15:15 +0200)]
avcodec/jpeg2000dec: fix boolean operator

Fixes CID1271791 #7-6

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f8f155a18ac454e7ff3312e0e0c3a70eb4359143)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/vqavideo: Check chunk size
Michael Niedermayer [Tue, 12 May 2015 22:41:38 +0000 (00:41 +0200)]
avcodec/vqavideo: Check chunk size

Fixes CID1239154

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8a62b80ce6c8e87e7937f9a5d68f83882c1c8da2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/matroskadec: Cleanup error handling for bz2 & zlib
Michael Niedermayer [Tue, 12 May 2015 16:32:12 +0000 (18:32 +0200)]
avformat/matroskadec: Cleanup error handling for bz2 & zlib

Fixes CID703652

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 171af59d58fc67d82dce8ff7ed11fa671108baa5)

Conflicts:

libavformat/matroskadec.c

4 years agoavformat/nutdec: Fix use of uinitialized value
Michael Niedermayer [Tue, 12 May 2015 16:20:23 +0000 (18:20 +0200)]
avformat/nutdec: Fix use of uinitialized value

Fixes CID1041175

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56abf35151c635caa3eb04bbb90454bae5463a09)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/rtpenc_jpeg: Check remaining buffer size for SOS
Michael Niedermayer [Tue, 12 May 2015 15:55:40 +0000 (17:55 +0200)]
avformat/rtpenc_jpeg: Check remaining buffer size for SOS

Fixes CID1238818

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81198a68370e88f7d02f16de58db36713c2a50b6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Michael Niedermayer [Tue, 12 May 2015 16:03:55 +0000 (18:03 +0200)]
avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()

Larger packets are not supported and would cause problems later

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e160551fb1c290d1397da2f04325817)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agotools/graph2dot: use larger data types than int for array/string sizes
Michael Niedermayer [Tue, 12 May 2015 01:59:30 +0000 (03:59 +0200)]
tools/graph2dot: use larger data types than int for array/string sizes

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit acf4925f444636a828534ab47d0f86c21a7a9b4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/subtitles: Use size_t for len
Michael Niedermayer [Sun, 10 May 2015 13:38:40 +0000 (15:38 +0200)]
avformat/subtitles: Use size_t for len

string length could theoretically be larger than int

Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a633928d47057426a9c328da594407d1c7da8a5c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/url: Use size_t for len from strlen()
Michael Niedermayer [Mon, 11 May 2015 01:50:01 +0000 (03:50 +0200)]
avformat/url: Use size_t for len from strlen()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95efc651294b3cf3e5ec4b3ed36e79d7261545ff)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavutil/avstring: Use size_t in av_strlcatf()
Michael Niedermayer [Mon, 11 May 2015 18:01:15 +0000 (20:01 +0200)]
avutil/avstring: Use size_t in av_strlcatf()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ae4eea8be45a0b212fd57ceaac1f11089ab81d98)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()
Michael Niedermayer [Mon, 11 May 2015 13:23:51 +0000 (15:23 +0200)]
avformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eca38864a6ce5053e463b8d3fc22b22bc9a49578)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavutil/dict: Use size_t for appending strings
Michael Niedermayer [Sun, 10 May 2015 14:09:07 +0000 (16:09 +0200)]
avutil/dict: Use size_t for appending strings

the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c128ea1629116fc4936edc5f96bbd18f3ef1647)

Conflicts:

libavutil/dict.c

4 years agoaacsbr: break infinite loop in sbr_hf_calc_npatches
Andreas Cadhalpun [Wed, 22 Apr 2015 13:23:24 +0000 (15:23 +0200)]
aacsbr: break infinite loop in sbr_hf_calc_npatches

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 584cc1ade10a3297ef9c107ef3a2081c04024156)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agodiracdec: check that block length is valid
Andreas Cadhalpun [Wed, 6 May 2015 13:34:53 +0000 (15:34 +0200)]
diracdec: check that block length is valid

In init_planes p->xblen and p->yblen are set to:
            p->xblen = s->plane[0].xblen >> s->chroma_x_shift;
            p->yblen = s->plane[0].yblen >> s->chroma_y_shift;

These are later used as block_w and block_h arguments of
s->vdsp.emulated_edge_mc. If one of them is 0 it triggers an av_assert2
in emulated_edge_mc:
    av_assert2(start_x < end_x && block_w > 0);
    av_assert2(start_y < end_y && block_h > 0);

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 75fc81c8318505aa7946e05a9bee08d47241fc66)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agodiracdec: check if reference could not be allocated
Andreas Cadhalpun [Tue, 5 May 2015 21:51:48 +0000 (23:51 +0200)]
diracdec: check if reference could not be allocated

s->ref_pics[i] is later used as ref argument of interpolate_refplane,
where it is dereferenced.

If it is NULL, it causes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d93181ef3eacdb862d93448f31c97765a523d1db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agodiracdec: avoid overflow of bytes*8 in decode_lowdelay
Andreas Cadhalpun [Tue, 5 May 2015 20:10:44 +0000 (22:10 +0200)]
diracdec: avoid overflow of bytes*8 in decode_lowdelay

If bytes is large enough, bytes*8 can overflow and become negative.

In that case 'bufsize -= bytes*8' causes bufsize to increase instead of
decrease.

This leads to a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9e66b39aa87eb653a6e5d15f70b792ccbf719de7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agodiracdec: prevent overflow in data_unit_size check
Andreas Cadhalpun [Tue, 5 May 2015 19:33:08 +0000 (21:33 +0200)]
diracdec: prevent overflow in data_unit_size check

buf_idx + data_unit_size can overflow, causing the '> buf_size' check to
wrongly fail.

This causes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 984f50deb2d48f6844d65e10991b996a6d29e87c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavidec: avoid infinite loop due to negative ast->sample_size
Andreas Cadhalpun [Mon, 4 May 2015 21:01:45 +0000 (23:01 +0200)]
avidec: avoid infinite loop due to negative ast->sample_size

If max in clean_index is set to a negative ast->sample_size, the
following loop never ends:
        while (max < 1024)
            max += max;

Thus set ast->sample_size to 0 if it would otherwise be negative.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ca234639ac49a0dc073ac1f10977979acdb94f97)

Conflicts:

libavformat/avidec.c

4 years agoavformat/matroskadec: Use tracks[k]->stream instead of s->streams[k]
Michael Niedermayer [Mon, 4 May 2015 13:47:54 +0000 (15:47 +0200)]
avformat/matroskadec: Use tracks[k]->stream instead of s->streams[k]

The later is not correct

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5d309d309108684f742bbf5fc2393f1c519cda72)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agomatroskadec: check s->streams[k] before using it
Andreas Cadhalpun [Sun, 3 May 2015 21:55:20 +0000 (23:55 +0200)]
matroskadec: check s->streams[k] before using it

This fixes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e54540655f229d06667dc7fa7005f2a20e101e80)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/ffv1dec: Check chroma shift parameters
Michael Niedermayer [Mon, 4 May 2015 11:37:26 +0000 (13:37 +0200)]
avcodec/ffv1dec: Check chroma shift parameters

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d43cd6b08ed555c303478e3133717fbb2236be6e)

Conflicts:

libavcodec/ffv1dec.c

4 years agomatroskadec: use uint64_t instead of int for index_scale
Andreas Cadhalpun [Sun, 3 May 2015 21:07:20 +0000 (23:07 +0200)]
matroskadec: use uint64_t instead of int for index_scale

index_scale is set to matroska->time_scale of type uint64_t.

When index_scale is int, the assignment can overflow and e.g. result
in index_scale = 0. This causes a floating point exception due to the
division by index_scale.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eb9fb508b0e09d85d234fe694333b2005e1d7a7e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and...
Michael Niedermayer [Sun, 3 May 2015 13:54:21 +0000 (15:54 +0200)]
avcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and undefined behavior in fate

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 042260cde4ecf716438c5fc92d15ad5f037ee2e1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agonutdec: fix illegal count check in decode_main_header
Andreas Cadhalpun [Tue, 28 Apr 2015 20:37:19 +0000 (22:37 +0200)]
nutdec: fix illegal count check in decode_main_header

The existing check has two problems:
 1) i + count can overflow, so that the check '< 256' returns true.
 2) In the (i == 'N') case occurs a j-- so that the loop runs once more.

This can trigger the assertion 'nut->header_len[0] == 0' or cause
segmentation faults or infinite hangs.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7c24ca1bda2d4df1dc9b2b982941be532d60da21)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agonutdec: check chapter creation in decode_info_header
Andreas Cadhalpun [Tue, 28 Apr 2015 18:57:59 +0000 (20:57 +0200)]
nutdec: check chapter creation in decode_info_header

This fixes a segmentation fault when accessing the metadata.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3ff1af2b0db7132d5717be6395227a94c8abab07)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agonutdec: check for negative frame rate in decode_info_header
Andreas Cadhalpun [Tue, 28 Apr 2015 18:31:56 +0000 (20:31 +0200)]
nutdec: check for negative frame rate in decode_info_header

A negative frame rate triggers an av_assert2 in av_rescale_rnd.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6621105877ce0d65724a8ab60b3a50160adbe65d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoffmpeg: remove incorrect network deinit
Michael Niedermayer [Thu, 23 Apr 2015 12:29:47 +0000 (14:29 +0200)]
ffmpeg: remove incorrect network deinit

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e2877bdf3862325c2982c3237d9bf28f1bbf793f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoapedec: prevent out of array writes in decode_array_0000
Andreas Cadhalpun [Tue, 28 Apr 2015 09:13:43 +0000 (11:13 +0200)]
apedec: prevent out of array writes in decode_array_0000

s->decoded_buffer is allocated with a min_size of:
    2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer)

Then it is assigned to s->decoded[0] (and s->decoded_buffer + FFALIGN(blockstodecode, 8)
to s->decoded[1]) and passed as out buffer to decode_array_0000.

In this function 64 elements of the out buffer are written
unconditionally and outside the array if blockstodecode is too small.

This causes memory corruption, leading to segmentation faults or other
crashes.

Thus change decode_array_0000 to write at most blockstodecode elements
of the out buffer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 699341d647f7af785fb8ceed67604467b0b9ab12)

Conflicts:

libavcodec/apedec.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoapedec: set s->samples only when init_frame_decoder succeeded
Andreas Cadhalpun [Mon, 27 Apr 2015 22:30:51 +0000 (00:30 +0200)]
apedec: set s->samples only when init_frame_decoder succeeded

Otherwise range_start_decoding is not necessarily run and thus
ctx->rc.range still 0 in range_dec_normalize leading to an infinite
loop.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 464c49155ce7ffc88ed39eb2511e7a75565c24be)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agotests/fate-run: do not attempt to parse tiny_psnrs output if it failed
Michael Niedermayer [Thu, 23 Apr 2015 02:27:56 +0000 (04:27 +0200)]
tests/fate-run: do not attempt to parse tiny_psnrs output if it failed

This avoids confusing syntax errors with awk later

Likely fixes awk errors at:
http://buildd.debian-ports.org/status/fetch.php?pkg=ffmpeg&arch=sparc64&ver=7%3A2.6.2-1&stamp=1428928967

Reviewed-by: Timothy Gu <timothygu99@gmail.com>
Thanks-to: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> for the link
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c0d847e457c1ef72843a63853f1135d52b74131e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoalac: reject rice_limit 0 if compression is used
Andreas Cadhalpun [Thu, 23 Apr 2015 22:01:43 +0000 (00:01 +0200)]
alac: reject rice_limit 0 if compression is used

If rice_limit is 0, k can be 0 in decode_scalar, which calls show_bits(gb, k).

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4b657a1b1eedcf38bcf36e89a2f4be6f76b5ce09)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoalsdec: only adapt order for positive max_order
Andreas Cadhalpun [Wed, 22 Apr 2015 14:03:41 +0000 (16:03 +0200)]
alsdec: only adapt order for positive max_order

For max_order = 0 the clipping range is invalid. (amin = 2, amax = 1)

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 58d605ee9b3277289278dc40e022311f8e083833)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolavf: Reset global flag on deinit
Vittorio Giovara [Wed, 22 Apr 2015 13:59:56 +0000 (14:59 +0100)]
lavf: Reset global flag on deinit

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32da94fa7f73ac749e0a1e2f20499fad2f6f57fe)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agompeg4videodec: only allow a positive length
Andreas Cadhalpun [Wed, 22 Apr 2015 14:32:42 +0000 (16:32 +0200)]
mpeg4videodec: only allow a positive length

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b3408ae4c64cb674b1d5f0f30171759113ce722a)

Conflicts:

libavcodec/mpeg4videodec.c
(cherry picked from commit 3339bae2197a2a02b090e74a8720282b5b87598e)

4 years agoalsdec: check sample pointer range in revert_channel_correlation
Andreas Cadhalpun [Tue, 21 Apr 2015 17:25:50 +0000 (19:25 +0200)]
alsdec: check sample pointer range in revert_channel_correlation

Also change the type of begin, end and smp to ptrdiff_t to make the
comparison well-defined.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Thilo Borgmann <thilo.borgmann@mail.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit afc7748d1f6abc4b3b1cc957b0fa6941837db3d0)

Conflicts:

libavcodec/alsdec.c
(cherry picked from commit 0b5405c443ec8adc3c114e508b71ce2012c83f0d)

4 years agoavformat/utils: Ensure that AVFMT_FLAG_CUSTOM_IO is set before use
Michael Niedermayer [Mon, 20 Apr 2015 20:22:31 +0000 (22:22 +0200)]
avformat/utils: Ensure that AVFMT_FLAG_CUSTOM_IO is set before use

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ba631b791435c395361e2026fc7419b341e57813)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoalsdec: validate time diff index
Andreas Cadhalpun [Sat, 18 Apr 2015 18:09:28 +0000 (20:09 +0200)]
alsdec: validate time diff index

If begin is smaller than t, the subtraction 'begin -= t' wraps around,
because begin is unsigned. The same applies for end < t.

This causes segmentation faults.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit faf9fe2c224ea81a98afd53e2f0be0a2e13aeca9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/alsdec: Use av_mallocz_array() for chan_data to ensure the arrays never conta...
Michael Niedermayer [Sat, 18 Apr 2015 18:50:23 +0000 (20:50 +0200)]
avcodec/alsdec: Use av_mallocz_array() for chan_data to ensure the arrays never contain random data

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7e104647a3556fc61a139483cee1cb7dfa2dc5bd)

Conflicts:

libavcodec/alsdec.c

4 years agoalsdec: ensure channel reordering is reversible
Andreas Cadhalpun [Sat, 18 Apr 2015 16:31:36 +0000 (18:31 +0200)]
alsdec: ensure channel reordering is reversible

If the same idx is used for more than one i, at least one entry in
sconf->chan_pos remains uninitialized.

This can cause segmentation faults.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ef16501aebed43e34a3721336e8bee732eca2877)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoac3: validate end in ff_ac3_bit_alloc_calc_mask
Andreas Cadhalpun [Thu, 16 Apr 2015 19:25:26 +0000 (21:25 +0200)]
ac3: validate end in ff_ac3_bit_alloc_calc_mask

This fixes an invalid read if end is 0:
     band_end   = ff_ac3_bin_to_band_tab[end-1] + 1;

Depending on what is before the array, this can cause stack smashing,
when band_end becomes too large.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bc4fee7f2a51635fa3c0f61d1e5164da1efeded3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoaacpsy: avoid psy_band->threshold becoming NaN
Andreas Cadhalpun [Thu, 16 Apr 2015 18:04:54 +0000 (20:04 +0200)]
aacpsy: avoid psy_band->threshold becoming NaN

If band->thr is 0.0f, the division is undefined, making norm_fac not a
number or infinity, which causes psy_band->threshold to become NaN.

This is passed on to other variables until it finally reaches
sce->sf_idx and is converted to an integer (-2147483648).

This causes a segmentation fault when it is used as array index.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Reviewed-by: Claudio Freire <klaussfreire@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e224aa41917454e7b5c23d9f2541425743ce595a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoaasc: return correct buffer size from aasc_decode_frame
Andreas Cadhalpun [Thu, 16 Apr 2015 17:12:02 +0000 (19:12 +0200)]
aasc: return correct buffer size from aasc_decode_frame

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0be54ad280cf114c02306b7063147e8379f8ed1e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agomsrledec: use signed pixel_ptr in msrle_decode_pal4
Andreas Cadhalpun [Thu, 16 Apr 2015 12:49:08 +0000 (14:49 +0200)]
msrledec: use signed pixel_ptr in msrle_decode_pal4

This fixes segmentation faults, when pic->linesize[0] is negative.
In that case 'line * pic->linesize[0] + pixel_ptr' is treated as
unsigned and wraps around.

This reverts commit 7d78a964.
The problem was introduced in commit f7e1367f, which should obsolete
that commit.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ae6fd7300b4e9f81d3b5ba201096ffe7cccf26fb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/aacdec: Fix storing state before PCE decode
Michael Niedermayer [Wed, 8 Apr 2015 22:04:44 +0000 (00:04 +0200)]
avcodec/aacdec: Fix storing state before PCE decode

Fixes Ticket4460

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e88b3852aefaa39b2170ef185ad03dda18732821)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agotests: Fix test name for pixfmts tests(cherry picked from commit e1ee0521a698809ed216...
Timothy Gu [Mon, 10 Nov 2014 05:37:18 +0000 (21:37 -0800)]
tests: Fix test name for pixfmts tests(cherry picked from commit e1ee0521a698809ed216e9e5c11bd2bbb466ed04)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agotests/fate.sh: report different status for different errors
Timothy Gu [Tue, 10 Jun 2014 04:46:37 +0000 (21:46 -0700)]
tests/fate.sh: report different status for different errors

The order of error codes will be useful in my future fateserver patches.

Signed-off-by: Timothy Gu <timothygu99@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc0057a31c7097839f9c4e4da61e2933b5b0e055)
Signed-off-by: Timothy Gu <timothygu99@gmail.com>
4 years agoavcodec/h264_refs: Do not set reference to things which dont exist
Michael Niedermayer [Sat, 4 Apr 2015 16:08:23 +0000 (18:08 +0200)]
avcodec/h264_refs: Do not set reference to things which dont exist

Fixes deadlock
Fixes Ticket4428
Fixes Ticket4429

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 429de043202286a2b5bcc082cc02de860b734db2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavutil/pca: Check for av_malloc* failures
Michael Niedermayer [Mon, 30 Mar 2015 02:37:42 +0000 (04:37 +0200)]
avutil/pca: Check for av_malloc* failures

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dadc43eee4d9036aa532665a04720238cc15e922)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/msrledec: restructure msrle_decode_pal4() based on the line number instead...
Michael Niedermayer [Tue, 24 Mar 2015 14:50:12 +0000 (15:50 +0100)]
avcodec/msrledec: restructure msrle_decode_pal4() based on the line number instead of the pixel pointer

Fixes out of array access
Fixes: da14e86d8462be6493eab16bc2d40f88/asan_heap-oob_204cfd2_528_cov_340150052_COMPRESS.BMP

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f7e1367f58263593e6cee3c282f7277d7ee9d553)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dnxhddec: Check that the frame is interlaced before using cur_field
Michael Niedermayer [Thu, 19 Mar 2015 22:28:39 +0000 (23:28 +0100)]
avcodec/dnxhddec: Check that the frame is interlaced before using cur_field

Fixes Ticket4227

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2c660e34cf3c2b77cd2bef6f292920334dfd9192)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mov: Disallow ".." in dref unless use_absolute_path is set
Michael Niedermayer [Sat, 14 Mar 2015 20:32:35 +0000 (21:32 +0100)]
avformat/mov: Disallow ".." in dref unless use_absolute_path is set

as this kind of allows to circumvent it to some extend.
We also could add a separate parameter or value to choose this

Found-by: ramiro
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e4d0498df6621143da1a550006ddc3526ad51cb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mov: Check for string truncation in mov_open_dref()
Michael Niedermayer [Sat, 14 Mar 2015 20:24:54 +0000 (21:24 +0100)]
avformat/mov: Check for string truncation in mov_open_dref()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8003816e1619e77d8de051883264aa090e0d78cc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mov: Use sizeof(filename) instead of a literal number
Michael Niedermayer [Sat, 14 Mar 2015 20:23:32 +0000 (21:23 +0100)]
avformat/mov: Use sizeof(filename) instead of a literal number

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 21a53dd08dce7cc5b3fdf9c4826b4b74d8300ea0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoffmdec: make sure the time base is valid
Andreas Cadhalpun [Sun, 8 Mar 2015 22:12:59 +0000 (23:12 +0100)]
ffmdec: make sure the time base is valid

A negative time base can trigger assertions.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c91d81be23ffacfa3897b2bcfa77445bb0c2f89)

Conflicts:

libavformat/ffmdec.c
(cherry picked from commit 9678ceb6976ca8194848b24535785a298521211f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/012v: redesign main loop
Michael Niedermayer [Tue, 10 Mar 2015 18:18:34 +0000 (19:18 +0100)]
avcodec/012v: redesign main loop

Fixes out of array accesses
Fixes: ffmpeg_012v_crash.ts

Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Reviewed-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 48df30d36c3ca360c407d84f96749888d1fbe853)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/012v: Check dimensions more completely
Michael Niedermayer [Tue, 10 Mar 2015 19:21:14 +0000 (20:21 +0100)]
avcodec/012v: Check dimensions more completely

Fixes division by 0

Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d3b25383daffac154846daeb4e4fb46569e728db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoarm: Suppress tags about used cpu arch and extensions
Martin Storsjö [Thu, 5 Mar 2015 21:38:00 +0000 (23:38 +0200)]
arm: Suppress tags about used cpu arch and extensions

When all the codepaths using manually set .arch/.fpu code is
behind runtime detection, the elf attributes should be suppressed.

This allows tools to know that the final built binary doesn't
strictly require these extensions.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit dcae2e32f7d8a1ca5fb8c1e4aa81313be854dd73
and b77e335e441040a40fc6156b8e4a134745d10233)
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 9841654c158c80e9d525ba03754135d3f34e306e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoFix read-after-free in matroska_read_seek().
Xiaohan Wang [Thu, 6 Nov 2014 20:59:54 +0000 (12:59 -0800)]
Fix read-after-free in matroska_read_seek().

In matroska_read_seek(), |tracks| is assigned at the begining of the function.
However, functions like matroska_parse_cues() could reallocate the tracks so
that |tracks| can get invalidated.

This CL assigns |tracks| only before we use it so that it won't be invalidated.

BUG=427266
TEST=Test case in associated bug passes now.

Change-Id: I9c7065fe8f4311ca846076281df2282d190ed344

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 33301f001747d7a542073c634cc81da5eff051cf)

Conflicts:

libavformat/matroskadec.c

4 years agoroqvideoenc: set enc->avctx in roq_encode_init
Andreas Cadhalpun [Mon, 9 Mar 2015 18:24:09 +0000 (19:24 +0100)]
roqvideoenc: set enc->avctx in roq_encode_init

So far it is only set in roq_encode_frame, but it is used in
roq_encode_end to free the coded_frame. This currently segfaults if
roq_encode_frame is not called between roq_encode_init and
roq_encode_end.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cf82c426fadf90105e1fb9d5ecd267cc3aa2b288)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/options_table: remove extradata_size from the AVOptions table
Michael Niedermayer [Mon, 9 Mar 2015 02:42:00 +0000 (03:42 +0100)]
avcodec/options_table: remove extradata_size from the AVOptions table

allowing access to the size but not the extradata itself is not useful
and could lead to potential problems if writing happens through this field

Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Reviewed-by: Lukasz Marek <lukasz.m.luki2@gmail.com>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1f4088b28540080ce1d42345c5614be3e1a6a197)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoffmdec: limit the backward seek to the last resync position
Andreas Cadhalpun [Mon, 9 Mar 2015 13:59:44 +0000 (14:59 +0100)]
ffmdec: limit the backward seek to the last resync position

If resyncing leads to the same position as previously, it will again
lead to a resync attempt, resulting in an infinite loop.

Thus don't seek back beyond the last syncpoint.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6b8263b03ab3d16d70525ae1893cb106be7852f1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoffmdec: fix infinite loop at EOF
Andreas Cadhalpun [Sun, 8 Mar 2015 22:31:48 +0000 (23:31 +0100)]
ffmdec: fix infinite loop at EOF

If EOF is reached, while skipping bytes, avio_tell(pb) won't change
anymore, resulting in an infinite loop.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6fa98822eba501a4898fdec5b75acd3026201005)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/rm: limit packet size
Andreas Cadhalpun [Mon, 2 Mar 2015 14:46:44 +0000 (15:46 +0100)]
avformat/rm: limit packet size

The chunk size is limited to 0xFFFF (written by avio_wb16), so make
sure that the packet size is not too large.

Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
See Ticket244

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08728f400b8367dc8c983036cb2eff3a2891322b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/rv10: check size of s->mb_width * s->mb_height
Andreas Cadhalpun [Mon, 2 Mar 2015 19:27:26 +0000 (20:27 +0100)]
avcodec/rv10: check size of s->mb_width * s->mb_height

If it doesn't fit into 12 bits it triggers an assertion.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2578a546183da09d49d5bba8ab5e982dece1dede)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agomdec: check for out of bounds read
Federico Tomassetti [Wed, 18 Feb 2015 12:11:43 +0000 (12:11 +0000)]
mdec: check for out of bounds read

Bug-Id: CID 1257501
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 2c63081b48d98f3a0d0bed7b0ec3c0347b99144c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoaic: Fix decoding files with odd dimensions
Vittorio Giovara [Fri, 27 Feb 2015 19:00:25 +0000 (19:00 +0000)]
aic: Fix decoding files with odd dimensions

Normally the aic decoder finds the proper slice combination (multiple of
some number less than 32) but in case of odd width, it resorts to the
default values, which were actually swapped.
The number of slices is modified to account for such odd width cases.

CC: libav-stable@libav.org
(cherry picked from commit e878ec0d47cd6228c367b2f3128b76d7523f7255)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/tiff: move bpp check to after "end:"
Michael Niedermayer [Sun, 8 Mar 2015 22:27:43 +0000 (23:27 +0100)]
avcodec/tiff: move bpp check to after "end:"

This ensures that all current and future code-pathes get bpp checked

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d5e9fc782150d4596c72440a0aa02b7f4f1254b1)

Conflicts:

libavcodec/tiff.c

4 years agoavcodec/utils: Align YUV411 by as much as the other YUV variants
Michael Niedermayer [Sat, 7 Mar 2015 13:30:34 +0000 (14:30 +0100)]
avcodec/utils: Align YUV411 by as much as the other YUV variants

Fixes out of array accesses
Fixes: ffmpeg_mjpeg_crash2.avi

Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Tested-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e3201c38d53d2b8b24d0bc95d726b2cb1752dc12)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/flvenc: check that the codec_tag fits in the available bits
Andreas Cadhalpun [Sat, 28 Feb 2015 19:58:31 +0000 (20:58 +0100)]
avformat/flvenc: check that the codec_tag fits in the available bits

flags is later written with avio_w8 and if it doesn't fit in one byte it
triggers an av_assert2.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e8565d21c276ab9ac5ce785549420321fbd0b093)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoswscale/utils: clear formatConvBuffer on allocation
Michael Niedermayer [Fri, 27 Feb 2015 02:12:23 +0000 (03:12 +0100)]
swscale/utils: clear formatConvBuffer on allocation

Fixes use of uninitialized memory
Fixes: asan_heap-oob_35ca682_1474_cov_3230122439_aletrek_tga_16bit.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 007498fc1a639ecee2cda1892cbcff66c7c8c951)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/bit: only accept the g729 codec and 1 channel
Andreas Cadhalpun [Thu, 26 Feb 2015 20:42:02 +0000 (21:42 +0100)]
avformat/bit: only accept the g729 codec and 1 channel

Other codecs/channel numbers are not supported by this muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d0b8640f75ff7569c98d6fdb03d83451104e088c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/bit: check that pkt->size is 10 in write_packet
Andreas Cadhalpun [Thu, 26 Feb 2015 20:38:50 +0000 (21:38 +0100)]
avformat/bit: check that pkt->size is 10 in write_packet

Ohter packet sizes are not supported by this muxer.

This avoids a null pointer dereference of pkt->data.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eeda2c3de8a8484d9e7d1e47ac836bec850b31fc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/adxdec: check avctx->channels for invalid values
Andreas Cadhalpun [Wed, 25 Feb 2015 21:55:44 +0000 (22:55 +0100)]
avformat/adxdec: check avctx->channels for invalid values

This avoids a null pointer dereference of pkt->data.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7faa40af982960608b117e20fec999b48011e5e0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoFix buffer_size argument to init_put_bits() in multiple encoders.
Dyami Caliri [Thu, 26 Feb 2015 18:17:01 +0000 (10:17 -0800)]
Fix buffer_size argument to init_put_bits() in multiple encoders.

Several encoders were multiplying the buffer size by 8, in order to get
a bit size. However, the buffer_size argument is for the byte size of
the buffer. We had experienced crashes encoding prores (Anatoliy) at
size 4096x4096.
(cherry picked from commit 50833c9f7b4e1922197a8955669f8ab3589c8cef)

Conflicts:

libavcodec/proresenc_kostya.c

4 years agomips/acelp_filters: fix incorrect register constraint
James Cowgill [Thu, 26 Feb 2015 13:42:52 +0000 (13:42 +0000)]
mips/acelp_filters: fix incorrect register constraint

Change register constraint on the v variable from = to +. This was causing GCC
to think that the v variable was never read and therefore not initialize it.

This fixes about 20 fate failures on mips64el.

Signed-off-by: James Cowgill <james410@cowgill.org.uk>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b9de1303a6414174ab2f3bccefa801bfabcf0f88)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/zmbv: Check len before reading in decode_frame()
Michael Niedermayer [Wed, 25 Feb 2015 11:29:10 +0000 (12:29 +0100)]
avcodec/zmbv: Check len before reading in decode_frame()

Fixes out of array read
Fixes: asan_heap-oob_4d4eb0_3994_cov_3169972261_zmbv_15bit.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1f5c7781e63d6519192ada59c1e36bcecc92791d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/snowdec: Fix ref value check
Michael Niedermayer [Tue, 24 Feb 2015 02:12:22 +0000 (03:12 +0100)]
avcodec/snowdec: Fix ref value check

Fixes integer overflow and out of array read.
Fixes: signal_sigsegv_24169e6_3445_cov_3778346427_snow_chroma_bug.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8f4cbf940212079a34753c7f4d6c6b5a43586d30)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoswscale/utils: More carefully merge and clear coefficients outside the input
Michael Niedermayer [Mon, 23 Feb 2015 23:32:39 +0000 (00:32 +0100)]
swscale/utils: More carefully merge and clear coefficients outside the input

Fixes out of array read
Fixes: asan_heap-oob_35ca682_1474_cov_3230122439_aletrek_tga_16bit.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1895d414aaacece3b57d7bf19502305e9a064fae)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/a64multienc: fix use of uninitialized values in to_meta_with_crop
Andreas Cadhalpun [Sun, 22 Feb 2015 19:48:38 +0000 (20:48 +0100)]
avcodec/a64multienc: fix use of uninitialized values in to_meta_with_crop

Averaging over 2 pixels doesn't work correctly for the last pixel, because the
rest of the buffer is not initialized.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 87513d654546a99f8ddb045ca4fa5d33778a617e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/a64multienc: don't set incorrect packet size
Michael Niedermayer [Mon, 23 Feb 2015 00:21:30 +0000 (01:21 +0100)]
avcodec/a64multienc: don't set incorrect packet size

This fixes invalid reads of the packet buffer in av_dup_packet

Based on patch by Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d96142e9af92ded84f2580620c571ab96c4bb657)

Conflicts:

libavcodec/a64multienc.c

4 years agoavcodec/a64multienc: use av_frame_ref instead of copying the frame
Andreas Cadhalpun [Sun, 22 Feb 2015 19:43:30 +0000 (20:43 +0100)]
avcodec/a64multienc: use av_frame_ref instead of copying the frame

This fixes freeing the frame buffer twice on cleanup leading to a crash.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 39e4ed7c1d8d840be47f6d604704d47a59a9ae5d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/x86/mlpdsp_init: Simplify mlp_filter_channel_x86()
Michael Niedermayer [Thu, 19 Feb 2015 15:25:29 +0000 (16:25 +0100)]
avcodec/x86/mlpdsp_init: Simplify mlp_filter_channel_x86()

Based on patch by Francisco Blas Izquierdo Riera
Commit message partly taken from carl

fixes a compilation
error in mlpdsp_init.c with -fstack-check and some gcc compilers (I
reproduced the issue with gcc 4.7.3) by simplifying the code.

See also https://bugs.gentoo.org/show_bug.cgi?id=471756

$ make libavcodec/x86/mlpdsp_init.o
libavcodec/x86/mlpdsp_init.c: In function ‘mlp_filter_channel_x86’:
libavcodec/x86/mlpdsp_init.c:142:5: error: can’t find a register in
class ‘GENERAL_REGS’ while reloading ‘asm’
libavcodec/x86/mlpdsp_init.c:142:5: error: ‘asm’ operand has impossible
constraints

4551 -> 4509 dezicycles

Reviewed-by: Ramiro Polla <ramiro.polla@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 03f39fbb2a558153a3c464edec1378d637a755fe)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoh264: initialize H264Context.avctx in init_thread_copy
Anton Khirnov [Thu, 12 Feb 2015 12:06:49 +0000 (13:06 +0100)]
h264: initialize H264Context.avctx in init_thread_copy

This prevents using a wrong (first thread's) AVCodecContext if decoding
a frame in the first pass over all threads fails.
(cherry picked from commit a06b0b1295c51d100101e0ca0434e199ad6de6b5)

Conflicts:

libavcodec/h264.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/vqf: Use 64bit for ret to avoid overflow
Michael Niedermayer [Fri, 20 Feb 2015 20:00:57 +0000 (21:00 +0100)]
avformat/vqf: Use 64bit for ret to avoid overflow

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cb08687180683a755d0fe9d425280d0e4d1e6db2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mvdec: Use 64bit for ret to avoid overflow
Michael Niedermayer [Fri, 20 Feb 2015 19:41:35 +0000 (20:41 +0100)]
avformat/mvdec: Use 64bit for ret to avoid overflow

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 26c0cc154e06cb0064b3a3da49447ac44d82444f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/gxf: Use 64bit for res to avoid overflow
Michael Niedermayer [Fri, 20 Feb 2015 19:14:56 +0000 (20:14 +0100)]
avformat/gxf: Use 64bit for res to avoid overflow

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 12987f89007ee82b9d3a6090085dfaef8461ab8b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>