ffmpeg.git
7 years agomp3dec: Fix a heap-buffer-overflow
Alex Converse [Wed, 25 Jan 2012 23:46:14 +0000 (15:46 -0800)]
mp3dec: Fix a heap-buffer-overflow

In some cases, what is left to read from ptr is smaller than EXTRABYTES.

Based on a patch by Thierry Foucu <tfoucu@gmail.com>.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit f372ce119bd2458fa0b4ddfb2af3a36621df99f7)

7 years agompeg12: Pad framerate tab to 16 entries.
Alex Converse [Fri, 27 Jan 2012 23:50:24 +0000 (15:50 -0800)]
mpeg12: Pad framerate tab to 16 entries.

There are many places where we read an unchecked 4-bit index into it.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit dfa37fe8a3d9243dd339d94befa065e2c90b29e6)

7 years agokgv1dec: Increase offsets array size so it is large enough.
Michael Niedermayer [Wed, 25 Jan 2012 22:23:35 +0000 (23:23 +0100)]
kgv1dec: Increase offsets array size so it is large enough.

Fixes CVE-2011-3945

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 807a045ab7f51993a2c1b3116016cbbd4f3d20d6)

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit a02e8df973f5478ec82f4c507f5b5b191a5ecb6b)

7 years agokmvc: Check palsize.
Alex Converse [Thu, 26 Jan 2012 16:30:49 +0000 (17:30 +0100)]
kmvc: Check palsize.

Fixes: CVE-2011-3952

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Based on fix by Michael Niedermayer
(cherry picked from commit 386741f887714d3e46c9e8fe577e326a7964037b)

7 years agonsvdec: Propagate errors
Alex Converse [Fri, 27 Jan 2012 01:23:09 +0000 (17:23 -0800)]
nsvdec: Propagate errors

Related to CVE-2011-3940.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit c898431ca5ef2a997fe9388b650f658fb60783e5)

Conflicts:

libavformat/nsvdec.c

7 years agonsvdec: Be more careful with av_malloc().
Alex Converse [Fri, 27 Jan 2012 01:21:46 +0000 (17:21 -0800)]
nsvdec: Be more careful with av_malloc().

Check results for av_malloc() and fix an overflow in one call.

Related to CVE-2011-3940.

Based in part on work from Michael Niedermayer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a)

7 years agonsvdec: Fix use of uninitialized streams.
Michael Niedermayer [Tue, 24 Jan 2012 21:20:26 +0000 (22:20 +0100)]
nsvdec: Fix use of uninitialized streams.

Fixes CVE-2011-3940 (Out of bounds read resulting in out of bounds write)

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c011706bc752d34bc6ada31d7df2ca0c9af7c6b)

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 6a89b41d9780325ba6d89a37f2aeb925aa68e6a3)

7 years agog722: Fix the QMF scaling
Martin Storsjö [Fri, 2 Mar 2012 15:03:06 +0000 (17:03 +0200)]
g722: Fix the QMF scaling

This fixes clipping if the encoder input used the full 16 bit
input range (samples with a magnitude below 16383 worked fine).
The filtered subband samples should be 15 bit maximum, while
the code earlier produced them scaled to 16 bit.

This makes the decoder output have double the magnitude
compared to before.

The spec reference samples doesn't test the QMF at all, which
was why this part slipped past initially.

(cherry picked from commit b087ce2bee81db8cc5caffb8f0a4f6c7c92a30fe)

Signed-off-by: Martin Storsjö <martin@martin.st>
7 years agoac3dsp: do not use pshufb in ac3_extract_exponents_ssse3()
Justin Ruggles [Thu, 9 Feb 2012 18:00:30 +0000 (13:00 -0500)]
ac3dsp: do not use pshufb in ac3_extract_exponents_ssse3()

We need to do unsigned saturation in order to cover the corner case when the
absolute coefficient value is 16777215 (the maximum value).

Fixes Bug #216
(cherry picked from commit d483bb58c318b0a6152709cf28263d72200b98f9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoFix format string vulnerability detected by -Wformat-security.
Fabian Greffrath [Mon, 5 Mar 2012 15:06:01 +0000 (16:06 +0100)]
Fix format string vulnerability detected by -Wformat-security.

Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit c9dbac36ad4bac07f6c1d06d465e361ab55bcb95)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoh264: fix mmxext chroma deblock to use correct TC values.
Ronald S. Bultje [Sun, 26 Feb 2012 16:57:14 +0000 (08:57 -0800)]
h264: fix mmxext chroma deblock to use correct TC values.
(cherry picked from commit b0c4f04338234ee011d7b704621347ef232294fe)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoh264: change underread for 10bit QPEL to overread.
Ronald S. Bultje [Sun, 26 Feb 2012 01:24:56 +0000 (17:24 -0800)]
h264: change underread for 10bit QPEL to overread.

This prevents us from reading before the start of the buffer, and thus
prevents crashes resulting from this behaviour. Fixes bug 237.
(cherry picked from commit 291c9b62855d555ac5385e23219461b6080da7db)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agocscd: use negative error values to indicate decode_init() failures.
Ronald S. Bultje [Wed, 29 Feb 2012 21:55:09 +0000 (13:55 -0800)]
cscd: use negative error values to indicate decode_init() failures.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8a9faf33f2b4f40afbc3393b2be49867cea0c92d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoamrnbdec: check frame size before decoding.
Vitor Sessak [Wed, 29 Feb 2012 21:09:10 +0000 (22:09 +0100)]
amrnbdec: check frame size before decoding.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 882abda5a26ffb8e3d1c5852dfa7cdad0a291d2d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoh264: prevent overreads in intra PCM decoding.
Ronald S. Bultje [Wed, 29 Feb 2012 02:48:27 +0000 (18:48 -0800)]
h264: prevent overreads in intra PCM decoding.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d1604b3de96575195b219028e2c4f08b2259aa7d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmaenc: fix m/s stereo encoding for the first frame
Justin Ruggles [Fri, 2 Mar 2012 22:11:25 +0000 (17:11 -0500)]
wmaenc: fix m/s stereo encoding for the first frame

We need to set ms_stereo in encode_init() in order to avoid incorrectly
encoding the first frame as non-m/s while flagging it as m/s. Fixes an
uncomfortable pop in the left channel at the start of playback.

CC:libav-stable@libav.org
(cherry picked from commit 51ddf35c9017018e58c15275ff5b129647a0c94d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmaenc: limit allowed sample rate to 48kHz
Justin Ruggles [Fri, 2 Mar 2012 21:27:57 +0000 (16:27 -0500)]
wmaenc: limit allowed sample rate to 48kHz

ff_wma_init() allows up to 50kHz, but this generates an exponent band
size table that requires 65 bands. The code assumes 25 bands in many
places, and using sample rates higher than 48kHz will lead to buffer
overwrites.

CC:libav-stable@libav.org
(cherry picked from commit 1ec075cfecac01f9a289965db06f76365b0b1737)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmaenc: limit block_align to MAX_CODED_SUPERFRAME_SIZE
Justin Ruggles [Fri, 2 Mar 2012 21:10:00 +0000 (16:10 -0500)]
wmaenc: limit block_align to MAX_CODED_SUPERFRAME_SIZE

This is near the theoretical limit for wma frame size and is the most that
our decoder can handle. Allowing higher bit rates will just end up padding
each frame with empty bytes.

Fixes invalid writes for avconv when using very high bit rates.

CC:libav-stable@libav.org
(cherry picked from commit c2b8dea1828f35c808adcf12615893d5c740bc0a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmaenc: require a large enough output buffer to prevent overwrites
Justin Ruggles [Fri, 2 Mar 2012 21:33:33 +0000 (16:33 -0500)]
wmaenc: require a large enough output buffer to prevent overwrites

The maximum theoretical frame size is around 17000 bytes. Although in
practice it will generally be much smaller, we require a larger buffer
just to be safe.

CC: libav-stable@libav.org
(cherry picked from commit dfc4fdedf8cfc56a505579b1f2c1c5efbce4b97e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agompegts: Do not call read_sl_header() when no bytes remain in the buffer.
Alex Converse [Fri, 2 Mar 2012 18:12:11 +0000 (10:12 -0800)]
mpegts: Do not call read_sl_header() when no bytes remain in the buffer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 4df369692ea8aee7094ac0f233cef8d1bee139a3)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agompegts: Pad the packet buffer in handle_packet().
Alex Converse [Fri, 2 Mar 2012 18:13:07 +0000 (10:13 -0800)]
mpegts: Pad the packet buffer in handle_packet().

This allows it to be used with get_bits without the thread of overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 1aa708988ac131cf7d5c8bd59aca256a7c974df9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoamrwb: remove duplicate arguments from extrapolate_isf().
Ronald S. Bultje [Thu, 1 Mar 2012 23:44:25 +0000 (15:44 -0800)]
amrwb: remove duplicate arguments from extrapolate_isf().

Prevents warnings because the dst and src overlap (are the same) in the
memcpy() inside the function.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9d87374ec0f382c8394ad511243db6980afa42af)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoamrwb: error out early if mode is invalid.
Ronald S. Bultje [Thu, 1 Mar 2012 21:51:21 +0000 (13:51 -0800)]
amrwb: error out early if mode is invalid.

Prevents using the invalid mode as an index in a static array, which
would generate invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 154b8bb80029e71d562e8936164266300dd35a0e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agomatroska: check buffer size for RM-style byte reordering.
Ronald S. Bultje [Fri, 2 Mar 2012 01:01:22 +0000 (17:01 -0800)]
matroska: check buffer size for RM-style byte reordering.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9c239f6026a170866a4a0c96908980ac2cfaa8b3)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowma: fix invalid buffer size assumptions causing random overreads.
Ronald S. Bultje [Fri, 2 Mar 2012 00:19:51 +0000 (16:19 -0800)]
wma: fix invalid buffer size assumptions causing random overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 349b7977e408f18cff01ab31dfa66c8249b6584a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agowmadec: Verify bitstream size makes sense before calling init_get_bits.
Alex Converse [Fri, 27 Jan 2012 22:24:07 +0000 (14:24 -0800)]
wmadec: Verify bitstream size makes sense before calling init_get_bits.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 48f1e5212c90b511c90fa0449655abb06a9edda2)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agorv10/20: Fix a buffer overread caused by losing track of the remaining buffer size.
Alex Converse [Thu, 1 Mar 2012 22:07:22 +0000 (14:07 -0800)]
rv10/20: Fix a buffer overread caused by losing track of the remaining buffer size.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2f6528537fdd88820f3a4683d5e595d7b3a62689)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agolcl: return negative error codes on decode_init() errors.
Ronald S. Bultje [Thu, 1 Mar 2012 01:50:28 +0000 (17:50 -0800)]
lcl: return negative error codes on decode_init() errors.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit bd17a40a7e0eba21b5d27c67aff795e2910766e4)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoavutil: add AVERROR_UNKNOWN
Justin Ruggles [Sat, 25 Feb 2012 04:27:14 +0000 (23:27 -0500)]
avutil: add AVERROR_UNKNOWN

Useful to return instead of -1 when the cause of the error is unknown,
typically from an external library.
(cherry picked from commit c9bca801324f03746757aef8549ebd26599adec2)

Conflicts:

doc/APIchanges
libavutil/avutil.h

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoh264: error out on invalid bitdepth.
Ronald S. Bultje [Thu, 1 Mar 2012 19:56:05 +0000 (11:56 -0800)]
h264: error out on invalid bitdepth.

Fixes invalid reads while initializing the dequant tables, which uses
the bit depth to determine the QP table size.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 0ce4fe482c27abfa7eac503a52fdc50b70ccd871)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agohuffyuv: do not abort on unknown pix_fmt; instead, return an error.
Ronald S. Bultje [Thu, 1 Mar 2012 17:41:22 +0000 (09:41 -0800)]
huffyuv: do not abort on unknown pix_fmt; instead, return an error.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 63c9de6469005974288f4e4d89fc79a590e38c06)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agovmnc: return error on decode_init() failure.
Ronald S. Bultje [Wed, 29 Feb 2012 03:00:48 +0000 (19:00 -0800)]
vmnc: return error on decode_init() failure.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 07a180972fb369bb59bf6d4f8edb4598c51e80d2)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agorpza: error out on buffer overreads.
Ronald S. Bultje [Wed, 29 Feb 2012 01:04:33 +0000 (17:04 -0800)]
rpza: error out on buffer overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 78e9852a2e3b198ecd69ffa0deab3fa22a8e5378)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoqtrle: return error on decode_init() failure.
Ronald S. Bultje [Wed, 29 Feb 2012 03:00:39 +0000 (19:00 -0800)]
qtrle: return error on decode_init() failure.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e54ae60e46f737b8e9a96548971091f7ab6b8f7c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoswscale: fix another integer overflow.
Ronald S. Bultje [Wed, 29 Feb 2012 02:21:31 +0000 (18:21 -0800)]
swscale: fix another integer overflow.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 791de61bbb0d2bceb1037597b310e2a4a94494fd)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agovp56: error out on invalid stream dimensions.
Ronald S. Bultje [Thu, 23 Feb 2012 19:19:33 +0000 (11:19 -0800)]
vp56: error out on invalid stream dimensions.

Prevents crashes when playing corrupt vp5/6 streams.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8bc396fc0e8769a056375c1c211f389ce0e3ecc5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoasf: don't seek back on EOF.
Ronald S. Bultje [Wed, 29 Feb 2012 00:13:46 +0000 (16:13 -0800)]
asf: don't seek back on EOF.

Seeking back on EOF will reset the EOF flag, causing us to re-enter
the loop to find the next marker in the ASF file, thus potentially
causing an infinite loop.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit bb6d5411e1e1a8e0608b1af1c4addee654dcbac5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoasf: error out on ridiculously large minpktsize values.
Ronald S. Bultje [Fri, 17 Feb 2012 20:21:22 +0000 (12:21 -0800)]
asf: error out on ridiculously large minpktsize values.

They cause various issues further down in demuxing.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6e57a02b9f639af53acfa9fc742c1341400818f8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agolavf: add functions for accessing the fourcc<->CodecID mapping tables.
Anton Khirnov [Fri, 27 Jan 2012 12:33:09 +0000 (13:33 +0100)]
lavf: add functions for accessing the fourcc<->CodecID mapping tables.

Fixes bug 212.
(cherry picked from commit dd6d3b0e025cb2a16022665dbb8ab1be18dc05e8)

Conflicts:

doc/APIchanges

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoavutil: make intfloat api public
Paul B Mahol [Sun, 29 Jan 2012 20:09:22 +0000 (20:09 +0000)]
avutil: make intfloat api public

The functions are already av_ prefixed and intfloat header is already provided.
Install libavutil/intfloat.h

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 8b933129b932f523a746e921a0a20b8dd8816971)

Conflicts:

doc/APIchanges

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agomjpegbdec: Fix overflow in SOS.
Alex Converse [Wed, 25 Jan 2012 21:39:24 +0000 (13:39 -0800)]
mjpegbdec: Fix overflow in SOS.

Based in part by a fix from Michael Niedermayer <michaelni@gmx.at>

Fixes CVE-2011-3947

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit b57d262412204e54a7ef8fa1b23ff4dcede622e5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agooma: don't read beyond end of leaf_table.
Ronald S. Bultje [Tue, 28 Feb 2012 19:35:36 +0000 (11:35 -0800)]
oma: don't read beyond end of leaf_table.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 934cd18a43151ba4b819d9270d539cdb26f6e079)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoIndeo3: fix crashes on corrupt bitstreams.
Ronald S. Bultje [Tue, 28 Feb 2012 18:22:28 +0000 (10:22 -0800)]
Indeo3: fix crashes on corrupt bitstreams.

Splits at borders of cells are invalid, since it leaves one of the
cells with a width/height of zero. Also, propagate errors on buffer
allocation failures, so we don't continue decoding (which crashes).

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit fc9bc08dca9ac32526251e19fcf738d23b8c68d1)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agovorbis: fix overflows in floor1[] vector and inverse db table index.
Ronald S. Bultje [Wed, 11 Jan 2012 01:01:26 +0000 (17:01 -0800)]
vorbis: fix overflows in floor1[] vector and inverse db table index.

(cherry picked from commit 24947d4988012f1f0fd467c83418615adc11c3e8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoFix parser not to clobber has_b_frames when extradata is set.
Reinhard Tartler [Sun, 26 Feb 2012 09:50:45 +0000 (10:50 +0100)]
Fix parser not to clobber has_b_frames when extradata is set.

Because in contrast to the decoder, the parser does not setup low_delay.
The code in parse_nal_units would always end up setting has_b_frames
to "1", except when stream is explicitly marked as low delay.
Since the parser itself would create 'extradata', simply reopening
the parser would cause this.

This happens for instance in estimate_timings_from_pts(), which causes the
parser to be reopened on the same stream.

This fixes Libav #22 and FFmpeg (trac) #360

CC: libav-stable@libav.org
Based on a patch by Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(commit 31ac0ac29b6bba744493f7d1040757a3f51b9ad7)

Comments and description adapted by Reinhard Tartler.

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 790a367d9ecd04360f78616765ee723f3fe65645)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agorm: prevent infinite loops for index parsing.
Ronald S. Bultje [Wed, 22 Feb 2012 19:33:24 +0000 (11:33 -0800)]
rm: prevent infinite loops for index parsing.

Specifically, prevent jumping back in the file for the next index, since
this can lead to infinite loops where we jump between indexes referring
to each other, and don't read indexes that don't fit in the file.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit aac07a7a4c2c7a4a29cf6dbc88c1b9fdd191b99d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agofraps: release reference buffer on pix_fmt change.
Ronald S. Bultje [Fri, 24 Feb 2012 22:11:04 +0000 (14:11 -0800)]
fraps: release reference buffer on pix_fmt change.

Prevents crash when trying to copy from a non-existing plane in e.g.
a RGB32 reference image to a YUV420P target image

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 830f70442a87a31f7c75565e9380e3caf8333b8a)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agokgv1: release reference picture on size change.
Ronald S. Bultje [Sat, 25 Feb 2012 00:27:53 +0000 (16:27 -0800)]
kgv1: release reference picture on size change.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 6c4c27adb61b2881a94ce5c7d97ee1c8adadb5fe)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agokgv1: use avctx->get/release_buffer().
Ronald S. Bultje [Thu, 29 Dec 2011 17:07:32 +0000 (09:07 -0800)]
kgv1: use avctx->get/release_buffer().

Also fixes crashes on corrupt bitstreams.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 33cd32b389864f2437c94e6fd7dc109ff5f0ed06)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agolcl: error out if uncompressed input buffer is smaller than framesize.
Ronald S. Bultje [Fri, 24 Feb 2012 00:09:36 +0000 (16:09 -0800)]
lcl: error out if uncompressed input buffer is smaller than framesize.

This prevents crashes when trying to read beyond the end of the buffer
while decoding frame data.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit be129271eac04f91393bf42a490ec631e1a9abea)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agomjpeg: abort decoding if packet is too large.
Ronald S. Bultje [Thu, 23 Feb 2012 20:22:40 +0000 (12:22 -0800)]
mjpeg: abort decoding if packet is too large.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit ab492ca2ab105aeb24d955f3f03756bdb3139ee1)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agotiff: Prevent overreads in the type_sizes array.
Alex Converse [Thu, 23 Feb 2012 18:47:50 +0000 (10:47 -0800)]
tiff: Prevent overreads in the type_sizes array.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 447363870f2f91e125e07ac2d0820359a5d86b06)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoswf: check return values for av_get/new_packet().
Ronald S. Bultje [Thu, 23 Feb 2012 19:53:27 +0000 (11:53 -0800)]
swf: check return values for av_get/new_packet().

Prevents crashers when using the packet if allocation failed.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 31632e73f47d25e2077fce729571259ee6354854)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agotruemotion2: error out if the huffman tree has no nodes.
Ronald S. Bultje [Wed, 22 Feb 2012 20:19:52 +0000 (12:19 -0800)]
truemotion2: error out if the huffman tree has no nodes.

This prevents crashers and errors further down when reading nodes in the
empty tree.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2b83e8b7005d531bc78b0fd4f699e9faa54ce9bb)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agormdec: when using INT4 deinterleaving, error out if sub_packet_h <= 1.
Ronald S. Bultje [Tue, 21 Feb 2012 18:36:27 +0000 (10:36 -0800)]
rmdec: when using INT4 deinterleaving, error out if sub_packet_h <= 1.

We read sub_packet_h / 2 packets per line of data (during deinterleaving),
which equals zero if sub_packet_h <= 1, thus causing us to not read any
data, leading to an infinite loop.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e30b3e59a4f3004337cb1623b2aac988ce52b93f)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoavplay: fix -threads option
Janne Grunau [Tue, 21 Feb 2012 15:34:08 +0000 (16:34 +0100)]
avplay: fix -threads option

The AVOptions based default to threads auto in 2473a45c8
works only if avplay does not use custom option handling
for -threads.

CC: <libav-stable@libav.org>
(cherry picked from commit e48a70e6da02cd5426b6340af70410bdfe27dfa7)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agovc1parse: call vc1_init_common().
Ronald S. Bultje [Fri, 17 Feb 2012 22:18:22 +0000 (14:18 -0800)]
vc1parse: call vc1_init_common().

The parser uses VLC tables initialized in vc1_common_init(), therefore
we should call this function on parser init also.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c742ab4e81bb9dcabfdab006d6b8b09a5808c4ce)

Conflicts:

libavcodec/vc1.h

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agowma: don't return 0 on invalid packets.
Ronald S. Bultje [Sat, 18 Feb 2012 00:57:00 +0000 (16:57 -0800)]
wma: don't return 0 on invalid packets.

Return 0 means "please return the same data again", i.e. it causes an
infinite loop. Instead, return an error.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9d3050d3e95e307ebc34a943484c7add838d1220)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agomjpegb: don't return 0 at the end of frame decoding.
Ronald S. Bultje [Sat, 18 Feb 2012 00:27:36 +0000 (16:27 -0800)]
mjpegb: don't return 0 at the end of frame decoding.

Return 0 indicates "please return the same data again", i.e. it causes
an infinite loop. Instead, return that we consumed the buffer if we
finished decoding succesfully, or return an error if an error occurred.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 74699ac8c8b562e9f8d26e21482b89585365774a)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoasf: prevent packet_size_left from going negative if hdrlen > pktlen.
Ronald S. Bultje [Fri, 17 Feb 2012 20:21:18 +0000 (12:21 -0800)]
asf: prevent packet_size_left from going negative if hdrlen > pktlen.

This prevents failed assertions further down in the packet processing
where we require non-negative values for packet_size_left.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 41afac7f7a67c634c86b1d17fc930e9183d4aaa0)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoaiff: don't skip block_align==0 check on COMM-after-SSND files.
Ronald S. Bultje [Fri, 17 Feb 2012 23:51:27 +0000 (15:51 -0800)]
aiff: don't skip block_align==0 check on COMM-after-SSND files.

This prevents SIGFPEs when using block_align for divisions.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 32a659c758bf2ddd8ad48f18c06fa77444341286)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agomp3on4: require a minimum framesize.
Ronald S. Bultje [Fri, 17 Feb 2012 23:20:27 +0000 (15:20 -0800)]
mp3on4: require a minimum framesize.

If bufsize < headersize, init_get_bits() will be called with a negative
number, causing it to fail and any subsequent call to get_bits() will
crash because it reads from a NULL pointer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3e13005cac6e076053276b515f5fcf59a3f4b65d)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agohuffyuv: error out on bit overrun.
Ronald S. Bultje [Fri, 17 Feb 2012 23:00:47 +0000 (15:00 -0800)]
huffyuv: error out on bit overrun.

On EOF, get_bits() will continuously return 0, causing an infinite
loop.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 84c202cc37024bd78261e4222e46631ea73c48dd)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoals: prevent infinite loop in zero_remaining().
Ronald S. Bultje [Fri, 17 Feb 2012 20:28:26 +0000 (12:28 -0800)]
als: prevent infinite loop in zero_remaining().

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit af468015d972c0dec5c8c37b2685ffa5cbe4ae87)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agocook: prevent div-by-zero if channels is zero.
Ronald S. Bultje [Fri, 17 Feb 2012 20:10:33 +0000 (12:10 -0800)]
cook: prevent div-by-zero if channels is zero.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 941fc1ea1ed7f7d99a8b9e2607b41f2f2820394a)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agovc1: prevent using last_frame as a reference for I/P first frame.
Ronald S. Bultje [Tue, 14 Feb 2012 20:40:19 +0000 (12:40 -0800)]
vc1: prevent using last_frame as a reference for I/P first frame.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit ae591aeea58d64399b8281be31dacec0de85ae04)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoswscale: take first/lastline over/underflows into account for MMX.
Ronald S. Bultje [Thu, 23 Feb 2012 00:48:38 +0000 (16:48 -0800)]
swscale: take first/lastline over/underflows into account for MMX.

Fixes crashes for extremely large resizes (several 100-fold).

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 1d8c4af396b6ed84c84b5ebf0bf1163c4a7a3017)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoswscale: fix overflows in filterPos[] calculation for large sizes.
Ronald S. Bultje [Thu, 23 Feb 2012 00:46:31 +0000 (16:46 -0800)]
swscale: fix overflows in filterPos[] calculation for large sizes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 19a65b5be47944c607a9e979edb098924d95f2e4)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoswscale: enforce a minimum filtersize.
Ronald S. Bultje [Sat, 11 Feb 2012 16:42:28 +0000 (08:42 -0800)]
swscale: enforce a minimum filtersize.

At very small dimensions, this calculation could lead to zero-sized
filters, which leads to uninitialized output, zero-sized allocations,
loop overflows in SIMD that uses do{..}while(i++<filtersize); instead
of for(i=0;i<filtersize;i++){..} and several other similar failures.
Therefore, require a minimum filtersize of 1.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit dae2ce361a2b5fd9be1d43e5e8c00bdbc5f03e3d)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agotta: error out if samplerate is zero.
Ronald S. Bultje [Fri, 10 Feb 2012 18:51:43 +0000 (10:51 -0800)]
tta: error out if samplerate is zero.

Prevents a division by zero later on.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7416d610362807848236ceff1bc6740dbc82842d)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agovc1: prevent null pointer dereference on broken files
Janne Grunau [Wed, 25 Jan 2012 14:49:54 +0000 (15:49 +0100)]
vc1: prevent null pointer dereference on broken files

CC: libav-stable@libav.org
(cherry picked from commit 510ef04a461b3b54a762c6141ad880cbed85981f)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agosmacker: Sanity check huffman tables found in the headers.
Alex Converse [Thu, 26 Jan 2012 00:12:42 +0000 (16:12 -0800)]
smacker: Sanity check huffman tables found in the headers.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9adf25c1cf78dbf1d71bf386c49dc74cb8a60df0)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agolavf: prevent infinite loops while flushing in avformat_find_stream_info
Janne Grunau [Wed, 18 Jan 2012 09:59:32 +0000 (10:59 +0100)]
lavf: prevent infinite loops while flushing in avformat_find_stream_info

If no data was seen for a stream decoder are returning 0 when fed with
empty packets for flushing. We can stop flushing when the decoder does
not return delayed delayed frames anymore. Changes try_decode_frame()
return value to got_picture or negative error.

CC: libav-stable@libav.org
(cherry picked from commit b3461c29c1aee7d62eeb02a59d46593c60362679)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agomatroska: don't overwrite string values until read/alloc was succesful.
Ronald S. Bultje [Sat, 25 Feb 2012 00:12:18 +0000 (16:12 -0800)]
matroska: don't overwrite string values until read/alloc was succesful.

This prevents certain tags with a default value assigned to them (as per
the EBML syntax elements) from ever being assigned a NULL value. Other
parts of the code rely on these being non-NULL (i.e. they don't check for
NULL before e.g. using the string in strcmp() or similar), and thus in
effect this prevents crashes when reading of such specific tags fails,
either because of low memory or because of targeted file corruption.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cd40c31ee9ad2cca6f3635950b002fd46be07e98)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agomatroskadec: Pad AAC extradata.
Alex Converse [Wed, 25 Jan 2012 22:34:21 +0000 (14:34 -0800)]
matroskadec: Pad AAC extradata.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d2ee8c17793201ce969afd1f433ba1580c143cd2)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoaac: fix infinite loop on end-of-frame with sequence of 1-bits.
Alex Converse [Wed, 22 Feb 2012 19:05:42 +0000 (11:05 -0800)]
aac: fix infinite loop on end-of-frame with sequence of 1-bits.

Based-on-work-by: Ronald S. Bultje <rsbultje@gmail.com>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 1cd9a6154bc1ac1193c703cea980ed21c3e53792)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agowma: Clip WMA1 and WMA2 frame length to 11 bits.
Alex Converse [Wed, 25 Jan 2012 02:43:43 +0000 (18:43 -0800)]
wma: Clip WMA1 and WMA2 frame length to 11 bits.

The MDCT buffers in the decoder are only sized for up to 11 bits. The
reverse engineered documentation for WMA1/2 headers say that that for
all samplerates above 32kHz 11 bits are used. 12 and 13 bit support
were added for WMAPro. I was unable to make any Microsoft tools generate
a test file at a samplerate above 48kHz.

Discovered by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

CC: libav-stable@libav.org
(cherry picked from commit d78bb1a4b2a3a415b68e4e6dd448779eccec64e3)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agorv20: prevent calling ff_h263_decode_mba() with unset height/width
Janne Grunau [Tue, 24 Jan 2012 20:50:50 +0000 (21:50 +0100)]
rv20: prevent calling ff_h263_decode_mba() with unset height/width

Prevents a crash of VLC during playback of a invalid matroska file,
found by John Villamil <johnv@matasano.com>.

CC: libav-stable@libav.org
(cherry picked from commit c3e10ae4127c998b809066926a410f40ebd47593)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
7 years agoflac: fix infinite loops on all-zero input or end-of-stream.
Ronald S. Bultje [Wed, 15 Feb 2012 17:52:11 +0000 (09:52 -0800)]
flac: fix infinite loops on all-zero input or end-of-stream.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 52e4018be47697a60f4f18f83551766df31f5adf)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agogolomb: use HAVE_BITS_REMAINING() macro to prevent infloop on EOF.
Ronald S. Bultje [Fri, 17 Feb 2012 20:54:37 +0000 (12:54 -0800)]
golomb: use HAVE_BITS_REMAINING() macro to prevent infloop on EOF.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 46b3fbc30b7aaf7fdd52391734cfd6d93af8720a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoget_bits: add HAVE_BITS_REMAINING macro.
Ronald S. Bultje [Wed, 22 Feb 2012 20:09:33 +0000 (12:09 -0800)]
get_bits: add HAVE_BITS_REMAINING macro.

(cherry picked from commit b44b41633f110e9d938165e0f79c9d32191fc135)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agogolomb: avoid infinite loop on all-zero input (or end of buffer).
Ronald S. Bultje [Tue, 14 Feb 2012 19:50:57 +0000 (11:50 -0800)]
golomb: avoid infinite loop on all-zero input (or end of buffer).

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c6643fddba73560f26f90d327c84d8832222a720)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoshorten: Use separate pointers for the allocated memory for decoded samples.
Michael Niedermayer [Sun, 25 Dec 2011 11:28:50 +0000 (12:28 +0100)]
shorten: Use separate pointers for the allocated memory for decoded samples.

Fixes invalid free() if any of the buffers are not allocated due to either
not decoding a header or an error prior to allocating all buffers.

Fixes CVE-2012-0858
CC: libav-stable@libav.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 204cb29b3c84a74cbcd059d353c70c8bdc567d98)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoatrac3: Fix crash in tonal component decoding.
Michael Niedermayer [Sat, 17 Dec 2011 02:18:58 +0000 (03:18 +0100)]
atrac3: Fix crash in tonal component decoding.

Add a check to avoid writing past the end of the channel_unit.components[]
array.

Bug Found by: cosminamironesei
Fixes CVE-2012-0853
CC: libav-stable@libav.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit c509f4f74713b035a06f79cb4d00e708f5226bc5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agows_snd1: Fix wrong samples count and crash.
Michael Niedermayer [Sat, 24 Dec 2011 23:10:27 +0000 (00:10 +0100)]
ws_snd1: Fix wrong samples count and crash.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9fb7a5af97d8c084c3af2566070d09eae0ab49fc)

Addresses CVE-2012-0848

Reviewed-by: Justin Ruggles <justin.ruggles@gmail.com>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoh264: disallow constrained intra prediction modes for luma.
Ronald S. Bultje [Fri, 10 Feb 2012 06:57:01 +0000 (22:57 -0800)]
h264: disallow constrained intra prediction modes for luma.

Conversion of the luma intra prediction mode to one of the constrained
("alzheimer") ones can happen by crafting special bitstreams, causing
a crash because we'll call a NULL function pointer for 16x16 block intra
prediction, since constrained intra prediction functions are only
implemented for chroma (8x8 blocks).

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 45b7bd7c53b41bc5ff6fc2158831f2b1b1256113)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoswscale: fix V plane memory location in bilinear/unscaled RGB/YUYV case.
Ronald S. Bultje [Tue, 7 Feb 2012 19:33:20 +0000 (11:33 -0800)]
swscale: fix V plane memory location in bilinear/unscaled RGB/YUYV case.

Fixes bug 221.

CC: libav-stable@libav.org
(cherry picked from commit b7542dd3d71d1ee873277020b6a8eab2674bb167)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agolibavcodec: Don't crash in avcodec_encode_audio if time_base isn't set
Martin Storsjö [Thu, 26 Jan 2012 19:37:38 +0000 (21:37 +0200)]
libavcodec: Don't crash in avcodec_encode_audio if time_base isn't set

Earlier, calling avcodec_encode_audio worked fine even if time_base
wasn't set. Now it crashes due to trying to scale the output pts to
the codec context time base. This affects e.g. VLC.

If no time_base is set for audio codecs, set it to the sample
rate.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 9a7dc618c50902e7a171f2deda6430d52c277a95)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agoqdm2: Check data block size for bytes to bits overflow.
Alex Converse [Wed, 25 Jan 2012 23:27:11 +0000 (15:27 -0800)]
qdm2: Check data block size for bytes to bits overflow.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit dac56d9ce01eb9963f28f26b97a81db5cbd46c1c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agolavc: set AVCodecContext.codec in avcodec_get_context_defaults3().
Anton Khirnov [Sat, 28 Jan 2012 18:15:15 +0000 (19:15 +0100)]
lavc: set AVCodecContext.codec in avcodec_get_context_defaults3().

This way, if the AVCodecContext is allocated for a specific codec, the
caller doesn't need to store this codec separately and then pass it
again to avcodec_open2().

It also allows to set codec private options using av_opt_set_* before
opening the codec.
(cherry picked from commit bc901998487bf9b77a423961d9f961bcc28a9291)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
7 years agolavc: make avcodec_close() work properly on unopened codecs.
Anton Khirnov [Sun, 29 Jan 2012 11:17:30 +0000 (12:17 +0100)]
lavc: make avcodec_close() work properly on unopened codecs.

I.e. free the priv_data and other stuff allocated in
avcodec_alloc_context3() and not segfault.

(cherry picked from commit 0e72ad95f9fef6a6b8ae55e47339a5c40526502f)

7 years agolavc: add avcodec_is_open().
Anton Khirnov [Thu, 8 Dec 2011 05:57:44 +0000 (06:57 +0100)]
lavc: add avcodec_is_open().

It allows to check whether an AVCodecContext is open in a documented
way. Right now the undocumented way this check is done in lavf/lavc is
by checking whether AVCodecContext.codec is NULL. However it's desirable
to be able to set AVCodecContext.codec before avcodec_open2().

(cherry picked from commit af08d9aeea870de017139f7b1c44b7d816cf8e56)

Conflicts:

doc/APIchanges

7 years agoFinalize changelog for 0.8 Release
Reinhard Tartler [Sat, 21 Jan 2012 17:37:25 +0000 (18:37 +0100)]
Finalize changelog for 0.8 Release

7 years agoPrepare for 0.8 Release
Reinhard Tartler [Sat, 21 Jan 2012 13:54:31 +0000 (14:54 +0100)]
Prepare for 0.8 Release

7 years agothreads: change the default for threads back to 1
Janne Grunau [Wed, 18 Jan 2012 09:53:41 +0000 (10:53 +0100)]
threads: change the default for threads back to 1

Using threaded decoding by default breaks backward compatibility if
AVHWAccel is used or if an appliction sets threadunsafe callbacks.
Avconv and avplay still use -threads auto if not specified.

7 years agothreads: update slice_count and slice_offset from user context
Janne Grunau [Fri, 20 Jan 2012 12:37:00 +0000 (13:37 +0100)]
threads: update slice_count and slice_offset from user context

They are used to signal the number of slices and offsets of each slice
out of band to the decoder.

7 years agoaviocat: Remove useless includes
Martin Storsjö [Sat, 21 Jan 2012 09:33:35 +0000 (11:33 +0200)]
aviocat: Remove useless includes

Also include stdlib.h explicitly - currently it is used
implicitly via avformat.h.

Signed-off-by: Martin Storsjö <martin@martin.st>
7 years agodoc/APIChanges: fill in missing dates and hashes
Anton Khirnov [Sat, 21 Jan 2012 07:48:53 +0000 (08:48 +0100)]
doc/APIChanges: fill in missing dates and hashes

7 years agoRevert "avserver: fix build after the next bump."
Anton Khirnov [Sat, 21 Jan 2012 07:40:47 +0000 (08:40 +0100)]
Revert "avserver: fix build after the next bump."

This temporarily (until 0.8 is released) reverts commit
8e1340abc316e038bb89e5a3b46e92ff58c98a88. That commit breaks shared
builds because of symbol hiding. Reverting it will enable shared builds
for 0.8

7 years agompegaudiodec: switch error detection check to AV_EF_BUFFER
Dustin Brody [Mon, 16 Jan 2012 13:25:04 +0000 (08:25 -0500)]
mpegaudiodec: switch error detection check to AV_EF_BUFFER

Signed-off-by: Anton Khirnov <anton@khirnov.net>