ffmpeg.git
5 years agoupdate for 1.1.9 n1.1.9
Michael Niedermayer [Fri, 7 Mar 2014 03:14:03 +0000 (04:14 +0100)]
update for 1.1.9

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/utvideoenc: fix slice_bits size
Michael Niedermayer [Sat, 1 Mar 2014 01:40:19 +0000 (02:40 +0100)]
avcodec/utvideoenc: fix slice_bits size

Fixes assertion failure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0a8c90202bb906747168a698b6837496f82c717c)

Conflicts:

libavcodec/utvideoenc.c
(cherry picked from commit 57522ca79cc38c279123596d3288ddbf56fa8903)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/snow: split block clipping checks
Michael Niedermayer [Tue, 18 Feb 2014 01:53:14 +0000 (02:53 +0100)]
avcodec/snow: split block clipping checks

Fixes out of array read
Fixes: d4476f68ca1c1c57afbc45806f581963-asan_heap-oob_2266b27_8607_cov_4044577381_snow_chroma_bug.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 61d59703c91869f4e5cdacd8d6be52f8b89d4ba4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/ansi: fix integer overflow
Michael Niedermayer [Mon, 17 Feb 2014 19:49:42 +0000 (20:49 +0100)]
avcodec/ansi: fix integer overflow

Fixes out of array read
Fixes: 5f9698e86d92f19bb08d54ff0d57027f-signal_sigsegv_b30756_3795_cov_2693691257_ansi256.ans
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d42ec8433c687fcbccefa51a7716d81920218e4f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/msrle: use av_image_get_linesize() to calculate the linesize
Michael Niedermayer [Sun, 16 Feb 2014 22:08:52 +0000 (23:08 +0100)]
avcodec/msrle: use av_image_get_linesize() to calculate the linesize

Fixes out of array access
Fixes: 14a74a0a2dc67ede543f0e35d834fbbe-asan_heap-oob_49572c_556_cov_215466444_44_001_engine_room.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c919e1ca2ecfc47d796382973ba0e48b8f6f92a2)

Conflicts:

libavcodec/msrle.c
(cherry picked from commit bc1c8ec5e65098fd2ccd8456f667151dfc9cda42)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavformat/mpegtsenc: Check data array size in mpegts_write_pmt()
Michael Niedermayer [Thu, 13 Feb 2014 12:59:51 +0000 (13:59 +0100)]
avformat/mpegtsenc: Check data array size in mpegts_write_pmt()

Prevents out of array writes

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 842b6c14bcfc1c5da1a2d288fd65386eb8c158ad)

Conflicts:

libavformat/mpegtsenc.c
(cherry picked from commit e87de3f50b765134588d0b048c32ed4b8acc16fb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/wmalosslessdec: fix mclms_coeffs* array size
Michael Niedermayer [Fri, 7 Feb 2014 14:07:23 +0000 (15:07 +0100)]
avcodec/wmalosslessdec: fix mclms_coeffs* array size

Fixes corruption of context
Fixes: 8835659dde6a4f7dcdf341de6a45c6c8-signal_sigsegv_1dce67b_4564_cov_2504444599_classical_22_16_1_14000_v3c_0_extend_0_29.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ec9578d54d09b64bf112c2bf7a34b1ef3b93dbd3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavdevice/v4l2: only use average frame rate if set
Michael Niedermayer [Sat, 1 Feb 2014 23:11:16 +0000 (00:11 +0100)]
avdevice/v4l2: only use average frame rate if set

It might be unset on some platforms with some drivers and some input

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0997c2504b25cbc2856800fc063395dcd40b2bf7)

Conflicts:

libavdevice/v4l2.c

5 years agoavdevice/v4l2: only use frame period from v4l2 if valid
Michael Niedermayer [Sat, 1 Feb 2014 23:10:43 +0000 (00:10 +0100)]
avdevice/v4l2: only use frame period from v4l2 if valid

There is evidence that some drivers do not set a valid value

See: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718805
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4aa4533ee8b51a1e6bdc4fbffaf90aa2b14e2c9f)

Conflicts:

libavdevice/v4l2.c

5 years agoavutil/log: skip IO calls on empty strings
Michael Niedermayer [Fri, 6 Dec 2013 22:30:34 +0000 (23:30 +0100)]
avutil/log: skip IO calls on empty strings

These occur when no context is set for example, thus they are common

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a044a183a3fb90b20a8deaa3ea1158510bcdd420)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/libopusenc: change default frame duration to 20 ms
Paul B Mahol [Fri, 15 Nov 2013 01:09:06 +0000 (01:09 +0000)]
avcodec/libopusenc: change default frame duration to 20 ms

20 ms is used by libopus encoder.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit 74906d3727ec3bd9b7b28dfa7a98ff6e8cf8b6d7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/jpeglsdec: check err value for ls_get_code_runterm()
Michael Niedermayer [Wed, 30 Oct 2013 22:27:28 +0000 (23:27 +0100)]
avcodec/jpeglsdec: check err value for ls_get_code_runterm()

Fixes infinite loop
Fixes Ticket3086

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc0e47b55096361723b364afa43b79a3f5619cdc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavutil/opt: initialize ret
Michael Niedermayer [Sun, 20 Oct 2013 16:38:48 +0000 (18:38 +0200)]
avutil/opt: initialize ret

Fixes CID1108610
Fixes use of uninitialized variable

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2d8ccf0adcae09cb9e14b01cfe20e4d77c3bbf5d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/avpacket/av_packet_split_side_data: ensure that side data padding is initialized
Michael Niedermayer [Sat, 19 Oct 2013 15:45:54 +0000 (17:45 +0200)]
avcodec/avpacket/av_packet_split_side_data: ensure that side data padding is initialized

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 240fd8c96f59ebe9dcfc4152a1086cd3f63400c0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e48318802b3caa493a40c0584afc30cc866d9d0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge remote-tracking branch 'qatar/release/9' into release/1.1
Michael Niedermayer [Fri, 7 Mar 2014 02:59:11 +0000 (03:59 +0100)]
Merge remote-tracking branch 'qatar/release/9' into release/1.1

* qatar/release/9:
  arm: hpeldsp: prevent overreads in armv6 asm

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit '798c715f4fa5cde37456af6202a32ee62cfb96d9' into release/1.1
Michael Niedermayer [Fri, 7 Mar 2014 02:54:51 +0000 (03:54 +0100)]
Merge commit '798c715f4fa5cde37456af6202a32ee62cfb96d9' into release/1.1

* commit '798c715f4fa5cde37456af6202a32ee62cfb96d9':
  configure: enable PIC on s390(x)
  ituh263: reject b-frame with pp_time = 0
  lagarith: reallocate rgb_planes when needed
  truemotion1: check the header size
  shorten: pad the internal bitstream buffer
  samplefmt: avoid integer overflow in av_samples_get_buffer_size()

Conflicts:
libavcodec/lagarith.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit '8883b5f85bfe35509633bc590d19b6a1b495690e' into release/1.1
Michael Niedermayer [Fri, 7 Mar 2014 02:09:32 +0000 (03:09 +0100)]
Merge commit '8883b5f85bfe35509633bc590d19b6a1b495690e' into release/1.1

* commit '8883b5f85bfe35509633bc590d19b6a1b495690e':
  h264: Fix a typo from the previous commit
  h264: Lower bound check for slice offsets
  Add missing header to fix compilation after d2a0654
  Prepare for 9.12 RELEASE
  configure: Add missing dependency of Snow decoder on videodsp
  rpza: limit the number of blocks to the total remaining blocks in the frame

Conflicts:
RELEASE

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoarm: hpeldsp: prevent overreads in armv6 asm
Janne Grunau [Wed, 5 Mar 2014 11:44:57 +0000 (12:44 +0100)]
arm: hpeldsp: prevent overreads in armv6 asm

Based on a patch by Russel King <rmk+libav@arm.linux.org.uk>

Bug-Id: 646
CC: libav-stable@libav.org
5 years agoconfigure: enable PIC on s390(x)
Reinhard Tartler [Sun, 2 Mar 2014 07:11:05 +0000 (02:11 -0500)]
configure: enable PIC on s390(x)

The s390 architecture requires shared libraries to be built in PIC mode.
Otherwise applications will get wrong relocations at run-time, leading
to confusing segmentation faults.

CC: libav-stable@libav.org
(cherry picked from commit 5ddc9f5052316608799b932c604f9e7561f8ce24)
(cherry picked from commit 7509c2c4ea2180733cc60ab1a0e0fe4ce2f02a69)

5 years agoituh263: reject b-frame with pp_time = 0
Keiji Costantini [Sat, 1 Mar 2014 18:17:04 +0000 (18:17 +0000)]
ituh263: reject b-frame with pp_time = 0

Avoid a division by 0 in ff_mpeg4_set_one_direct_mv.

Sample-Id: 00000168-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
(cherry picked from commit 9514440337875e0c63b409abcd616b68c518283f)
(cherry picked from commit 5df52b0131d3d4d804ad6e221bc9a2cd8b201ef2)

5 years agoh264: Fix a typo from the previous commit
Luca Barbato [Sat, 22 Feb 2014 10:19:03 +0000 (11:19 +0100)]
h264: Fix a typo from the previous commit

f777504f640260337974848c7d5d7a3f064bbb45 changed a - in +

CC: libav-stable@libav.org
(cherry picked from commit d922c5a5fbaf0b6c73bd8c81ae059bc6e406961c)
(cherry picked from commit 3ce77e04c2ca4b9e7fa6b94b51e8d7c5f188da86)

5 years agolagarith: reallocate rgb_planes when needed
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
lagarith: reallocate rgb_planes when needed

Fixes invalid writes on pixel format changes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 4c3e1956ee35fdcc5ffdb28782050164b4623c0b)

5 years agoh264: Lower bound check for slice offsets
Vittorio Giovara [Thu, 20 Feb 2014 01:38:32 +0000 (02:38 +0100)]
h264: Lower bound check for slice offsets

And use the value from the specification.

Sample-Id: 00000451-google
Found-by: Mateusz j00ru Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit f777504f640260337974848c7d5d7a3f064bbb45)
(cherry picked from commit 5bd083d0216d9ee649039c84999fb61386536ac1)

Conflicts:
libavcodec/h264.c

5 years agotruemotion1: check the header size
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
truemotion1: check the header size

Fixes invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 2240e2078d53d3cfce8ff1dda64e58fa72038602)

5 years agoshorten: pad the internal bitstream buffer
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
shorten: pad the internal bitstream buffer

Fixes invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 1713eec29add37b654ec6bf262b843d139c1ffc6)

5 years agosamplefmt: avoid integer overflow in av_samples_get_buffer_size()
Justin Ruggles [Thu, 30 Jan 2014 19:08:38 +0000 (14:08 -0500)]
samplefmt: avoid integer overflow in av_samples_get_buffer_size()

CC:libav-stable@libav.org
(cherry picked from commit 0e830094ad0dc251613a0aa3234d9c5c397e02e6)

5 years agoAdd missing header to fix compilation after d2a0654
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
Add missing header to fix compilation after d2a0654

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoPrepare for 9.12 RELEASE
Reinhard Tartler [Sat, 1 Mar 2014 00:22:56 +0000 (19:22 -0500)]
Prepare for 9.12 RELEASE

5 years agoconfigure: Add missing dependency of Snow decoder on videodsp
Diego Biurrun [Fri, 21 Feb 2014 09:31:39 +0000 (10:31 +0100)]
configure: Add missing dependency of Snow decoder on videodsp

5 years agorpza: limit the number of blocks to the total remaining blocks in the frame
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
rpza: limit the number of blocks to the total remaining blocks in the frame

Fixes invalid writes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 77bb0004bbe18f1498cfecdc68db5f10808b6599)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
5 years agoMerge remote-tracking branch 'qatar/release/9' into release/1.1
Michael Niedermayer [Tue, 4 Feb 2014 05:41:15 +0000 (06:41 +0100)]
Merge remote-tracking branch 'qatar/release/9' into release/1.1

* qatar/release/9:
  Update Changelog for 9.11
  oggparseogm: check timing variables
  mathematics: remove asserts from av_rescale_rnd()
  vc1: Always reset numref when parsing a new frame header.
  h264: reset num_reorder_frames if it is invalid

Conflicts:
Changelog
libavcodec/vc1.c
libavutil/mathematics.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit '62ed6da016b789eee00e0fff517df4a254e12e5d' into release/1.1
Michael Niedermayer [Tue, 4 Feb 2014 05:32:39 +0000 (06:32 +0100)]
Merge commit '62ed6da016b789eee00e0fff517df4a254e12e5d' into release/1.1

* commit '62ed6da016b789eee00e0fff517df4a254e12e5d':
  h264: check that an IDR NAL only contains I slices
  mov: Free an earlier allocated array if allocating a new one

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit '44079902c49e526f464bb4eb855665e1af867e91' into release/1.1
Michael Niedermayer [Tue, 4 Feb 2014 05:17:49 +0000 (06:17 +0100)]
Merge commit '44079902c49e526f464bb4eb855665e1af867e91' into release/1.1

* commit '44079902c49e526f464bb4eb855665e1af867e91':
  mov: Free intermediate arrays in the normal cleanup function
  segafilm: fix leaks if reading the header fails
  h264_cavlc: check the size of the intra PCM data.
  h263: Check init_get_bits return value
  cavsdec: check ff_get_buffer() return value

Conflicts:
libavcodec/cavsdec.c
libavcodec/h263dec.c
libavformat/mov.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit 'c85e5f13f6ac9c4c90125e7671d89009e57f9df9' into release/1.1
Michael Niedermayer [Tue, 4 Feb 2014 05:05:36 +0000 (06:05 +0100)]
Merge commit 'c85e5f13f6ac9c4c90125e7671d89009e57f9df9' into release/1.1

* commit 'c85e5f13f6ac9c4c90125e7671d89009e57f9df9':
  cavs: Check for negative cbp
  avi: DV in AVI must be considered single stream
  vmnc: Check the cursor dimensions
  vmnc: Port to bytestream2

Conflicts:
libavcodec/cavsdec.c
libavcodec/vmnc.c
libavformat/avidec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit 'f1476459b7013d306eb911573f1dc81e74ccd082' into release/1.1
Michael Niedermayer [Tue, 4 Feb 2014 04:43:42 +0000 (05:43 +0100)]
Merge commit 'f1476459b7013d306eb911573f1dc81e74ccd082' into release/1.1

* commit 'f1476459b7013d306eb911573f1dc81e74ccd082':
  vmnc: K&R formatting cosmetics
  flashsv: Check diff_start diff_height values
  dsputil/pngdsp: fix signed/unsigned type in end comparison

Conflicts:
libavcodec/dsputil.c
libavcodec/flashsv.c
libavcodec/vmnc.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavformat/utils: av_probe_input_buffer2 decrease difference to libav
Michael Niedermayer [Mon, 13 Jan 2014 21:37:31 +0000 (22:37 +0100)]
avformat/utils: av_probe_input_buffer2 decrease difference to libav

This removes the initialization of 2 unused fields
The change was part of c1868e7ee7b07b40a0fe15f50df89fe499a01a50
but wasnt merged as the fields could still be used

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 05c78f345b623a3eed203ab17da6e1419d56abd0)

Conflicts:

libavformat/utils.c

5 years agoavformat/utils/av_probe_input_buffer2: fix buffer passed to ffio_rewind_with_probe_data()
Michael Niedermayer [Mon, 13 Jan 2014 21:17:12 +0000 (22:17 +0100)]
avformat/utils/av_probe_input_buffer2: fix buffer passed to ffio_rewind_with_probe_data()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 05886c9d4edddb07a4cdc6afee8b30cd9c80b4db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavformat/utils/av_probe_input_buffer2: fix offset check
Michael Niedermayer [Mon, 13 Jan 2014 21:17:12 +0000 (22:17 +0100)]
avformat/utils/av_probe_input_buffer2: fix offset check

The check could fail if avio_read() read less than requested

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8c3b026a0eeb49464d957b61b0c01cceecc416fd)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavformat/utils/av_probe_input_buffer2: Fix pd.buf_size
Michael Niedermayer [Mon, 13 Jan 2014 21:14:02 +0000 (22:14 +0100)]
avformat/utils/av_probe_input_buffer2: Fix pd.buf_size

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6a2064820b52568c05a9ec8f418f18840e7c43cc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit '8575f5362f98c937758b20ff8512d6767a56208e' into release/1.1
Michael Niedermayer [Tue, 4 Feb 2014 04:17:38 +0000 (05:17 +0100)]
Merge commit '8575f5362f98c937758b20ff8512d6767a56208e' into release/1.1

* commit '8575f5362f98c937758b20ff8512d6767a56208e':
  lavf: make av_probe_input_buffer more robust
  lavf: use a fixed width type
  lavf: simplify handling of offset in av_probe_input_buffer()

Conflicts:
libavformat/utils.c

See: cdce0e8a506cafebe47736d891f5b645b57d14b2 and previous commits
Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavformat/utils: fix av_probe_input_buffer2() so it returns the probe score
Michael Niedermayer [Wed, 28 Aug 2013 23:07:57 +0000 (01:07 +0200)]
avformat/utils: fix av_probe_input_buffer2() so it returns the probe score

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c4810fbe4f53d312ba70f251f7ee4f484cbca565)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/vc1: reset fcm/field_mode in non advanced header parsing
Michael Niedermayer [Sat, 1 Feb 2014 18:04:37 +0000 (19:04 +0100)]
avcodec/vc1: reset fcm/field_mode in non advanced header parsing

Fixes NULL pointer dereference
Fixes: signal_sigsegv_1ab8bf4_2847_cov_4254117347_SA10091.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b51e9354772de446e8196dabf9aad1567b22f74d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/takdec: always check bits_per_raw_sample
Michael Niedermayer [Fri, 31 Jan 2014 18:16:02 +0000 (19:16 +0100)]
avcodec/takdec: always check bits_per_raw_sample

Fixes out of array access
Fixes: asan_heap-oob_19c7a94_6470_cov_1453611734_luckynight-partial.tak
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f58eab151214d2d35ff0973f2b3e51c5eb372da4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/vmnc: Check that rectangles are within the picture
Michael Niedermayer [Mon, 20 Jan 2014 17:08:18 +0000 (18:08 +0100)]
avcodec/vmnc: Check  that rectangles are within the picture

Prevents out of array accesses with CODEC_FLAG_EMU_EDGE

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6ba02602aa7fc7d38db582e75b8b093fb3c1608d)

Conflicts:

libavcodec/vmnc.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7c17207ab9acfaa934e8feb8fba90765c9d0b989)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agodnxhdenc: fix mb_rc size
Michael Niedermayer [Fri, 17 Jan 2014 19:09:48 +0000 (20:09 +0100)]
dnxhdenc: fix mb_rc size

Fixes out of array access with RC_VARIANCE set to 0

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f1caaa1c61310beba705957e6366f0392a0b005b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agocmdutils: update year
Michael Niedermayer [Thu, 16 Jan 2014 01:53:32 +0000 (02:53 +0100)]
cmdutils: update year

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoUpdate Changelog for 9.11
Reinhard Tartler [Sun, 2 Feb 2014 18:08:08 +0000 (13:08 -0500)]
Update Changelog for 9.11

5 years agoh264: check that an IDR NAL only contains I slices
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
h264: check that an IDR NAL only contains I slices

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 8b2e5e42bb9d6a59ede5af2e6df4aaf7750d1195)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agooggparseogm: check timing variables
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
oggparseogm: check timing variables

Fixes a potential divide by zero.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 75647dea6f7db79b409bad66a119f5c73da730f3)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agomathematics: remove asserts from av_rescale_rnd()
Anton Khirnov [Thu, 12 Dec 2013 06:34:13 +0000 (07:34 +0100)]
mathematics: remove asserts from av_rescale_rnd()

It is a public function, it must not assert on its parameters.

(cherry picked from commit 94a417acc05cc5151b473abc0bf51fad26f8c5a0)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agovc1: Always reset numref when parsing a new frame header.
Michael Niedermayer [Sun, 19 Jan 2014 15:28:25 +0000 (15:28 +0000)]
vc1: Always reset numref when parsing a new frame header.

Fixes an issue where the B-frame coding mode switches from interlaced
fields to interlaced frames, causing incorrect decisions in the motion
compensation code and resulting in visual artifacts.

CC: libav-stable@libav.org
Signed-off-by: Tim Walker <tdskywalker@gmail.com>
(cherry picked from commit dd2d0039b6405dc724e4fef0d5b8f49530eea3aa)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoh264: reset num_reorder_frames if it is invalid
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
h264: reset num_reorder_frames if it is invalid

An invalid VUI is not considered a fatal error, so the SPS containing it
may still be used. Leaving an invalid value of num_reorder_frames there
can result in writing over the bounds of H264Context.delayed_pic.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 9ecabd7892ff073ae60ded3fc0a1290f5914ed5c)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/h264_ps.c

5 years agomov: Free intermediate arrays in the normal cleanup function
Martin Storsjö [Mon, 13 Jan 2014 12:43:23 +0000 (14:43 +0200)]
mov: Free intermediate arrays in the normal cleanup function

These arrays are normally freed at the end of mov_read_trak,
but make sure they're freed in case mov_read_trak returned
early (due to errors) or in case the atoms that allocate arrays
are encountered at some other point than within a trak (which
we don't have checks against).

Sample-Id: 00000496-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d51f09962d5b4bc999fb70c040f330dd1873212e)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agomov: Free an earlier allocated array if allocating a new one
Martin Storsjö [Mon, 13 Jan 2014 12:46:07 +0000 (14:46 +0200)]
mov: Free an earlier allocated array if allocating a new one

It could probably also be considered an error if the pointer isn't
null at this point, but then we might risk rejecting some
slightly broken files that we might have handled so far.

Sample-Id: 00000496-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 2620df13104ddaa136158eb6bb1195adbf9d7692)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agosegafilm: fix leaks if reading the header fails
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
segafilm: fix leaks if reading the header fails

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 6892d145a0c80249bd61ee7dd31ec851c5076bcd)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agocavs: Check for negative cbp
Luca Barbato [Sun, 13 Oct 2013 01:30:06 +0000 (03:30 +0200)]
cavs: Check for negative cbp

Sample-Id: 00000647-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
5 years agovmnc: K&R formatting cosmetics
Luca Barbato [Wed, 9 Oct 2013 10:58:42 +0000 (12:58 +0200)]
vmnc: K&R formatting cosmetics

Signed-off-by: Diego Biurrun <diego@biurrun.de>
5 years agoh264_cavlc: check the size of the intra PCM data.
Anton Khirnov [Fri, 15 Nov 2013 08:42:26 +0000 (09:42 +0100)]
h264_cavlc: check the size of the intra PCM data.

Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org

5 years agoavi: DV in AVI must be considered single stream
Luca Barbato [Tue, 6 Aug 2013 01:38:12 +0000 (03:38 +0200)]
avi: DV in AVI must be considered single stream

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
5 years agoh263: Check init_get_bits return value
Michael Niedermayer [Sat, 26 Oct 2013 17:02:34 +0000 (19:02 +0200)]
h263: Check init_get_bits return value

And use init_get_bits8 to check for integer overflows while at it.

CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
5 years agovmnc: Check the cursor dimensions
Luca Barbato [Wed, 9 Oct 2013 03:51:20 +0000 (05:51 +0200)]
vmnc: Check the cursor dimensions

And manage the reallocation failure path.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5e992a4682d2c09eed3839c6cacf70db3b65c2f4)

5 years agocavsdec: check ff_get_buffer() return value
Anton Khirnov [Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)]
cavsdec: check ff_get_buffer() return value

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org

5 years agovmnc: Port to bytestream2
Luca Barbato [Wed, 9 Oct 2013 03:13:59 +0000 (05:13 +0200)]
vmnc: Port to bytestream2

Fix some buffer overreads.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
5 years agoflashsv: Check diff_start diff_height values
Michael Niedermayer [Tue, 20 Aug 2013 21:18:48 +0000 (23:18 +0200)]
flashsv: Check diff_start diff_height values

Fix out of array accesses.

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Adresses: CVE-2013-7015
(cherry picked from commit 57070b1468edc6ac8cb3696c817f3c943975d4c1)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agodsputil/pngdsp: fix signed/unsigned type in end comparison
Michael Niedermayer [Fri, 30 Aug 2013 21:14:32 +0000 (23:14 +0200)]
dsputil/pngdsp: fix signed/unsigned type in end comparison

Fixes out of array accesses and integer overflows.

(cherry picked from commit d1916d13e28b87f4b1b214231149e12e1d536b4b)
Adresses: CVE-2013-7010, CVE-2013-7014

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoavcodec/aacdec: Dont fail if channels arent known yet
Michael Niedermayer [Sun, 19 Jan 2014 05:20:46 +0000 (06:20 +0100)]
avcodec/aacdec: Dont fail if channels arent known yet

Fixes Ticket3312

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 676a395ab903cac623c5d6ddd0928c789e08a59e)

Conflicts:
libavcodec/aacdec.c

5 years agoavcodec/mjpegdec: Dont treat the lack of a startcode differently from end of the...
Michael Niedermayer [Sun, 19 Jan 2014 03:02:11 +0000 (04:02 +0100)]
avcodec/mjpegdec: Dont treat the lack of a startcode differently from end of the bitstream

Fixes Ticket3303

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 31e703e899bee74c50efd8eb62c3d012ef5ab26d)

5 years agoavcodec/mjpegdec: only run EOI emulation code when there was a scan
Michael Niedermayer [Sun, 19 Jan 2014 03:56:13 +0000 (04:56 +0100)]
avcodec/mjpegdec: only run EOI emulation code when there was a scan

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361e27a3d8096baacc45d2551a1ebfcbfdaa6a67)

5 years agoavcodec/mjpegdec: update cur_scan also for non-LS jpeg
Michael Niedermayer [Sun, 19 Jan 2014 03:55:01 +0000 (04:55 +0100)]
avcodec/mjpegdec: update cur_scan also for non-LS jpeg

This should make no difference but the variable will be used in a subsequent commit

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8893f31e206358d933abe4a5227b5ae89f5f303d)

Conflicts:
libavcodec/mjpegdec.c

5 years agolavf: make av_probe_input_buffer more robust
Anton Khirnov [Mon, 13 Jan 2014 12:47:07 +0000 (13:47 +0100)]
lavf: make av_probe_input_buffer more robust

Always use the actually read size as the offset instead of making
possibly invalid assumptions.

Addresses: CVE-2012-6618

(cherry picked from commit 2115a3597457231a6e5c0527fe0ff8550f64b733)

Conflicts:
libavformat/utils.c

Signed-off-by: Anton Khirnov <anton@khirnov.net>
5 years agolavf: use a fixed width type
Anton Khirnov [Mon, 13 Jan 2014 10:56:59 +0000 (11:56 +0100)]
lavf: use a fixed width type

It's shorter and more consistent with the rest of the code.

(cherry picked from commit 8b76362836f3c373c3aadc544522edcbef16dd5f)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
5 years agolavf: simplify handling of offset in av_probe_input_buffer()
Anton Khirnov [Mon, 13 Jan 2014 10:55:18 +0000 (11:55 +0100)]
lavf: simplify handling of offset in av_probe_input_buffer()

(cherry picked from commit c1868e7ee7b07b40a0fe15f50df89fe499a01a50)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
5 years agoupdate for 1.1.8 n1.1.8
Michael Niedermayer [Mon, 13 Jan 2014 14:20:18 +0000 (15:20 +0100)]
update for 1.1.8

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge remote-tracking branch 'qatar/release/9' into release/1.1
Michael Niedermayer [Mon, 13 Jan 2014 14:09:10 +0000 (15:09 +0100)]
Merge remote-tracking branch 'qatar/release/9' into release/1.1

* qatar/release/9:
  prores: Error out only on surely incomplete ac_coeffs

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoprores: Error out only on surely incomplete ac_coeffs
Luca Barbato [Thu, 10 Oct 2013 08:26:31 +0000 (10:26 +0200)]
prores: Error out only on surely incomplete ac_coeffs

(cherry picked from commit 2df7f7714a12a59d31058aba15fb1e348e36b0ab)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
5 years agoMerge remote-tracking branch 'qatar/release/9' into release/1.1
Michael Niedermayer [Sun, 12 Jan 2014 15:57:57 +0000 (16:57 +0100)]
Merge remote-tracking branch 'qatar/release/9' into release/1.1

* qatar/release/9:
  shorten: Fix out-of-array read

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit '65830277d2d2ee3658e1f070a61044fff261ed3e' into release/1.1
Michael Niedermayer [Sun, 12 Jan 2014 15:51:26 +0000 (16:51 +0100)]
Merge commit '65830277d2d2ee3658e1f070a61044fff261ed3e' into release/1.1

* commit '65830277d2d2ee3658e1f070a61044fff261ed3e':
  prores: Add a codepath for decoding errors
  nut: Fix unchecked allocations
  avi: directly resync on DV in AVI read failure
  mov: Don't allocate arrays with av_malloc that will be realloced
  shorten: Extend fixed_coeffs to properly support pred_order 0
  Prepare for 9.11 RELEASE
  avi: properly fail if the dv demuxer is missing
  prores: Reject negative run and level values
  audio_mix: fix channel order in mix_1_to_2_fltp_flt_c
  indeo4: Check the inherited quant_mat

Conflicts:
RELEASE
libavcodec/indeo4.c
libavcodec/shorten.c
libavformat/nut.c
libavformat/nutdec.c
libavformat/nutenc.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit '0358a099f8abe60230dc2e5bec59bfceb7d1be07' into release/1.1
Michael Niedermayer [Sun, 12 Jan 2014 15:37:42 +0000 (16:37 +0100)]
Merge commit '0358a099f8abe60230dc2e5bec59bfceb7d1be07' into release/1.1

* commit '0358a099f8abe60230dc2e5bec59bfceb7d1be07':
  indeo4: Check the block size if reusing the band configuration
  ffv1: Assume bitdepth 0 means 8bit
  alsa-audio-dec: explicitly cast the delay to a signed int64
  matroskadec: pad EBML_BIN data.
  motionpixels: clip VLC codes.
  avidec: fix a memleak in the dv init code.

Conflicts:
libavcodec/ffv1dec.c
libavcodec/indeo4.c
libavdevice/alsa-audio-dec.c
libavformat/matroskadec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit '7b337b122959b9bf634c31b549892df974f35b40' into release/1.1
Michael Niedermayer [Sun, 12 Jan 2014 15:16:58 +0000 (16:16 +0100)]
Merge commit '7b337b122959b9bf634c31b549892df974f35b40' into release/1.1

* commit '7b337b122959b9bf634c31b549892df974f35b40':
  truemotion1: make sure index does not go out of bounds
  pcx: round up in bits->bytes conversion in a buffer size check
  omadec: Fix wrong number of array elements
  omadec: check GEOB sizes against buffer size
  ac3dec: fix outptr increment.
  avio: Use AVERROR_PROTOCOL_NOT_FOUND

Conflicts:
libavcodec/ac3dec.c
libavcodec/pcx.c
libavformat/omadec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit '0e8ae6d10c609bb968c141aa2436413a55852590' into release/1.1
Michael Niedermayer [Sun, 12 Jan 2014 15:01:50 +0000 (16:01 +0100)]
Merge commit '0e8ae6d10c609bb968c141aa2436413a55852590' into release/1.1

* commit '0e8ae6d10c609bb968c141aa2436413a55852590':
  mpegvideo: Drop a faulty assert
  lavr: check that current_buffer is not NULL before using it
  pmpdec: check that there is at least one audio packet.
  lzw: switch to bytestream2
  gifdec: convert to bytestream2

Conflicts:
libavcodec/gifdec.c
libavcodec/lzw.c
libavcodec/lzw.h
libavformat/pmpdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge commit 'c5c7e3e6f7cf17943c04bd078f260eaf789afbc9' into release/1.1
Michael Niedermayer [Sun, 12 Jan 2014 14:48:39 +0000 (15:48 +0100)]
Merge commit 'c5c7e3e6f7cf17943c04bd078f260eaf789afbc9' into release/1.1

* commit 'c5c7e3e6f7cf17943c04bd078f260eaf789afbc9':
  gifdec: check that the image dimensions are non-zero
  gifdec: return meaningful error codes.
  eacmv: check the framerate before setting it.
  rv30: fix extradata size check.
  sdp: Check that fmt->oformat is non-null before accessing it
  matroskadec: use correct compression parameters for current track CodecPrivate
  vc1: Reset numref if fieldmode is not set

Conflicts:
libavcodec/gifdec.c
libavcodec/rv30.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoavcodec/msvideo1enc: fix SKIPS_MAX
Michael Niedermayer [Thu, 9 Jan 2014 03:02:58 +0000 (04:02 +0100)]
avcodec/msvideo1enc: fix SKIPS_MAX

Fixes Ticket3270

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fb8f5d0510619cea2204246631f1c0dcd994ee25)

5 years agoUse the h264 parser when decoding VSSH in avi.
Carl Eugen Hoyos [Tue, 7 Jan 2014 21:49:05 +0000 (22:49 +0100)]
Use the h264 parser when decoding VSSH in avi.

Fixes ticket #3261 visually.

Analyzed-by: Michael Doilnitsyn
(cherry picked from commit 94cf4f8bac12c58e30ce3b5d72cf5898baafe9a8)

Conflicts:
libavformat/avidec.c

5 years agoavformat/mxfdec: detect loops during header parsing
Michael Niedermayer [Wed, 8 Jan 2014 03:49:50 +0000 (04:49 +0100)]
avformat/mxfdec: detect loops during header parsing

The header parser uses forward and backward parsing, making the
bulletproof prevention of loops difficult, thus this simple
detection code.
If someone improves the forward/backward parsing so it cannot loop
then this commit should be reverted

Fixes Ticket3278

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1c010fd035c1a14dc73827b84f21f593e969a5d6)

5 years agoavformat/oggdec: dont read timestamps from EOS pages of ogm videos
Michael Niedermayer [Sat, 4 Jan 2014 16:33:59 +0000 (17:33 +0100)]
avformat/oggdec: dont read timestamps from EOS pages of ogm videos

Some muxers store invalid timestamps there, which breaks seeking
Fixes Ticket2739

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5e0c7eab2a9d43e6e3be967ec1a6b04a3e0328da)

5 years agoshorten: Fix out-of-array read
Tim Walker [Wed, 9 Oct 2013 09:47:04 +0000 (11:47 +0200)]
shorten: Fix out-of-array read

pred_order == FF_ARRAY_ELEMS(fixed_coeffs) is invalid too.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 5f5ada3dbf97e306a74250ba8dcf8619ad59b020)
Signed-off-by: Tim Walker <tdskywalker@gmail.com>
5 years agoprores: Add a codepath for decoding errors
Luca Barbato [Thu, 10 Oct 2013 06:40:39 +0000 (08:40 +0200)]
prores: Add a codepath for decoding errors

(cherry picked from commit 44690dfa683f620c77e9f0e8e9bc5682608636b1)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
5 years agonut: Fix unchecked allocations
Derek Buitenhuis [Tue, 22 Oct 2013 15:11:11 +0000 (16:11 +0100)]
nut: Fix unchecked allocations

CC: libav-stable@libav.org
(cherry picked from commit b1fcdc08ceb5df69fac34aa0d57c56905d32b8b4)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
5 years agoavi: directly resync on DV in AVI read failure
Luca Barbato [Tue, 6 Aug 2013 01:52:48 +0000 (03:52 +0200)]
avi: directly resync on DV in AVI read failure

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit ceec6e792e4b5baaa23b220f4fd33417631f5288)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agomov: Don't allocate arrays with av_malloc that will be realloced
Martin Storsjö [Fri, 4 Oct 2013 06:52:02 +0000 (09:52 +0300)]
mov: Don't allocate arrays with av_malloc that will be realloced

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit b698542ad83284fbb8c22404e3cafeb2dd739d38)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoshorten: Extend fixed_coeffs to properly support pred_order 0
Luca Barbato [Wed, 4 Sep 2013 17:26:36 +0000 (19:26 +0200)]
shorten: Extend fixed_coeffs to properly support pred_order 0

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b2148faca9e9e553c14b27844b56e367c85a777e)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoPrepare for 9.11 RELEASE
Reinhard Tartler [Sun, 5 Jan 2014 22:23:12 +0000 (17:23 -0500)]
Prepare for 9.11 RELEASE

5 years agoavi: properly fail if the dv demuxer is missing
Luca Barbato [Mon, 5 Aug 2013 23:39:07 +0000 (01:39 +0200)]
avi: properly fail if the dv demuxer is missing

CC: libav-stable@libav.org
(cherry picked from commit 1cac9accbd1f9b8596122d0735e37b97a844c514)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoprores: Reject negative run and level values
Luca Barbato [Thu, 10 Oct 2013 19:02:10 +0000 (21:02 +0200)]
prores: Reject negative run and level values

Sample-Id: 00000611-google

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c0de9a23c7080e2fac8f879b9d9a0ce2b64ea953)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoaudio_mix: fix channel order in mix_1_to_2_fltp_flt_c
Anton Khirnov [Wed, 2 Oct 2013 14:40:02 +0000 (16:40 +0200)]
audio_mix: fix channel order in mix_1_to_2_fltp_flt_c

CC:libav-stable@libav.org
(cherry picked from commit df6737a55f5dc7c0ae5272bc5fa6182836d5481c)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoindeo4: Check the inherited quant_mat
Luca Barbato [Fri, 11 Oct 2013 09:34:03 +0000 (11:34 +0200)]
indeo4: Check the inherited quant_mat

Invalidate it if not supported.

Sample-Id: 00000262-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c9ef6b09326a24010bf86d6b0d19cfa42df4d546)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/indeo4.c

5 years agoindeo4: Check the block size if reusing the band configuration
Luca Barbato [Fri, 11 Oct 2013 08:51:53 +0000 (10:51 +0200)]
indeo4: Check the block size if reusing the band configuration

Sample-Id: 00000287-google

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 0cb83c563848bf8f8365e7bd30e7e6b57ef360f0)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoffv1: Assume bitdepth 0 means 8bit
Luca Barbato [Sun, 13 Oct 2013 13:34:47 +0000 (15:34 +0200)]
ffv1: Assume bitdepth 0 means 8bit

CC: libav-stable@libav.org
Reported-by: debian/726189
(cherry picked from commit a90905db2e6ab1840890f3a88bfd3bf008b9d886)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoalsa-audio-dec: explicitly cast the delay to a signed int64
Anton Khirnov [Sun, 1 Dec 2013 08:27:01 +0000 (09:27 +0100)]
alsa-audio-dec: explicitly cast the delay to a signed int64

Otherwise the expression will be evaluated as unsigned, which will break
when the result should be negative.
CC:libav-stable@libav.org

(cherry picked from commit 089fac77a6bf9199a5ec161e9c27850f0a680541)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agomatroskadec: pad EBML_BIN data.
Anton Khirnov [Fri, 15 Nov 2013 09:15:24 +0000 (10:15 +0100)]
matroskadec: pad EBML_BIN data.

It might be passed to code requiring padding, such as lzo decompression.

Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org

(cherry picked from commit 30be1ea33e5525266ad871bed60b1893a53caeaf)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>