ffmpeg.git
4 years agoavformat/avidec: add mp2 to the list of exceptions instead of generally treating... n2.6.3
Michael Niedermayer [Sat, 16 May 2015 23:34:35 +0000 (01:34 +0200)]
avformat/avidec: add mp2 to the list of exceptions instead of generally treating dshow_block_align==1 special

Fixes Ticket4552

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 488383afd1275f6da53e9c83bc209c2f70d768ef)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mov: Fix parsing short loci
Michael Niedermayer [Sat, 16 May 2015 11:51:18 +0000 (13:51 +0200)]
avformat/mov: Fix parsing short loci

Fixes Ticket4557

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 50393bce31a5618f5125aaaf97bb69886fc4261d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mov: Print reason of loci parsing failure
Michael Niedermayer [Sat, 16 May 2015 11:50:38 +0000 (13:50 +0200)]
avformat/mov: Print reason of loci parsing failure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9e4f0cfc8ff4ab635ea12bdbd8d85d8bb1ba25f9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoUpdate for 2.6.3
Michael Niedermayer [Fri, 15 May 2015 22:33:13 +0000 (00:33 +0200)]
Update for 2.6.3

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc: Fix typo in num_entry_point_offsets check
Michael Niedermayer [Fri, 15 May 2015 20:12:08 +0000 (22:12 +0200)]
avcodec/hevc: Fix typo in num_entry_point_offsets check

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3051e7fa712dfe2136f19b7157211453895f2a3c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/libtheoraenc: Check for av_malloc failure
Michael Niedermayer [Fri, 15 May 2015 20:02:12 +0000 (22:02 +0200)]
avcodec/libtheoraenc: Check for av_malloc failure

Fixes CID1257799

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c64b2d480b4a35d4face9928b4265a0fda3f3dd9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check active_bands
Michael Niedermayer [Fri, 15 May 2015 16:29:40 +0000 (18:29 +0200)]
avcodec/dcadec: Check active_bands

Fixes CID1297594 part2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc624ec9ba7e5c4e8d905ac10f605a43d123f95a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check scale table index
Michael Niedermayer [Fri, 15 May 2015 16:04:12 +0000 (18:04 +0200)]
avcodec/dcadec: Check scale table index

Fixes CID1297594 part 1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0f3e6959bfa67d12cd5a173b86eb15abd7d9e4d5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/sonic: More completely check sample_rate_index and channels
Michael Niedermayer [Fri, 15 May 2015 15:31:58 +0000 (17:31 +0200)]
avcodec/sonic: More completely check sample_rate_index and channels

Fixes CID1271783

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ade8a46154cb45c88b1cb5c616eaa6320c941187)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/sonic: check memory allocations
Michael Niedermayer [Fri, 15 May 2015 15:26:25 +0000 (17:26 +0200)]
avcodec/sonic: check memory allocations

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c131a9fead5bf63215b6e1172b3c5c183cf90b85)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/smvjpegdec: check avcodec_decode_video2() return code
Michael Niedermayer [Fri, 15 May 2015 15:21:10 +0000 (17:21 +0200)]
avcodec/smvjpegdec: check avcodec_decode_video2() return code

Fixes CID1271810

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cdd25f9a3df3905543a5546cf6076d2eaf895736)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/shorten: More complete pred_order check
Michael Niedermayer [Fri, 15 May 2015 15:02:28 +0000 (17:02 +0200)]
avcodec/shorten: More complete pred_order check

Fixes CID1239055

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 294469416d8193a28710d802bb0c46e5fa09fad7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/shorten: Check skip_bytes()
Michael Niedermayer [Fri, 15 May 2015 14:48:31 +0000 (16:48 +0200)]
avcodec/shorten: Check skip_bytes()

Fixes CID1210526

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d201becfc0d89c6a5dfe44e96f1044fbc2aadb70)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/shorten: Fix code depending on signed overflow behavior
Michael Niedermayer [Fri, 15 May 2015 14:58:51 +0000 (16:58 +0200)]
avcodec/shorten: Fix code depending on signed overflow behavior

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2d15588124ab1d4c0612cab66f02a716f1509211)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/proresdec2: Reset slice_count on deallocation
Michael Niedermayer [Fri, 15 May 2015 13:23:32 +0000 (15:23 +0200)]
avcodec/proresdec2: Reset slice_count on deallocation

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c4c6aea397f62421bf8ef0449b2b465a53e4ab4d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dvbsubdec: Clear w/h/size on region buffer allocation failure
Michael Niedermayer [Thu, 14 May 2015 21:25:39 +0000 (23:25 +0200)]
avcodec/dvbsubdec: Clear w/h/size on region buffer allocation failure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9f0b898e8258a9a51b290f4c145388d62080f868)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolavf/matroskaenc: List subtitle codecs with fake codec_tags to allow remuxing.
Carl Eugen Hoyos [Mon, 23 Mar 2015 23:04:43 +0000 (00:04 +0100)]
lavf/matroskaenc: List subtitle codecs with fake codec_tags to allow remuxing.

Fixes remuxing of DVBSUB to mkv.

4 years agoffmpeg_opt: Fix -timestamp parsing
Michael Niedermayer [Sat, 9 May 2015 11:07:00 +0000 (13:07 +0200)]
ffmpeg_opt: Fix -timestamp parsing

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 107e4da47644fe615ea821d6a19682d73789aca7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check subsubframes
Michael Niedermayer [Thu, 14 May 2015 19:29:19 +0000 (21:29 +0200)]
avcodec/dcadec: Check subsubframes

Fixes: CID1239152

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a9bf628bfdad142763880a3d1ccb6058040dda57)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dcadec: Check nchans
Michael Niedermayer [Thu, 14 May 2015 18:49:25 +0000 (20:49 +0200)]
avcodec/dcadec: Check nchans

Fixes CID1239110

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a6a45774d045007f8262cd7c614804390e53122e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agohevc: make avcodec_decode_video2() fail if get_format() fails
wm4 [Thu, 14 May 2015 16:27:31 +0000 (18:27 +0200)]
hevc: make avcodec_decode_video2() fail if get_format() fails

Personally, I need the decoder to back out if get_format() returns no
usable pixel format. This didn't work because the error code was not
propagated down the call chain. This in turn happened because the
variable declaration removed in this patch shadowed the variable, whose
value is returned at the end of the function. Consequently, failures of
decode_nal_unit() were ignored in this place.

Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc5e4bb48476a89cc8ce0c41bc2bd2e8fda9b37c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/cavsdec: Use ff_set_dimensions()
Michael Niedermayer [Thu, 14 May 2015 16:08:33 +0000 (18:08 +0200)]
avcodec/cavsdec: Use ff_set_dimensions()

Fixes CID1239111 part2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f6b8b966076fcd358f734c6d00ed642edc02b4cd)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/cavsdec: Check esc_code
Michael Niedermayer [Thu, 14 May 2015 15:54:40 +0000 (17:54 +0200)]
avcodec/cavsdec: Check esc_code

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 139e1c8009df7729a53eaaae7036ca01071aced5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/on2avc: Check run more carefully
Michael Niedermayer [Wed, 13 May 2015 23:01:35 +0000 (01:01 +0200)]
avcodec/on2avc: Check run more carefully

Fixes CID1239106

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 22f15f5735389e992ec9aed43b0680e75746b3a1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/mpeg4audio: add some padding/alignment to MAX_PCE_SIZE
Michael Niedermayer [Wed, 13 May 2015 22:09:56 +0000 (00:09 +0200)]
avcodec/mpeg4audio: add some padding/alignment to MAX_PCE_SIZE

This avoids potential accesses over the end

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 93cfa7d1692c25cff045f99ba1af2c9e5772c45e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoswr: fix alignment issue caused by 8ch sse functions
Rainer Hochecker [Wed, 13 May 2015 16:31:27 +0000 (18:31 +0200)]
swr: fix alignment issue caused by 8ch sse functions

Fix crash when doing 8 ch conversion from apps compiled with MSVS
Thanks to Ronald for giving this hint:
https://ffmpeg.org/pipermail/ffmpeg-devel/2015-May/173049.html

Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit adb7372f7495927a226edf9b8e1d0ac9453985ea)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/mjpegdec: fix len computation in ff_mjpeg_decode_dqt()
Michael Niedermayer [Wed, 13 May 2015 16:36:19 +0000 (18:36 +0200)]
avcodec/mjpegdec: fix len computation in ff_mjpeg_decode_dqt()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81cf9108563510dee24f73b2c5d94a7bd07ff747)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/jpeg2000dec: fix boolean operator
Michael Niedermayer [Wed, 13 May 2015 13:15:55 +0000 (15:15 +0200)]
avcodec/jpeg2000dec: fix boolean operator

Fixes CID1271791 #7-6

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f8f155a18ac454e7ff3312e0e0c3a70eb4359143)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc_ps: Explicitly check num_tile_* for negative values
Michael Niedermayer [Wed, 13 May 2015 11:53:33 +0000 (13:53 +0200)]
avcodec/hevc_ps: Explicitly check num_tile_* for negative values

This fixes nothing but maybe helps coverity which does not see that this is failing later

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 65e5032955cb5022f0f39160aa3839f0799456bd)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc_ps: Check vps_num_hrd_parameters
Michael Niedermayer [Wed, 13 May 2015 11:35:57 +0000 (13:35 +0200)]
avcodec/hevc_ps: Check vps_num_hrd_parameters

Fix CID1239052 part2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b195aa5d529040f43ab3acf0079cecbeb111bd57)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc_ps: More completely check vps_num_layer_sets
Michael Niedermayer [Wed, 13 May 2015 11:35:37 +0000 (13:35 +0200)]
avcodec/hevc_ps: More completely check vps_num_layer_sets

Fixes CID1239052  part1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 16c95b107365cdbfcde1945370b59fc7e17e0309)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc: Check num_entry_point_offsets
Michael Niedermayer [Wed, 13 May 2015 11:21:52 +0000 (13:21 +0200)]
avcodec/hevc: Check num_entry_point_offsets

Fixes CID1239099 part 2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1c6ae98d4a9ff9ea607df87908393eda4ebdf4e8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc: Check offset_len
Michael Niedermayer [Wed, 13 May 2015 11:13:07 +0000 (13:13 +0200)]
avcodec/hevc: Check offset_len

Fixes CID1239099 part 1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e9d5e16ad9799f6b6faae4f21120d23146b84c9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolibswscale/x86/hscale_fast_bilinear_simd.c: Include BX in the clobber list on x86_64...
Nick Lewycky [Wed, 13 May 2015 01:07:57 +0000 (18:07 -0700)]
libswscale/x86/hscale_fast_bilinear_simd.c: Include BX in the clobber list on x86_64, because it isn't implicitly included when PIC is on.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 48e9f68384a2af257b9ca7633bf14f0c2748edc6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/hevc_sei: Check num_sps_ids_minus1 value
Michael Niedermayer [Tue, 12 May 2015 23:31:15 +0000 (01:31 +0200)]
avcodec/hevc_sei: Check num_sps_ids_minus1 value

Fixes CID1271794

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 93b0ee21a2f534f6d3b812686f3acde110e94f18)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/vqavideo: Check chunk size
Michael Niedermayer [Tue, 12 May 2015 22:41:38 +0000 (00:41 +0200)]
avcodec/vqavideo: Check chunk size

Fixes CID1239154

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8a62b80ce6c8e87e7937f9a5d68f83882c1c8da2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/hevc: Check num_negative_pics and num_positive_pics
Michael Niedermayer [Tue, 12 May 2015 17:28:15 +0000 (19:28 +0200)]
avformat/hevc: Check num_negative_pics and num_positive_pics

Fixes CID1238994

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b62b3292d8e25d3240e462c1b1cd8ac69195c46b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/hevc: Check cpb_cnt_minus1
Michael Niedermayer [Tue, 12 May 2015 17:09:06 +0000 (19:09 +0200)]
avformat/hevc: Check cpb_cnt_minus1

Fixes CID1239014

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2cddc0b19a20dd061dbf199bf88005b37c540d2f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/matroskadec: Cleanup error handling for bz2 & zlib
Michael Niedermayer [Tue, 12 May 2015 16:32:12 +0000 (18:32 +0200)]
avformat/matroskadec: Cleanup error handling for bz2 & zlib

Fixes CID703652

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 171af59d58fc67d82dce8ff7ed11fa671108baa5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/nutdec: Fix use of uinitialized value
Michael Niedermayer [Tue, 12 May 2015 16:20:23 +0000 (18:20 +0200)]
avformat/nutdec: Fix use of uinitialized value

Fixes CID1041175

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56abf35151c635caa3eb04bbb90454bae5463a09)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/rtpenc_jpeg: Check remaining buffer size for SOS
Michael Niedermayer [Tue, 12 May 2015 15:55:40 +0000 (17:55 +0200)]
avformat/rtpenc_jpeg: Check remaining buffer size for SOS

Fixes CID1238818

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81198a68370e88f7d02f16de58db36713c2a50b6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Michael Niedermayer [Tue, 12 May 2015 16:03:55 +0000 (18:03 +0200)]
avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()

Larger packets are not supported and would cause problems later

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e160551fb1c290d1397da2f04325817)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agotools/graph2dot: use larger data types than int for array/string sizes
Michael Niedermayer [Tue, 12 May 2015 01:59:30 +0000 (03:59 +0200)]
tools/graph2dot: use larger data types than int for array/string sizes

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit acf4925f444636a828534ab47d0f86c21a7a9b4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()
Michael Niedermayer [Mon, 11 May 2015 13:37:38 +0000 (15:37 +0200)]
avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()

Its currently guaranteed to be smaller but its safer to check anyway

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f26b3e8ec075298e7ba329a55893d085bafe96)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/oggenc: Check ff_vorbiscomment_length in ogg_write_vorbiscomment()
Michael Niedermayer [Mon, 11 May 2015 13:34:28 +0000 (15:34 +0200)]
avformat/oggenc: Check ff_vorbiscomment_length in ogg_write_vorbiscomment()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0db5b2b9f8a96298eeba7988d43c4eb44220fab3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/flacenc: Check length in flac_write_block_comment()
Michael Niedermayer [Mon, 11 May 2015 13:30:32 +0000 (15:30 +0200)]
avformat/flacenc: Check length in flac_write_block_comment()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a7700b82aec0036622f8673ce64e070a520891)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/subtitles: Use size_t for len
Michael Niedermayer [Sun, 10 May 2015 13:38:40 +0000 (15:38 +0200)]
avformat/subtitles: Use size_t for len

string length could theoretically be larger than int

Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a633928d47057426a9c328da594407d1c7da8a5c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/url: Use size_t for len from strlen()
Michael Niedermayer [Mon, 11 May 2015 01:50:01 +0000 (03:50 +0200)]
avformat/url: Use size_t for len from strlen()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95efc651294b3cf3e5ec4b3ed36e79d7261545ff)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavutil/avstring: Use size_t in av_strlcatf()
Michael Niedermayer [Mon, 11 May 2015 18:01:15 +0000 (20:01 +0200)]
avutil/avstring: Use size_t in av_strlcatf()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ae4eea8be45a0b212fd57ceaac1f11089ab81d98)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()
Michael Niedermayer [Mon, 11 May 2015 13:23:51 +0000 (15:23 +0200)]
avformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eca38864a6ce5053e463b8d3fc22b22bc9a49578)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavutil/dict: Use size_t for appending strings
Michael Niedermayer [Sun, 10 May 2015 14:09:07 +0000 (16:09 +0200)]
avutil/dict: Use size_t for appending strings

the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c128ea1629116fc4936edc5f96bbd18f3ef1647)

Conflicts:

libavutil/dict.c

4 years agolibavutil/mem: use size_t for the length in av_strdup()
Michael Niedermayer [Sun, 10 May 2015 14:06:50 +0000 (16:06 +0200)]
libavutil/mem: use size_t for the length in av_strdup()

the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4950bd4ebedbb6289734234bb2a719820f565c41)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolavd/v4l2: fix typo
Giorgio Vazzana [Fri, 8 May 2015 15:42:34 +0000 (17:42 +0200)]
lavd/v4l2: fix typo

This was introduced in cde6e328de214ffe8387641cdc1e433a2c2150f3

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 23e6cf832ff6e7260f7d5190a2d284b64d29e316)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/mpeg12dec: use the correct dimensions for checking SAR
Michael Niedermayer [Tue, 5 May 2015 02:15:31 +0000 (04:15 +0200)]
avcodec/mpeg12dec: use the correct dimensions for checking SAR

Fixes Ticket4533

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7f45f7fc7f4977e3a0697dfa0771015b4b985e24)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/ffv1dec: Check chroma shift parameters
Michael Niedermayer [Mon, 4 May 2015 11:37:26 +0000 (13:37 +0200)]
avcodec/ffv1dec: Check chroma shift parameters

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d43cd6b08ed555c303478e3133717fbb2236be6e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and...
Michael Niedermayer [Sun, 3 May 2015 13:54:21 +0000 (15:54 +0200)]
avcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and undefined behavior in fate

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 042260cde4ecf716438c5fc92d15ad5f037ee2e1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoxcbgrab: Validate the capture area
Luca Barbato [Sat, 14 Mar 2015 11:30:11 +0000 (12:30 +0100)]
xcbgrab: Validate the capture area

And notify why the capture is impossible.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit e8c4db0d4d07738fed716b1d2f20c85aac944641)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoxcbgrab: Do not assume the non shm image data is always available
Luca Barbato [Sat, 14 Mar 2015 11:30:10 +0000 (12:30 +0100)]
xcbgrab: Do not assume the non shm image data is always available

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 82a10225f817b2612fdd2b23af9d4f0a3408df3b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavfilter/lavfutils: disable frame threads when decoding a single image
Michael Niedermayer [Thu, 30 Apr 2015 01:03:31 +0000 (03:03 +0200)]
avfilter/lavfutils: disable frame threads when decoding a single image

The image decoding code does expect the image to be decoded immedeatly

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d2184bf3b65354e44c177e226a6c59c5d6fdbad4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/mov: Do not read ACLR into extradata for H.264
Michael Niedermayer [Wed, 29 Apr 2015 22:02:47 +0000 (00:02 +0200)]
avformat/mov: Do not read ACLR into extradata for H.264

Fixes regression decoding AVCI
Fixes Ticket4493

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2025e803cd0c865b6ca2f80160293de28eb5efed)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoffmpeg: remove incorrect network deinit
Michael Niedermayer [Thu, 23 Apr 2015 12:29:47 +0000 (14:29 +0200)]
ffmpeg: remove incorrect network deinit

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e2877bdf3862325c2982c3237d9bf28f1bbf793f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoOpenCL: Avoid potential buffer overflow in cmdutils_opencl.c
Maneesh Gupta [Tue, 28 Apr 2015 07:38:31 +0000 (13:08 +0530)]
OpenCL: Avoid potential buffer overflow in cmdutils_opencl.c

The opt_opencl_bench function copied the device name using strcpy without checking if the source string was larger.
This patch fixes this by replacing the strcpy with av_strlcpy, with the string copy size capped to the destination buffer size.

Signed-off-by: Maneesh Gupta <maneesh.gupta@amd.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cf234552b83a9503ff96572de2658b921b8842eb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolibvpxenc: only set noise reduction w/vp8
James Zern [Tue, 21 Apr 2015 07:03:00 +0000 (00:03 -0700)]
libvpxenc: only set noise reduction w/vp8

this quiets a warning:
Failed to set VP8E_SET_NOISE_SENSITIVITY codec control: Unspecified
internal error

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: James Zern <jzern@google.com>
(cherry picked from commit 238ec505e263e7d0363798a05c1c28f494a6300a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agovp9: remove another optimization branch in iadst16 which causes overflows.
Ronald S. Bultje [Wed, 22 Apr 2015 19:48:37 +0000 (15:48 -0400)]
vp9: remove another optimization branch in iadst16 which causes overflows.

See sample vp90-2-14-resize-fp-tiles-16-8.webm from the vp9 test vector
set to reproduce the issue.
(cherry picked from commit 3de13d5212b6a0ff146dc0b50e34ee7dbc822eef)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/dvbsubdec: Do not return a value from a function returning void
Michael Niedermayer [Sun, 26 Apr 2015 11:47:12 +0000 (13:47 +0200)]
avcodec/dvbsubdec: Do not return a value from a function returning void

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e06dde52d75ac216c98c8479f7f8f0d4566024af)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolavf: Reset global flag on deinit
Vittorio Giovara [Wed, 22 Apr 2015 13:59:56 +0000 (14:59 +0100)]
lavf: Reset global flag on deinit

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32da94fa7f73ac749e0a1e2f20499fad2f6f57fe)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agonetwork: Do not leave context locked on error
Vittorio Giovara [Wed, 22 Apr 2015 13:59:55 +0000 (14:59 +0100)]
network: Do not leave context locked on error

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 45340f9fc77e254924f129c764b685fe682e380c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agovp9: remove one optimization branch in iadst16 which causes overflows.
Ronald S. Bultje [Wed, 22 Apr 2015 18:53:01 +0000 (14:53 -0400)]
vp9: remove one optimization branch in iadst16 which causes overflows.

See sample vp90-2-14-resize-fp-tiles-16-8-4-2-1.webm from the vp9 test
vector set which reproduces the issue. This probably costs a few cycles,
but I don't think there's an easy way to workaround that.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d02d04a18f300ebe97319ca6e91fc943cb14f58b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agofate: Include branch information in the payload header
Timothy Gu [Sun, 12 Apr 2015 15:28:42 +0000 (08:28 -0700)]
fate: Include branch information in the payload header

The server is properly equiped not to choke on that now.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ad27f1221562b037178d1fb605510ba349f04cc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/utils: Ensure that AVFMT_FLAG_CUSTOM_IO is set before use
Michael Niedermayer [Mon, 20 Apr 2015 20:22:31 +0000 (22:22 +0200)]
avformat/utils: Ensure that AVFMT_FLAG_CUSTOM_IO is set before use

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ba631b791435c395361e2026fc7419b341e57813)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavformat/img2dec: do not rewind custom io buffers
Michael Niedermayer [Mon, 20 Apr 2015 21:59:53 +0000 (23:59 +0200)]
avformat/img2dec: do not rewind custom io buffers

Fixes double free with some applications

Fixes vlc ticket14121
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e6e8cc8ce9c2a398fbb51254a5067f4bd3c4fa8a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/alsdec: Use av_mallocz_array() for chan_data to ensure the arrays never conta...
Michael Niedermayer [Sat, 18 Apr 2015 18:50:23 +0000 (20:50 +0200)]
avcodec/alsdec: Use av_mallocz_array() for chan_data to ensure the arrays never contain random data

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7e104647a3556fc61a139483cee1cb7dfa2dc5bd)

Conflicts:

libavcodec/alsdec.c

4 years agoavcodec/atrac3plusdsp: fix on stack alignment
Michael Niedermayer [Fri, 17 Apr 2015 09:58:41 +0000 (11:58 +0200)]
avcodec/atrac3plusdsp: fix on stack alignment

Fixes fate failure on ARM
(cherry picked from commit 38f67260684aec8a02d87ab4056b1a1fbf964c03)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoswresample/swresample-test: Randomly wipe out channel counts
Michael Niedermayer [Sun, 12 Apr 2015 20:08:52 +0000 (22:08 +0200)]
swresample/swresample-test: Randomly wipe out channel counts

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ff50b1b13be965c93a9a7169edb62631a928e308)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoswresample: Check channel layouts and channels against each other and print human...
Michael Niedermayer [Sun, 12 Apr 2015 19:08:09 +0000 (21:08 +0200)]
swresample: Check channel layouts and channels against each other and print human readable error messages

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3c77bb5f23b2e149495c814759beab7eedeede6c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoswresample: Allow reinitialization without ever setting channel layouts
Michael Niedermayer [Sun, 12 Apr 2015 18:50:53 +0000 (20:50 +0200)]
swresample: Allow reinitialization without ever setting channel layouts
(cherry picked from commit 80a28c7509a11114e1aea5b208d56c6646d69c07)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoswresample: Allow reinitialization without ever setting channel counts
Michael Niedermayer [Sun, 12 Apr 2015 17:43:08 +0000 (19:43 +0200)]
swresample: Allow reinitialization without ever setting channel counts

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d7b9cb2f7a51351586791e65fa22e6536ee58c9f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agodashenc: replace attribute id with contentType for the AdaptationSet element
James Almer [Sun, 10 May 2015 06:31:44 +0000 (03:31 -0300)]
dashenc: replace attribute id with contentType for the AdaptationSet element

id should be an integer, not a string. It is also optional, so use
contentType instead which is the proper attribute for these values.

This addresses ticket #4545, fixing an MPD validation error.

Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32a4177a627ddce984a5a9ed7023d9a63dcbdf85)

4 years agoavformat/matroskaenc: Use avoid_negative_ts_use_pts if no stream writes dts
Michael Niedermayer [Tue, 5 May 2015 10:57:24 +0000 (12:57 +0200)]
avformat/matroskaenc: Use avoid_negative_ts_use_pts if no stream writes dts

This reduces the number of cases where timestamps need to be shifted

Fixes Ticket4487

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9d4fdfe24c731d1880797dee65365154b41c1dea)

4 years agoavformat/mux: Add avoid_negative_ts_use_pts
Michael Niedermayer [Tue, 5 May 2015 10:44:20 +0000 (12:44 +0200)]
avformat/mux: Add avoid_negative_ts_use_pts

This allows using pts instead of dts for negative TS avoidance

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ac5c38ec5baeea6ad647ccc9bb7e97564c50ec2)

4 years agotests/fate-run: do not attempt to parse tiny_psnrs output if it failed
Michael Niedermayer [Thu, 23 Apr 2015 02:27:56 +0000 (04:27 +0200)]
tests/fate-run: do not attempt to parse tiny_psnrs output if it failed

This avoids confusing syntax errors with awk later

Likely fixes awk errors at:
http://buildd.debian-ports.org/status/fetch.php?pkg=ffmpeg&arch=sparc64&ver=7%3A2.6.2-1&stamp=1428928967

Reviewed-by: Timothy Gu <timothygu99@gmail.com>
Thanks-to: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> for the link
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c0d847e457c1ef72843a63853f1135d52b74131e)

4 years agocafdec: free extradata before allocating it
Andreas Cadhalpun [Tue, 12 May 2015 22:22:03 +0000 (00:22 +0200)]
cafdec: free extradata before allocating it

This fixes a memleak if read_kuki_chunk is executed more than once.

Reviewed-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit cb7c4f73e5e3debe2646279eaa7cfb493573118b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agocafdec: check avio_read return value
Andreas Cadhalpun [Tue, 12 May 2015 21:49:45 +0000 (23:49 +0200)]
cafdec: check avio_read return value

If avio_read fails, the buffer can contain uninitialized values.

Reviewed-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit a3ede6b742f37d511253ab4c2fd98c13203f1cd3)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agoimgutils: initialize palette padding bytes in av_image_alloc
Andreas Cadhalpun [Tue, 12 May 2015 19:45:42 +0000 (21:45 +0200)]
imgutils: initialize palette padding bytes in av_image_alloc

av_image_fill_pointers always aligns the palette, but the padding
bytes don't (and can't) get initialized in av_image_copy.

Thus initialize them in av_image_alloc.

This fixes 'Syscall param write(buf) points to uninitialised byte(s)'
valgrind warnings.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 51f64552853e16d72644308db53abee870aecfb9)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agoaacdec: don't return frames without data
Andreas Cadhalpun [Tue, 12 May 2015 18:27:21 +0000 (20:27 +0200)]
aacdec: don't return frames without data

Since commit 676a395a aac->frame->data is not necessarily allocated at
the end of aac_decode_frame_int if avctx->channels is 0.

In this case a bogus frame without any data, but non-zero nb_samples is
returned.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ec38a1ba404b8cb8d71ccee2b8dcd6f3fcbde273)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agoid3v2: catch avio_read errors in check_tag
Andreas Cadhalpun [Mon, 11 May 2015 18:07:49 +0000 (20:07 +0200)]
id3v2: catch avio_read errors in check_tag

Since len is an unsigned int, the comparison is currently treated as
unsigned and thus ignores all errors from avio_read.

Thus cast len to int, which is unproblematic, because at that point len
is between 0 and 4.

This fixes 'Conditional jump or move depends on uninitialised value'
valgrind warnings in is_tag.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0382c94f13b4b20456b7259e90b170dc020419b8)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agoavi: Validate sample_size
Andreas Cadhalpun [Wed, 6 May 2015 00:26:57 +0000 (02:26 +0200)]
avi: Validate sample_size

And either error out or set it to 0 if it is negative.

CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 4d0ee4962be7e07cdc038a78008ef2e4e47e5f81)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Conflicts:
libavformat/avidec.c

4 years agoaacsbr: break infinite loop in sbr_hf_calc_npatches
Andreas Cadhalpun [Wed, 22 Apr 2015 13:23:24 +0000 (15:23 +0200)]
aacsbr: break infinite loop in sbr_hf_calc_npatches

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 584cc1ade10a3297ef9c107ef3a2081c04024156)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agodiracdec: check that block length is valid
Andreas Cadhalpun [Wed, 6 May 2015 13:34:53 +0000 (15:34 +0200)]
diracdec: check that block length is valid

In init_planes p->xblen and p->yblen are set to:
            p->xblen = s->plane[0].xblen >> s->chroma_x_shift;
            p->yblen = s->plane[0].yblen >> s->chroma_y_shift;

These are later used as block_w and block_h arguments of
s->vdsp.emulated_edge_mc. If one of them is 0 it triggers an av_assert2
in emulated_edge_mc:
    av_assert2(start_x < end_x && block_w > 0);
    av_assert2(start_y < end_y && block_h > 0);

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 75fc81c8318505aa7946e05a9bee08d47241fc66)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agodiracdec: check if reference could not be allocated
Andreas Cadhalpun [Tue, 5 May 2015 21:51:48 +0000 (23:51 +0200)]
diracdec: check if reference could not be allocated

s->ref_pics[i] is later used as ref argument of interpolate_refplane,
where it is dereferenced.

If it is NULL, it causes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d93181ef3eacdb862d93448f31c97765a523d1db)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agodiracdec: avoid overflow of bytes*8 in decode_lowdelay
Andreas Cadhalpun [Tue, 5 May 2015 20:10:44 +0000 (22:10 +0200)]
diracdec: avoid overflow of bytes*8 in decode_lowdelay

If bytes is large enough, bytes*8 can overflow and become negative.

In that case 'bufsize -= bytes*8' causes bufsize to increase instead of
decrease.

This leads to a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9e66b39aa87eb653a6e5d15f70b792ccbf719de7)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agodiracdec: prevent overflow in data_unit_size check
Andreas Cadhalpun [Tue, 5 May 2015 19:33:08 +0000 (21:33 +0200)]
diracdec: prevent overflow in data_unit_size check

buf_idx + data_unit_size can overflow, causing the '> buf_size' check to
wrongly fail.

This causes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 984f50deb2d48f6844d65e10991b996a6d29e87c)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agoavidec: check for valid bit_rate range
Andreas Cadhalpun [Mon, 4 May 2015 19:07:52 +0000 (21:07 +0200)]
avidec: check for valid bit_rate range

If bit_rate is negative, it can trigger an av_assert2 in av_rescale_rnd.

Since av_rescale returns int64_t, but st->codec_bit_rate is int, it can
also overflow into a negative value.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0eec40b713eee84e2aec8af35ccce059817cad2a)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agoavformat/matroskadec: Use tracks[k]->stream instead of s->streams[k]
Michael Niedermayer [Mon, 4 May 2015 13:47:54 +0000 (15:47 +0200)]
avformat/matroskadec: Use tracks[k]->stream instead of s->streams[k]

The later is not correct

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5d309d309108684f742bbf5fc2393f1c519cda72)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agomatroskadec: check s->streams[k] before using it
Andreas Cadhalpun [Sun, 3 May 2015 21:55:20 +0000 (23:55 +0200)]
matroskadec: check s->streams[k] before using it

This fixes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e54540655f229d06667dc7fa7005f2a20e101e80)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agomatroskadec: use uint64_t instead of int for index_scale
Andreas Cadhalpun [Sun, 3 May 2015 21:07:20 +0000 (23:07 +0200)]
matroskadec: use uint64_t instead of int for index_scale

index_scale is set to matroska->time_scale of type uint64_t.

When index_scale is int, the assignment can overflow and e.g. result
in index_scale = 0. This causes a floating point exception due to the
division by index_scale.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eb9fb508b0e09d85d234fe694333b2005e1d7a7e)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agopngdec: don't use AV_PIX_FMT_MONOBLACK for apng
Andreas Cadhalpun [Sun, 3 May 2015 18:36:20 +0000 (20:36 +0200)]
pngdec: don't use AV_PIX_FMT_MONOBLACK for apng

AV_PIX_FMT_MONOBLACK has the AV_PIX_FMT_FLAG_BITSTREAM flag, i.e.
linesize can be smaller than width.

Since x_offset is only check against the width, this can lead to
x_offset * bpp >= image_linesize.

In this case ptr could be set to a position outside the image_buf in
png_handle_row, leading to memory corruption and thus crashes.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 372aa0777aaacf726de7cd7dd0e6797026a124ee)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agopngdec: return correct error code from decode_frame_common
Andreas Cadhalpun [Sun, 3 May 2015 15:50:26 +0000 (17:50 +0200)]
pngdec: return correct error code from decode_frame_common

During the loop ret can get changed. Since it is not set on all failure
paths, decode_frame_common can return 0 even though an error occurred.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8f760be4d312bb6e78f80d39b9d0062253332e08)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agopngdec: check s->last_picture.f->data[0] before using it
Andreas Cadhalpun [Sun, 3 May 2015 14:21:39 +0000 (16:21 +0200)]
pngdec: check s->last_picture.f->data[0] before using it

This check was removed in commit 08aec6f6, but
s->last_picture.f->data[0] is still used in handle_p_frame_apng
unconditionally.

This fixes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 287dbb0771d558b336e377d0594e26c0a6291755)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
4 years agonutdec: fix illegal count check in decode_main_header
Andreas Cadhalpun [Tue, 28 Apr 2015 20:37:19 +0000 (22:37 +0200)]
nutdec: fix illegal count check in decode_main_header

The existing check has two problems:
 1) i + count can overflow, so that the check '< 256' returns true.
 2) In the (i == 'N') case occurs a j-- so that the loop runs once more.

This can trigger the assertion 'nut->header_len[0] == 0' or cause
segmentation faults or infinite hangs.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7c24ca1bda2d4df1dc9b2b982941be532d60da21)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>