Commit Graph

67007 Commits

Author SHA1 Message Date
Michael Niedermayer
57b7a009c0 avcodec/hevc: Check num_entry_point_offsets
Fixes CID1239099 part 2

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1c6ae98d4a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
f1b0d65237 avcodec/hevc: Check offset_len
Fixes CID1239099 part 1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e9d5e16ad)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Nick Lewycky
7bda5b378d libswscale/x86/hscale_fast_bilinear_simd.c: Include BX in the clobber list on x86_64, because it isn't implicitly included when PIC is on.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 48e9f68384)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
959423e8d7 avcodec/hevc_sei: Check num_sps_ids_minus1 value
Fixes CID1271794

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 93b0ee21a2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
96de4bbf38 avcodec/vqavideo: Check chunk size
Fixes CID1239154

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8a62b80ce6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Andreas Cadhalpun
de648a11d8 aacdec: don't return frames without data
Since commit 676a395a aac->frame->data is not necessarily allocated at
the end of aac_decode_frame_int if avctx->channels is 0.

In this case a bogus frame without any data, but non-zero nb_samples is
returned.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ec38a1ba40)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
f30ab69b38 avformat/hevc: Check num_negative_pics and num_positive_pics
Fixes CID1238994

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b62b3292d8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
ce3bb01119 avformat/hevc: Check cpb_cnt_minus1
Fixes CID1239014

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2cddc0b19a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
3bd85e1f83 avformat/matroskadec: Cleanup error handling for bz2 & zlib
Fixes CID703652

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 171af59d58)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
7c4e3ddda1 avformat/nutdec: Fix use of uinitialized value
Fixes CID1041175

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56abf35151)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
fbd9ab5967 avformat/rtpenc_jpeg: Check remaining buffer size for SOS
Fixes CID1238818

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81198a6837)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
18e83992f2 avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Larger packets are not supported and would cause problems later

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
bec4b3c856 tools/graph2dot: use larger data types than int for array/string sizes
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit acf4925f44)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
c0ca9773a7 avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()
Its currently guaranteed to be smaller but its safer to check anyway

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f26b3e8e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
9193fd9ddf avformat/oggenc: Check ff_vorbiscomment_length in ogg_write_vorbiscomment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0db5b2b9f8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
02fe112c7c avformat/flacenc: Check length in flac_write_block_comment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a7700b82)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
81941153ab avformat/subtitles: Use size_t for len
string length could theoretically be larger than int

Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a633928d47)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
2c50cc497d avformat/url: Use size_t for len from strlen()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95efc65129)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
8c6bbc6728 avutil/avstring: Use size_t in av_strlcatf()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ae4eea8be4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
27a0dab914 avformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eca38864a6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
618c7a91ee avutil/dict: Use size_t for appending strings
the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c128ea162)

Conflicts:

	libavutil/dict.c
2015-06-01 23:25:20 +02:00
Michael Niedermayer
e75393c659 libavutil/mem: use size_t for the length in av_strdup()
the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4950bd4ebe)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Andreas Cadhalpun
17fd68e9d7 aacsbr: break infinite loop in sbr_hf_calc_npatches
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 584cc1ade1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Andreas Cadhalpun
f61ebd555d diracdec: check that block length is valid
In init_planes p->xblen and p->yblen are set to:
            p->xblen = s->plane[0].xblen >> s->chroma_x_shift;
            p->yblen = s->plane[0].yblen >> s->chroma_y_shift;

These are later used as block_w and block_h arguments of
s->vdsp.emulated_edge_mc. If one of them is 0 it triggers an av_assert2
in emulated_edge_mc:
    av_assert2(start_x < end_x && block_w > 0);
    av_assert2(start_y < end_y && block_h > 0);

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 75fc81c831)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
8c8a9a20cf ffmpeg_opt: Set the video VBV parameters only for the video stream from -target
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2ce6e41911)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
796cc5a5eb avcodec/bitstream: Assert that there is enough space left in avpriv_copy_bits()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 291ad5cc9c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
5b5002279d avcodec/put_bits: Assert that there is enough space left in skip_put_bytes()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8f5ffed183)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
b56de5859e avcodec/mpegvideo_enc: Update the buffer size as more slices are merged
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 561d3a57aa)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
e03fa4b88d avcodec/put_bits: Update size_in_bits in set_put_bits_buffer_size()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e4c2ec879b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Rodger Combs
6d3f0fe24d avformat/wavdec: Increase dts packet threshold to fix more misdetections
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a3e1e9c5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
a39a2978d5 avformat/wavdec: Increase probe_packets limit
Fixes DTS detection of b2429e5ba9.dts

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9f5769437a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Andreas Cadhalpun
9f99f29f23 nutdec: abort if EOF is reached in decode_info_header/read_sm_data
These loops can take a lot of time if count is very large.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit bb23a15df5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Andreas Cadhalpun
b947ff8985 nutdec: stop skipping bytes at EOF
This can unnecessarily waste a lot of time.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit fa7dec8cb0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Andreas Cadhalpun
936a5dd2c5 nutdec: fix infinite resync loops
nut->last_syncpoint_pos doesn't necessarily change between resync
attempts, so find_any_startcode can return the same startcode again.

Thus remember where the last resync happened and don't try to resync
before that.

This can't be done locally in nut_read_packet, because this wouldn't
prevent infinite resync loops, where after the resync a packet is
returned and while reading a following packet the resync happens again.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 37e679881d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
236452f83e avformat/nutdec: Check X in 2nd branch of index reading
Prevents read of uninitialized variable

Based on patch by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ebb0ca3d70)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
b45f67b05a avformat/nutdec: Fix recovery when immedeately after seeking a failure happens
Found-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b3496b4a33)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
179d850ded avformat/nutdec: Return error on EOF from get_str()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6bbb2f8f4d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
7727877239 Merge commit '0069d4597bda5723fbcae410784bbfa4750df706' into release/2.4
* commit '0069d4597bda5723fbcae410784bbfa4750df706':
  Update changelog for v11.4

Conflicts:
	Changelog
	RELEASE

Not merged, our changelog differs from this

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 05:00:30 +02:00
Reinhard Tartler
0069d4597b Update changelog for v11.4 2015-05-31 10:54:31 -04:00
Michael Niedermayer
b50fa26885 Merge commit '3b69f245dbe6e2016659a45c4bfe284f6c5ac57e' into release/2.4
* commit '3b69f245dbe6e2016659a45c4bfe284f6c5ac57e':
  h264: Make sure reinit failures mark the context as not initialized

Conflicts:
	libavcodec/h264_slice.c

See: e8714f6f93
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-31 00:13:22 +02:00
Michael Niedermayer
2c180cfc5d Merge commit '70642090960c35dcd6da941c869bdf55d4f3bb00' into release/2.4
* commit '70642090960c35dcd6da941c869bdf55d4f3bb00':
  msrle: Use FFABS to determine the frame size in msrle_decode_pal4

Conflicts:
	libavcodec/msrledec.c

See: f7e1367f58
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-30 23:46:58 +02:00
Luca Barbato
3b69f245db h264: Make sure reinit failures mark the context as not initialized
Bug-Id: CVE-2015-3417
CC: libav-stable@libav.org
2015-05-30 16:32:02 +02:00
Luca Barbato
7064209096 msrle: Use FFABS to determine the frame size in msrle_decode_pal4
As done in msrle_decode_8_16_24_32.

Bug-Id: CVE-2015-3395
CC: libav-stable@libav.org
2015-05-30 16:30:22 +02:00
Michael Niedermayer
95cf5e83a7 Merge commit '4dc0fbb13c33b4e5bdb766652f4daf900ccc952f' into release/2.4
* commit '4dc0fbb13c33b4e5bdb766652f4daf900ccc952f':
  x86: cavs: Remove an unneeded scratch buffer

Conflicts:
	libavcodec/x86/cavsdsp.c

See: d79f7bf0d6
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-28 22:40:53 +02:00
Michael Niedermayer
e4e64f2fea avcodec/x86/cavsdsp: remove unneeded tmp
This is faster and simpler as well

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d79f7bf0d6)

Conflicts:

	libavcodec/x86/cavsdsp.c
2015-05-28 22:40:23 +02:00
Michael Niedermayer
4dc0fbb13c x86: cavs: Remove an unneeded scratch buffer
Simplifies the code and makes it build on certain compilers
running out of registers on x86.

CC: libav-stable@libav.org
Reported-By: mudler
(cherry picked from commit e4610300de)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-05-28 18:42:30 +02:00
Michael Niedermayer
93ceae749b Merge commit 'b37bfbfbe53917820d1f97312fa0b2e8c7a15217' into release/2.4
* commit 'b37bfbfbe53917820d1f97312fa0b2e8c7a15217':
  configure: Disable i686 for i586 and lower CPUs

See: cdb3eee7c4
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 22:02:40 +02:00
Michael Niedermayer
dcc8009249 Merge commit '5549f693d2181b3211427f65e48eaa2f4fc5a402' into release/2.4
* commit '5549f693d2181b3211427f65e48eaa2f4fc5a402':
  mjpegenc: Fix JFIF header byte ordering

Conflicts:
	libavcodec/mjpegenc_common.c

See: b19313218c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 22:01:58 +02:00
Michael Niedermayer
fb2d1b1b13 Merge commit '1f64b018cbec018fa66a4a20f79958d9707913de' into release/2.4
* commit '1f64b018cbec018fa66a4a20f79958d9707913de':
  nut: Make sure to clean up on read_header failure

Conflicts:
	libavformat/nutdec.c

See: 361702660d
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 22:01:21 +02:00
Andreas Cadhalpun
91aa6d8a8b nutdec: fix memleaks on error in nut_read_header
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361702660d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:54:19 +02:00