14758 Commits

Author SHA1 Message Date
Michael Niedermayer
3e17543491 Merge branch 'release/0.8' into release/0.7
* release/0.8: (96 commits)
  Version numbers for 0.8.6
  snow: emu edge support Fixes Ticket592
  imc: validate channel count
  imc: check for ff_fft_init() failure (cherry picked from commit 95fee70d6773fde1c34ff6422f48e5e66f37f263)
  libgsmdec: check output buffer size before decoding (cherry picked from commit b03761b1309293bbf30edef767503875277b01cf)
  configure: fix arch x86_32
  mp3enc: avoid truncating id3v1 tags by one byte
  asfdec: Check packet_replic_size earlier
  cin audio: validate the channel count
  binkaudio: add some buffer overread checks.
  atrac1: validate number of channels (cherry picked from commit bff5b2c1ca1290ea30587ff2f76171f9e3854872)
  atrac1: check output buffer size before decoding (cherry picked from commit 33684b9c12b74c0140fb91e8150263db4a48d55e)
  vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)
  apedec: set s->currentframeblocks after validating nblocks
  apedec: use unsigned int for 'nblocks' and make sure that it's within int range
  apedec: check for data buffer realloc failure (cherry picked from commit 11ca8b2d7486e879926488404b3b79af774f0f2d)
  apedec: check for filter buffer allocation failure (cherry picked from commit 7500781313d11b37772c05a28da20fbc112db478)
  mpegaudiodec: check output data size based on avctx->frame_size
  resample: Fix array size
  resample2: fix potential overflow
  ...

Conflicts:
	Doxyfile
	RELEASE
	VERSION

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 20:20:37 +01:00
Michael Niedermayer
c4a34f4025 snow: emu edge support
Fixes Ticket592

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4416931fc069332e267ab6df037a1227c051d7b1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 13:36:28 +01:00
Justin Ruggles
cba03dc667 imc: validate channel count
ask for a sample if not mono
(cherry picked from commit 7b7f47e73356d113cace74b922eee0b6ff5ffe0b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 13:34:42 +01:00
Justin Ruggles
5a3f494466 imc: check for ff_fft_init() failure
(cherry picked from commit 95fee70d6773fde1c34ff6422f48e5e66f37f263)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 13:34:35 +01:00
Justin Ruggles
112431705d libgsmdec: check output buffer size before decoding
(cherry picked from commit b03761b1309293bbf30edef767503875277b01cf)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 13:33:38 +01:00
Justin Ruggles
711e6c947b cin audio: validate the channel count
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 13:32:18 +01:00
Justin Ruggles
8491677ab6 binkaudio: add some buffer overread checks.
This stops decoding before overreads instead of after.
(cherry picked from commit 101ef19ef4dc9f5c3d536aee8fcc10fff2af4d9e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 13:31:15 +01:00
Justin Ruggles
f98bb0d3ec atrac1: validate number of channels
(cherry picked from commit bff5b2c1ca1290ea30587ff2f76171f9e3854872)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:40:42 +01:00
Justin Ruggles
346e089d25 atrac1: check output buffer size before decoding
(cherry picked from commit 33684b9c12b74c0140fb91e8150263db4a48d55e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:40:35 +01:00
Ronald S. Bultje
0ac6777a34 vp3: fix oob read for negative tokens and memleaks on error.
(cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:37:06 +01:00
Justin Ruggles
ae2d3d6be0 apedec: set s->currentframeblocks after validating nblocks 2011-11-04 03:32:39 +01:00
Justin Ruggles
998fc04bcf apedec: use unsigned int for 'nblocks' and make sure that it's within int range
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:30:44 +01:00
Justin Ruggles
43fa5bf55e apedec: check for data buffer realloc failure
(cherry picked from commit 11ca8b2d7486e879926488404b3b79af774f0f2d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:23:39 +01:00
Justin Ruggles
f19b8d9533 apedec: check for filter buffer allocation failure
(cherry picked from commit 7500781313d11b37772c05a28da20fbc112db478)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:23:34 +01:00
Justin Ruggles
4a66fe2107 mpegaudiodec: check output data size based on avctx->frame_size
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:23:13 +01:00
Michael Niedermayer
edf3c5a3eb resample: Fix array size
Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e7db0a9ee758bf0570a141be1fea64f8d9c03db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:22:03 +01:00
Michael Niedermayer
a39b5e8b32 resample2: fix potential overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Michael Niedermayer
6ae93d0304 resample: Fix overflow
Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Justin Ruggles
2137d99086 vorbisdec: check output buffer size before writing output
(cherry picked from commit 60aa1a358d9c1c8f891e72246d5dcd897857eca8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Justin Ruggles
e9de2d98a9 twinvq: check output buffer size before decoding
(cherry picked from commit e53eecd0e7211973a1a9757f559bdd93a1848901)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Alex Converse
93f1159af5 vp6: Fix illegal read.
(cherry picked from commit 2a6eb06254df79e96b3d791b6b89b2534ced3119)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:54:13 +01:00
Justin Ruggles
b08001e00a shorten: check output buffer size before decoding
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:30:29 +01:00
Justin Ruggles
e1ea35fb52 shorten: check for realloc failure
(cherry picked from commit 9e5e2c2d010c05c10337e9c1ec9d0d61495e0c9c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:24:03 +01:00
Matthew Einhorn
f531193690 Fixes avpicture_layout to not write past buffer end.
avpicture_get_size() returns the size of buffer required for avpicture_layout.
For pseudo-paletted formats (gray8...) this size does not include the palette.
However, avpicture_layout doesn't know this and still writes the palette. Consequently,
avpicture_layout writes passed the length of the buffer. This fixes it
by fixing avpicture_layout so that it doesn't write the palette for these formats.

Signed-off-by: Matthew Einhorn <moiein2000@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e662b263d9c500270a8f1dc7e1b81b51d5bdfd4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:47 +01:00
Ronald S. Bultje
15a7fe106c pthread: copy coded frame dimensions in update_context_from_thread
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit feadcd1bdcbb4601f4ff01878027264fde985ee1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:28 +01:00
Ronald S. Bultje
d32f509de1 vp8: prevent read from uninitialized memory in decode_mvs
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 0f0b5d643401d4d83322eeee0e57eb5a226ef9ab)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:22:59 +01:00
Ronald S. Bultje
5f5f36b52e vp8: force reallocation in update_thread_context after frame size change
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 56535793810584f5b3ae59e62cea66fe22d0307d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:22:52 +01:00
Ronald S. Bultje
d1166f03be vp8: fix return value if update_dimensions fails
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit f05c2fb6eb1f9ddaec3c07d1874ba62ec0891269)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:22:45 +01:00
Justin Ruggles
62cf52c860 truespeech: check to make sure channels == 1
(cherry picked from commit 3e7a176759e8a8e66d65c779b47b5bba793dfd4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:09:22 +01:00
Justin Ruggles
7e95a12d51 mlpdec: validate that the reported channel count matches the actual output
channel count
(cherry picked from commit caa845851d790f894a2ccbe12580934f75545f92)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:09:17 +01:00
Mans Rullgard
1c3d46a924 h264: fix HRD parameters parsing
The bit_rate_value_minus1 and cpb_size_value_minus1 elements
allow a wider range than get_ue_golomb() supports.  This
adds a get_ue_golomb_long() function supporting up to 31
leading zeros, which is the maximum for these syntax
elements, and uses it in decode_hrd_parameters().

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit fdba370f8a1bdfc22ecbdf3c7148c2f8680a4ac4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:08:09 +01:00
Justin Ruggles
800ab099e3 smacker: validate channels and sample format.
(cherry picked from commit ff1f89de2da3472d133e2c95bf7c9ad2d88df33d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:07:49 +01:00
Justin Ruggles
e6b2255329 smacker: check buffer size before reading output size
(cherry picked from commit cf044f8bff0d28dbc34492f18b0d18b3ba8bad9d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:07:44 +01:00
Justin Ruggles
7f7b2e89e2 smacker: validate number of channels
(cherry picked from commit e190e453bd1e4d4b409ed3556b3a50d1087c15d7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:07:39 +01:00
Mans Rullgard
73f85eae68 sipr: fix get_bits(0) calls
Zero-length get_bits() is undefined, must check before calling.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit c79d2a20bad59298188171f1316a830d563a41ee)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:46 +01:00
Mans Rullgard
190807a56c 4xm: fix signed overflow
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 84dda407628e298f33d610e9e04a8b2945d24665)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:17 +01:00
Mans Rullgard
33029d7353 wmavoice: fix a signed overflow
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit ba3f07d0611d9a6c10eaa90b3c058ecdffe76676)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:13 +01:00
Mans Rullgard
c41950099d mpegvideo_enc: fix a signed overflow
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 05795f35be4b479bfa8d60ed3eb13e0f89e439c0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:08 +01:00
Mans Rullgard
115d88c4b2 h264pred: use unsigned types for pixel values, fix signed overflows
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 60f10e0ad37418cc697765d85b0bc22db70f726a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:48 +01:00
Laurent Aimar
a65045915f qtrle: check for out of bound writes.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7fb92be7e50ea4ba5712804326c6814ae02dd190)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:23 +01:00
Laurent Aimar
adb12c4deb xxan: check for out of bound accesses
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a68a6a4fb19caecc91d5f7fe3ef4f83f6d3c4586)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:15 +01:00
Laurent Aimar
ca58b215ab txd: check for out of bound reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e182de9a98272fbe4f368000911191aaeb0d6fb3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:11 +01:00
Laurent Aimar
67c46b9b30 qtrle: check for invalid line offset
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9f99b89f86b65710d8855dc572f1a25)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:07 +01:00
Laurent Aimar
7ab0b6b7ed vqavideo: check for out of bound reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6d45702f7f257c1cfcd3ce3287bf258854528a4a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:04 +01:00
Laurent Aimar
2fdbc1d553 vqavideo: check for invalid/unsupported version
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b226af39107f09cd650875388250f4968eea54db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:00:54 +01:00
Laurent Aimar
5415c488f9 eamad: release the reference frame on video size changes
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6c1fb3e7631178c2a45c6c41b9b8d9ee3a5298fc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:00:49 +01:00
Laurent Aimar
79bafbb0dd eamad: check for out of bound reads when doing MC
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit da35797359cec148f3fe59894c62727b0422d75a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:00:43 +01:00
Laurent Aimar
7b3c851526 eamad: avoid NULL derefence when missing the reference frame.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6e20554a6d33e92b81dc3cfed6082e03bff2a7f8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:00:38 +01:00
Laurent Aimar
1b6e6439fa eatgv: fix pointer arithmetic overflows.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6bfe0d4c3d7de11e859ea6720b011cf5fdf5ef03)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:00:34 +01:00
Laurent Aimar
4474051370 eatgv: fix out of bound reads on corrupted motions vectors.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 09302a897d1990b1338f049fcd29638d736b8823)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:00:29 +01:00