31587 Commits

Author SHA1 Message Date
Justin Ruggles
f98bb0d3ec atrac1: validate number of channels
(cherry picked from commit bff5b2c1ca1290ea30587ff2f76171f9e3854872)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:40:42 +01:00
Justin Ruggles
346e089d25 atrac1: check output buffer size before decoding
(cherry picked from commit 33684b9c12b74c0140fb91e8150263db4a48d55e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:40:35 +01:00
Ronald S. Bultje
0ac6777a34 vp3: fix oob read for negative tokens and memleaks on error.
(cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:37:06 +01:00
Justin Ruggles
ae2d3d6be0 apedec: set s->currentframeblocks after validating nblocks 2011-11-04 03:32:39 +01:00
Justin Ruggles
998fc04bcf apedec: use unsigned int for 'nblocks' and make sure that it's within int range
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:30:44 +01:00
Justin Ruggles
43fa5bf55e apedec: check for data buffer realloc failure
(cherry picked from commit 11ca8b2d7486e879926488404b3b79af774f0f2d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:23:39 +01:00
Justin Ruggles
f19b8d9533 apedec: check for filter buffer allocation failure
(cherry picked from commit 7500781313d11b37772c05a28da20fbc112db478)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:23:34 +01:00
Justin Ruggles
4a66fe2107 mpegaudiodec: check output data size based on avctx->frame_size
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:23:13 +01:00
Michael Niedermayer
edf3c5a3eb resample: Fix array size
Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e7db0a9ee758bf0570a141be1fea64f8d9c03db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:22:03 +01:00
Michael Niedermayer
a39b5e8b32 resample2: fix potential overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Michael Niedermayer
6ae93d0304 resample: Fix overflow
Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Justin Ruggles
241f15f1c9 tta: check for extradata allocation failure in tta demuxer
(cherry picked from commit f540ca22c5fb4504d959c295f55591a9ec2a8859)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Justin Ruggles
2137d99086 vorbisdec: check output buffer size before writing output
(cherry picked from commit 60aa1a358d9c1c8f891e72246d5dcd897857eca8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Justin Ruggles
e9de2d98a9 twinvq: check output buffer size before decoding
(cherry picked from commit e53eecd0e7211973a1a9757f559bdd93a1848901)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Alex Converse
93f1159af5 vp6: Fix illegal read.
(cherry picked from commit 2a6eb06254df79e96b3d791b6b89b2534ced3119)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:54:13 +01:00
Justin Ruggles
b08001e00a shorten: check output buffer size before decoding
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:30:29 +01:00
Justin Ruggles
e1ea35fb52 shorten: check for realloc failure
(cherry picked from commit 9e5e2c2d010c05c10337e9c1ec9d0d61495e0c9c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:24:03 +01:00
Laurent Aimar
cbfd34246c mpegts: do not return from ff_mpegts_parse_packet() after having seen the first PMT
It prevents leaving the AVPacket uninitialized.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bc38e83793be5f7a184c88be55e556453a25224b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:56 +01:00
Laurent Aimar
feef77ec3a mpegts: fix return value when enough ts packets have been parsed or when the first PMT has been seen.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 49ec0c818dc3c1c293a582b57fb58ba611a10b32)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:52 +01:00
Matthew Einhorn
f531193690 Fixes avpicture_layout to not write past buffer end.
avpicture_get_size() returns the size of buffer required for avpicture_layout.
For pseudo-paletted formats (gray8...) this size does not include the palette.
However, avpicture_layout doesn't know this and still writes the palette. Consequently,
avpicture_layout writes passed the length of the buffer. This fixes it
by fixing avpicture_layout so that it doesn't write the palette for these formats.

Signed-off-by: Matthew Einhorn <moiein2000@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e662b263d9c500270a8f1dc7e1b81b51d5bdfd4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:47 +01:00
Alex Converse
e86e9f8b7a avio: Check for invalid buffer length.
(cherry picked from commit ab2940691ba76e1a9b0ce608db0dfc45021d741e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:33 +01:00
Ronald S. Bultje
15a7fe106c pthread: copy coded frame dimensions in update_context_from_thread
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit feadcd1bdcbb4601f4ff01878027264fde985ee1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:28 +01:00
Ronald S. Bultje
d32f509de1 vp8: prevent read from uninitialized memory in decode_mvs
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 0f0b5d643401d4d83322eeee0e57eb5a226ef9ab)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:22:59 +01:00
Ronald S. Bultje
5f5f36b52e vp8: force reallocation in update_thread_context after frame size change
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 56535793810584f5b3ae59e62cea66fe22d0307d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:22:52 +01:00
Ronald S. Bultje
d1166f03be vp8: fix return value if update_dimensions fails
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit f05c2fb6eb1f9ddaec3c07d1874ba62ec0891269)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:22:45 +01:00
Ronald S. Bultje
d51c7b4cbe matroskadec: fix out of bounds write
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 723229c11f1400e6a09c8a1c9c27193f376eb1d1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:22:38 +01:00
Alex Converse
e58870a587 mov: 10l: Terminate string with 0 not '0'
(cherry picked from commit 7ad06beb2cf31d8a96f475361425d6cc95e8f176)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:21:57 +01:00
Alex Converse
5c18bcfd9c mov: Prevent illegal writes when chapter titles are very short.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:11:18 +01:00
Justin Ruggles
62cf52c860 truespeech: check to make sure channels == 1
(cherry picked from commit 3e7a176759e8a8e66d65c779b47b5bba793dfd4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:09:22 +01:00
Justin Ruggles
7e95a12d51 mlpdec: validate that the reported channel count matches the actual output
channel count
(cherry picked from commit caa845851d790f894a2ccbe12580934f75545f92)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:09:17 +01:00
John Brooks
2c0cddf255 rtpdec: Read the packet length for all RTCP packet types
This allows skipping past unsupported RTCP packet types, as
RFC 3550 section 6.1 mandates.

Currently this only has any practical effect if a sender puts
an unrecognized type before RTCP_BYE in a compounded packet, or
(incorrectly) does not put RTCP_SR first.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 07b77fe3871f86b87e35876d38f1969da5ece4b2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:09:05 +01:00
John Brooks
d398d042c1 rtpdec: Fix the minimum packet length for RTCP SR packets
We actually read 20 bytes of these packets.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d6ecf5345c0913e2b66427ea062e7989201a139)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:08:54 +01:00
Michael Niedermayer
5ae87280e2 mem: fix memalign hack av_realloc()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc11927890f38445a950b453d24928525da0e61a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:08:24 +01:00
Michael Niedermayer
7d02df7036 arm: fix av_clipl_int32() asm
Note, the other arm asm code is likely affected too and should be changed as well.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 96bc6485bc929741827fc0f08ef06bea662a3eea)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:08:16 +01:00
Mans Rullgard
1c3d46a924 h264: fix HRD parameters parsing
The bit_rate_value_minus1 and cpb_size_value_minus1 elements
allow a wider range than get_ue_golomb() supports.  This
adds a get_ue_golomb_long() function supporting up to 31
leading zeros, which is the maximum for these syntax
elements, and uses it in decode_hrd_parameters().

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit fdba370f8a1bdfc22ecbdf3c7148c2f8680a4ac4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:08:09 +01:00
Justin Ruggles
800ab099e3 smacker: validate channels and sample format.
(cherry picked from commit ff1f89de2da3472d133e2c95bf7c9ad2d88df33d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:07:49 +01:00
Justin Ruggles
e6b2255329 smacker: check buffer size before reading output size
(cherry picked from commit cf044f8bff0d28dbc34492f18b0d18b3ba8bad9d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:07:44 +01:00
Justin Ruggles
7f7b2e89e2 smacker: validate number of channels
(cherry picked from commit e190e453bd1e4d4b409ed3556b3a50d1087c15d7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:07:39 +01:00
Mans Rullgard
73f85eae68 sipr: fix get_bits(0) calls
Zero-length get_bits() is undefined, must check before calling.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit c79d2a20bad59298188171f1316a830d563a41ee)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:46 +01:00
Alex Converse
9b6080f685 mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions.
(cherry picked from commit 0c46e958d1fd3817b8e9fa048d0450d509c80378)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:29 +01:00
Mans Rullgard
190807a56c 4xm: fix signed overflow
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 84dda407628e298f33d610e9e04a8b2945d24665)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:17 +01:00
Mans Rullgard
33029d7353 wmavoice: fix a signed overflow
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit ba3f07d0611d9a6c10eaa90b3c058ecdffe76676)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:13 +01:00
Mans Rullgard
c41950099d mpegvideo_enc: fix a signed overflow
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 05795f35be4b479bfa8d60ed3eb13e0f89e439c0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:08 +01:00
Mans Rullgard
f65e396aa1 crc: fix signed overflow
This fixes a signed overflow from i << 24 when i == 255 by
making i unsigned.  The result of the shift is already
assigned to an variable of unsigned type.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 8b19ae07616bbd18969b94cbf5d74308a8f2bbdf)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:03 +01:00
Mans Rullgard
115d88c4b2 h264pred: use unsigned types for pixel values, fix signed overflows
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 60f10e0ad37418cc697765d85b0bc22db70f726a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:48 +01:00
Laurent Aimar
a65045915f qtrle: check for out of bound writes.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7fb92be7e50ea4ba5712804326c6814ae02dd190)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:23 +01:00
Laurent Aimar
adb12c4deb xxan: check for out of bound accesses
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a68a6a4fb19caecc91d5f7fe3ef4f83f6d3c4586)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:15 +01:00
Laurent Aimar
ca58b215ab txd: check for out of bound reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e182de9a98272fbe4f368000911191aaeb0d6fb3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:11 +01:00
Laurent Aimar
67c46b9b30 qtrle: check for invalid line offset
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9f99b89f86b65710d8855dc572f1a25)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:07 +01:00
Laurent Aimar
7ab0b6b7ed vqavideo: check for out of bound reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6d45702f7f257c1cfcd3ce3287bf258854528a4a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:01:04 +01:00