67051 Commits

Author SHA1 Message Date
Michael Niedermayer
f30ab69b38 avformat/hevc: Check num_negative_pics and num_positive_pics
Fixes CID1238994

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b62b3292d8e25d3240e462c1b1cd8ac69195c46b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
ce3bb01119 avformat/hevc: Check cpb_cnt_minus1
Fixes CID1239014

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2cddc0b19a20dd061dbf199bf88005b37c540d2f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
3bd85e1f83 avformat/matroskadec: Cleanup error handling for bz2 & zlib
Fixes CID703652

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 171af59d58fc67d82dce8ff7ed11fa671108baa5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
7c4e3ddda1 avformat/nutdec: Fix use of uinitialized value
Fixes CID1041175

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56abf35151c635caa3eb04bbb90454bae5463a09)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
fbd9ab5967 avformat/rtpenc_jpeg: Check remaining buffer size for SOS
Fixes CID1238818

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81198a68370e88f7d02f16de58db36713c2a50b6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
18e83992f2 avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Larger packets are not supported and would cause problems later

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e160551fb1c290d1397da2f04325817)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
bec4b3c856 tools/graph2dot: use larger data types than int for array/string sizes
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit acf4925f444636a828534ab47d0f86c21a7a9b4e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
c0ca9773a7 avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()
Its currently guaranteed to be smaller but its safer to check anyway

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f26b3e8ec075298e7ba329a55893d085bafe96)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
9193fd9ddf avformat/oggenc: Check ff_vorbiscomment_length in ogg_write_vorbiscomment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0db5b2b9f8a96298eeba7988d43c4eb44220fab3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
02fe112c7c avformat/flacenc: Check length in flac_write_block_comment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a7700b82aec0036622f8673ce64e070a520891)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
81941153ab avformat/subtitles: Use size_t for len
string length could theoretically be larger than int

Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a633928d47057426a9c328da594407d1c7da8a5c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
2c50cc497d avformat/url: Use size_t for len from strlen()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95efc651294b3cf3e5ec4b3ed36e79d7261545ff)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
8c6bbc6728 avutil/avstring: Use size_t in av_strlcatf()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ae4eea8be45a0b212fd57ceaac1f11089ab81d98)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
27a0dab914 avformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eca38864a6ce5053e463b8d3fc22b22bc9a49578)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
618c7a91ee avutil/dict: Use size_t for appending strings
the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c128ea1629116fc4936edc5f96bbd18f3ef1647)

Conflicts:

	libavutil/dict.c
2015-06-01 23:25:20 +02:00
Michael Niedermayer
e75393c659 libavutil/mem: use size_t for the length in av_strdup()
the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4950bd4ebedbb6289734234bb2a719820f565c41)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Andreas Cadhalpun
17fd68e9d7 aacsbr: break infinite loop in sbr_hf_calc_npatches
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 584cc1ade10a3297ef9c107ef3a2081c04024156)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Andreas Cadhalpun
f61ebd555d diracdec: check that block length is valid
In init_planes p->xblen and p->yblen are set to:
            p->xblen = s->plane[0].xblen >> s->chroma_x_shift;
            p->yblen = s->plane[0].yblen >> s->chroma_y_shift;

These are later used as block_w and block_h arguments of
s->vdsp.emulated_edge_mc. If one of them is 0 it triggers an av_assert2
in emulated_edge_mc:
    av_assert2(start_x < end_x && block_w > 0);
    av_assert2(start_y < end_y && block_h > 0);

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 75fc81c8318505aa7946e05a9bee08d47241fc66)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
8c8a9a20cf ffmpeg_opt: Set the video VBV parameters only for the video stream from -target
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2ce6e419113f8276f417a9a8b50122c5467d9bc5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
796cc5a5eb avcodec/bitstream: Assert that there is enough space left in avpriv_copy_bits()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 291ad5cc9cf815eb110b062487980fab2d107936)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
5b5002279d avcodec/put_bits: Assert that there is enough space left in skip_put_bytes()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8f5ffed183e099128a732a00976f69fdc641d093)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
b56de5859e avcodec/mpegvideo_enc: Update the buffer size as more slices are merged
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 561d3a57aaa95c7e8e65e96b36dd069100603650)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
e03fa4b88d avcodec/put_bits: Update size_in_bits in set_put_bits_buffer_size()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e4c2ec879b1121c02279cd60a54643da0d249e40)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Rodger Combs
6d3f0fe24d avformat/wavdec: Increase dts packet threshold to fix more misdetections
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a3e1e9c54997e4dfc7802b5a758b68ceb64982)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
a39a2978d5 avformat/wavdec: Increase probe_packets limit
Fixes DTS detection of b2429e5ba9.dts

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9f5769437aaab30a359cde254f39d9a28b1ce657)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Andreas Cadhalpun
9f99f29f23 nutdec: abort if EOF is reached in decode_info_header/read_sm_data
These loops can take a lot of time if count is very large.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit bb23a15df507440deb0dcf25099d321d0f73dc28)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Andreas Cadhalpun
b947ff8985 nutdec: stop skipping bytes at EOF
This can unnecessarily waste a lot of time.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit fa7dec8cb00d2d0dd96ff9863ccda38428610a21)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Andreas Cadhalpun
936a5dd2c5 nutdec: fix infinite resync loops
nut->last_syncpoint_pos doesn't necessarily change between resync
attempts, so find_any_startcode can return the same startcode again.

Thus remember where the last resync happened and don't try to resync
before that.

This can't be done locally in nut_read_packet, because this wouldn't
prevent infinite resync loops, where after the resync a packet is
returned and while reading a following packet the resync happens again.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 37e679881d364b6da817d829d35869d657218ab3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
236452f83e avformat/nutdec: Check X in 2nd branch of index reading
Prevents read of uninitialized variable

Based on patch by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ebb0ca3d70465ab6d369a66b2ef43bb059705db8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
b45f67b05a avformat/nutdec: Fix recovery when immedeately after seeking a failure happens
Found-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b3496b4a33e806b7afdcbbf6f468b0332b676d7c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
179d850ded avformat/nutdec: Return error on EOF from get_str()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6bbb2f8f4da67af374d62403742482cc5962aa21)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
7727877239 Merge commit '0069d4597bda5723fbcae410784bbfa4750df706' into release/2.4
* commit '0069d4597bda5723fbcae410784bbfa4750df706':
  Update changelog for v11.4

Conflicts:
	Changelog
	RELEASE

Not merged, our changelog differs from this

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 05:00:30 +02:00
Reinhard Tartler
0069d4597b Update changelog for v11.4 2015-05-31 10:54:31 -04:00
Michael Niedermayer
b50fa26885 Merge commit '3b69f245dbe6e2016659a45c4bfe284f6c5ac57e' into release/2.4
* commit '3b69f245dbe6e2016659a45c4bfe284f6c5ac57e':
  h264: Make sure reinit failures mark the context as not initialized

Conflicts:
	libavcodec/h264_slice.c

See: e8714f6f93d1a32f4e4655209960afcf4c185214
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-31 00:13:22 +02:00
Michael Niedermayer
2c180cfc5d Merge commit '70642090960c35dcd6da941c869bdf55d4f3bb00' into release/2.4
* commit '70642090960c35dcd6da941c869bdf55d4f3bb00':
  msrle: Use FFABS to determine the frame size in msrle_decode_pal4

Conflicts:
	libavcodec/msrledec.c

See: f7e1367f58263593e6cee3c282f7277d7ee9d553
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-30 23:46:58 +02:00
Luca Barbato
3b69f245db h264: Make sure reinit failures mark the context as not initialized
Bug-Id: CVE-2015-3417
CC: libav-stable@libav.org
2015-05-30 16:32:02 +02:00
Luca Barbato
7064209096 msrle: Use FFABS to determine the frame size in msrle_decode_pal4
As done in msrle_decode_8_16_24_32.

Bug-Id: CVE-2015-3395
CC: libav-stable@libav.org
2015-05-30 16:30:22 +02:00
Michael Niedermayer
95cf5e83a7 Merge commit '4dc0fbb13c33b4e5bdb766652f4daf900ccc952f' into release/2.4
* commit '4dc0fbb13c33b4e5bdb766652f4daf900ccc952f':
  x86: cavs: Remove an unneeded scratch buffer

Conflicts:
	libavcodec/x86/cavsdsp.c

See: d79f7bf0d63a81ee66026ee92a6946a7303d04bd
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-28 22:40:53 +02:00
Michael Niedermayer
e4e64f2fea avcodec/x86/cavsdsp: remove unneeded tmp
This is faster and simpler as well

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d79f7bf0d63a81ee66026ee92a6946a7303d04bd)

Conflicts:

	libavcodec/x86/cavsdsp.c
2015-05-28 22:40:23 +02:00
Michael Niedermayer
4dc0fbb13c x86: cavs: Remove an unneeded scratch buffer
Simplifies the code and makes it build on certain compilers
running out of registers on x86.

CC: libav-stable@libav.org
Reported-By: mudler
(cherry picked from commit e4610300de6869bd6b3b00e76cfeabb6d7653dcd)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-05-28 18:42:30 +02:00
Michael Niedermayer
93ceae749b Merge commit 'b37bfbfbe53917820d1f97312fa0b2e8c7a15217' into release/2.4
* commit 'b37bfbfbe53917820d1f97312fa0b2e8c7a15217':
  configure: Disable i686 for i586 and lower CPUs

See: cdb3eee7c496f763d195de34be7f67783b98fb2c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 22:02:40 +02:00
Michael Niedermayer
dcc8009249 Merge commit '5549f693d2181b3211427f65e48eaa2f4fc5a402' into release/2.4
* commit '5549f693d2181b3211427f65e48eaa2f4fc5a402':
  mjpegenc: Fix JFIF header byte ordering

Conflicts:
	libavcodec/mjpegenc_common.c

See: b19313218c32fa9446d474cbddb11c0776868cd3
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 22:01:58 +02:00
Michael Niedermayer
fb2d1b1b13 Merge commit '1f64b018cbec018fa66a4a20f79958d9707913de' into release/2.4
* commit '1f64b018cbec018fa66a4a20f79958d9707913de':
  nut: Make sure to clean up on read_header failure

Conflicts:
	libavformat/nutdec.c

See: 361702660d2c37a63b7d6381d39e1e1de8405260
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 22:01:21 +02:00
Andreas Cadhalpun
91aa6d8a8b nutdec: fix memleaks on error in nut_read_header
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361702660d2c37a63b7d6381d39e1e1de8405260)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:54:19 +02:00
Michael Niedermayer
1ab5f63941 Merge commit '0f50c53cfb959162f2bccc1a2c2e066d35723595' into release/2.4
* commit '0f50c53cfb959162f2bccc1a2c2e066d35723595':
  png: Set the color range as full range

Conflicts:
	libavcodec/pngdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:54:04 +02:00
Michael Niedermayer
9005075f39 Merge commit 'a55a70644872027fdf76a75edf12a09c9008880f' into release/2.4
* commit 'a55a70644872027fdf76a75edf12a09c9008880f':
  avi: Validate sample_size

Conflicts:
	libavformat/avidec.c

See: ca234639ac49a0dc073ac1f10977979acdb94f97
See: c7369f3a4bd21ea64571c1b0c4fcbf39f8daf68c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:24:51 +02:00
Michael Niedermayer
9f4979b24c avformat/avidec: print a warning for negative sample_size
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c7369f3a4bd21ea64571c1b0c4fcbf39f8daf68c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:24:27 +02:00
Andreas Cadhalpun
df0003030a avidec: avoid infinite loop due to negative ast->sample_size
If max in clean_index is set to a negative ast->sample_size, the
following loop never ends:
        while (max < 1024)
            max += max;

Thus set ast->sample_size to 0 if it would otherwise be negative.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ca234639ac49a0dc073ac1f10977979acdb94f97)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:24:22 +02:00
Michael Niedermayer
95b42188d6 Merge commit '21b21aed797b5e636adcf2df811f96a95f208930' into release/2.4
* commit '21b21aed797b5e636adcf2df811f96a95f208930':
  nut: Check chapter creation in decode_info_header

Conflicts:
	libavformat/nutdec.c

See: 3ff1af2b0db7132d5717be6395227a94c8abab07
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:23:13 +02:00
Andreas Cadhalpun
63afe5b914 nutdec: check chapter creation in decode_info_header
This fixes a segmentation fault when accessing the metadata.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3ff1af2b0db7132d5717be6395227a94c8abab07)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:21:39 +02:00