67344 Commits

Author SHA1 Message Date
Michael Niedermayer
c0ca9773a7 avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()
Its currently guaranteed to be smaller but its safer to check anyway

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f26b3e8ec075298e7ba329a55893d085bafe96)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
9193fd9ddf avformat/oggenc: Check ff_vorbiscomment_length in ogg_write_vorbiscomment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0db5b2b9f8a96298eeba7988d43c4eb44220fab3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
02fe112c7c avformat/flacenc: Check length in flac_write_block_comment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a7700b82aec0036622f8673ce64e070a520891)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
81941153ab avformat/subtitles: Use size_t for len
string length could theoretically be larger than int

Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a633928d47057426a9c328da594407d1c7da8a5c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
2c50cc497d avformat/url: Use size_t for len from strlen()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95efc651294b3cf3e5ec4b3ed36e79d7261545ff)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
8c6bbc6728 avutil/avstring: Use size_t in av_strlcatf()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ae4eea8be45a0b212fd57ceaac1f11089ab81d98)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
27a0dab914 avformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eca38864a6ce5053e463b8d3fc22b22bc9a49578)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
618c7a91ee avutil/dict: Use size_t for appending strings
the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c128ea1629116fc4936edc5f96bbd18f3ef1647)

Conflicts:

	libavutil/dict.c
2015-06-01 23:25:20 +02:00
Michael Niedermayer
e75393c659 libavutil/mem: use size_t for the length in av_strdup()
the string length is not constrained to INT_MAX

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4950bd4ebedbb6289734234bb2a719820f565c41)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Andreas Cadhalpun
17fd68e9d7 aacsbr: break infinite loop in sbr_hf_calc_npatches
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 584cc1ade10a3297ef9c107ef3a2081c04024156)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Andreas Cadhalpun
f61ebd555d diracdec: check that block length is valid
In init_planes p->xblen and p->yblen are set to:
            p->xblen = s->plane[0].xblen >> s->chroma_x_shift;
            p->yblen = s->plane[0].yblen >> s->chroma_y_shift;

These are later used as block_w and block_h arguments of
s->vdsp.emulated_edge_mc. If one of them is 0 it triggers an av_assert2
in emulated_edge_mc:
    av_assert2(start_x < end_x && block_w > 0);
    av_assert2(start_y < end_y && block_h > 0);

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 75fc81c8318505aa7946e05a9bee08d47241fc66)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:20 +02:00
Michael Niedermayer
8c8a9a20cf ffmpeg_opt: Set the video VBV parameters only for the video stream from -target
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2ce6e419113f8276f417a9a8b50122c5467d9bc5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
796cc5a5eb avcodec/bitstream: Assert that there is enough space left in avpriv_copy_bits()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 291ad5cc9cf815eb110b062487980fab2d107936)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
5b5002279d avcodec/put_bits: Assert that there is enough space left in skip_put_bytes()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8f5ffed183e099128a732a00976f69fdc641d093)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
b56de5859e avcodec/mpegvideo_enc: Update the buffer size as more slices are merged
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 561d3a57aaa95c7e8e65e96b36dd069100603650)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
e03fa4b88d avcodec/put_bits: Update size_in_bits in set_put_bits_buffer_size()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e4c2ec879b1121c02279cd60a54643da0d249e40)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Rodger Combs
6d3f0fe24d avformat/wavdec: Increase dts packet threshold to fix more misdetections
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a3e1e9c54997e4dfc7802b5a758b68ceb64982)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
a39a2978d5 avformat/wavdec: Increase probe_packets limit
Fixes DTS detection of b2429e5ba9.dts

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9f5769437aaab30a359cde254f39d9a28b1ce657)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Andreas Cadhalpun
9f99f29f23 nutdec: abort if EOF is reached in decode_info_header/read_sm_data
These loops can take a lot of time if count is very large.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit bb23a15df507440deb0dcf25099d321d0f73dc28)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Andreas Cadhalpun
b947ff8985 nutdec: stop skipping bytes at EOF
This can unnecessarily waste a lot of time.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit fa7dec8cb00d2d0dd96ff9863ccda38428610a21)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Andreas Cadhalpun
936a5dd2c5 nutdec: fix infinite resync loops
nut->last_syncpoint_pos doesn't necessarily change between resync
attempts, so find_any_startcode can return the same startcode again.

Thus remember where the last resync happened and don't try to resync
before that.

This can't be done locally in nut_read_packet, because this wouldn't
prevent infinite resync loops, where after the resync a packet is
returned and while reading a following packet the resync happens again.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 37e679881d364b6da817d829d35869d657218ab3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
236452f83e avformat/nutdec: Check X in 2nd branch of index reading
Prevents read of uninitialized variable

Based on patch by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ebb0ca3d70465ab6d369a66b2ef43bb059705db8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
b45f67b05a avformat/nutdec: Fix recovery when immedeately after seeking a failure happens
Found-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b3496b4a33e806b7afdcbbf6f468b0332b676d7c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
179d850ded avformat/nutdec: Return error on EOF from get_str()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6bbb2f8f4da67af374d62403742482cc5962aa21)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:19 +02:00
Michael Niedermayer
7727877239 Merge commit '0069d4597bda5723fbcae410784bbfa4750df706' into release/2.4
* commit '0069d4597bda5723fbcae410784bbfa4750df706':
  Update changelog for v11.4

Conflicts:
	Changelog
	RELEASE

Not merged, our changelog differs from this

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 05:00:30 +02:00
Reinhard Tartler
0069d4597b Update changelog for v11.4 2015-05-31 10:54:31 -04:00
Michael Niedermayer
b50fa26885 Merge commit '3b69f245dbe6e2016659a45c4bfe284f6c5ac57e' into release/2.4
* commit '3b69f245dbe6e2016659a45c4bfe284f6c5ac57e':
  h264: Make sure reinit failures mark the context as not initialized

Conflicts:
	libavcodec/h264_slice.c

See: e8714f6f93d1a32f4e4655209960afcf4c185214
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-31 00:13:22 +02:00
Michael Niedermayer
2c180cfc5d Merge commit '70642090960c35dcd6da941c869bdf55d4f3bb00' into release/2.4
* commit '70642090960c35dcd6da941c869bdf55d4f3bb00':
  msrle: Use FFABS to determine the frame size in msrle_decode_pal4

Conflicts:
	libavcodec/msrledec.c

See: f7e1367f58263593e6cee3c282f7277d7ee9d553
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-30 23:46:58 +02:00
Luca Barbato
3b69f245db h264: Make sure reinit failures mark the context as not initialized
Bug-Id: CVE-2015-3417
CC: libav-stable@libav.org
2015-05-30 16:32:02 +02:00
Luca Barbato
7064209096 msrle: Use FFABS to determine the frame size in msrle_decode_pal4
As done in msrle_decode_8_16_24_32.

Bug-Id: CVE-2015-3395
CC: libav-stable@libav.org
2015-05-30 16:30:22 +02:00
Michael Niedermayer
95cf5e83a7 Merge commit '4dc0fbb13c33b4e5bdb766652f4daf900ccc952f' into release/2.4
* commit '4dc0fbb13c33b4e5bdb766652f4daf900ccc952f':
  x86: cavs: Remove an unneeded scratch buffer

Conflicts:
	libavcodec/x86/cavsdsp.c

See: d79f7bf0d63a81ee66026ee92a6946a7303d04bd
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-28 22:40:53 +02:00
Michael Niedermayer
e4e64f2fea avcodec/x86/cavsdsp: remove unneeded tmp
This is faster and simpler as well

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d79f7bf0d63a81ee66026ee92a6946a7303d04bd)

Conflicts:

	libavcodec/x86/cavsdsp.c
2015-05-28 22:40:23 +02:00
Michael Niedermayer
4dc0fbb13c x86: cavs: Remove an unneeded scratch buffer
Simplifies the code and makes it build on certain compilers
running out of registers on x86.

CC: libav-stable@libav.org
Reported-By: mudler
(cherry picked from commit e4610300de6869bd6b3b00e76cfeabb6d7653dcd)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-05-28 18:42:30 +02:00
Michael Niedermayer
93ceae749b Merge commit 'b37bfbfbe53917820d1f97312fa0b2e8c7a15217' into release/2.4
* commit 'b37bfbfbe53917820d1f97312fa0b2e8c7a15217':
  configure: Disable i686 for i586 and lower CPUs

See: cdb3eee7c496f763d195de34be7f67783b98fb2c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 22:02:40 +02:00
Michael Niedermayer
dcc8009249 Merge commit '5549f693d2181b3211427f65e48eaa2f4fc5a402' into release/2.4
* commit '5549f693d2181b3211427f65e48eaa2f4fc5a402':
  mjpegenc: Fix JFIF header byte ordering

Conflicts:
	libavcodec/mjpegenc_common.c

See: b19313218c32fa9446d474cbddb11c0776868cd3
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 22:01:58 +02:00
Michael Niedermayer
fb2d1b1b13 Merge commit '1f64b018cbec018fa66a4a20f79958d9707913de' into release/2.4
* commit '1f64b018cbec018fa66a4a20f79958d9707913de':
  nut: Make sure to clean up on read_header failure

Conflicts:
	libavformat/nutdec.c

See: 361702660d2c37a63b7d6381d39e1e1de8405260
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 22:01:21 +02:00
Andreas Cadhalpun
91aa6d8a8b nutdec: fix memleaks on error in nut_read_header
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361702660d2c37a63b7d6381d39e1e1de8405260)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:54:19 +02:00
Michael Niedermayer
1ab5f63941 Merge commit '0f50c53cfb959162f2bccc1a2c2e066d35723595' into release/2.4
* commit '0f50c53cfb959162f2bccc1a2c2e066d35723595':
  png: Set the color range as full range

Conflicts:
	libavcodec/pngdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:54:04 +02:00
Michael Niedermayer
9005075f39 Merge commit 'a55a70644872027fdf76a75edf12a09c9008880f' into release/2.4
* commit 'a55a70644872027fdf76a75edf12a09c9008880f':
  avi: Validate sample_size

Conflicts:
	libavformat/avidec.c

See: ca234639ac49a0dc073ac1f10977979acdb94f97
See: c7369f3a4bd21ea64571c1b0c4fcbf39f8daf68c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:24:51 +02:00
Michael Niedermayer
9f4979b24c avformat/avidec: print a warning for negative sample_size
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c7369f3a4bd21ea64571c1b0c4fcbf39f8daf68c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:24:27 +02:00
Andreas Cadhalpun
df0003030a avidec: avoid infinite loop due to negative ast->sample_size
If max in clean_index is set to a negative ast->sample_size, the
following loop never ends:
        while (max < 1024)
            max += max;

Thus set ast->sample_size to 0 if it would otherwise be negative.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ca234639ac49a0dc073ac1f10977979acdb94f97)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:24:22 +02:00
Michael Niedermayer
95b42188d6 Merge commit '21b21aed797b5e636adcf2df811f96a95f208930' into release/2.4
* commit '21b21aed797b5e636adcf2df811f96a95f208930':
  nut: Check chapter creation in decode_info_header

Conflicts:
	libavformat/nutdec.c

See: 3ff1af2b0db7132d5717be6395227a94c8abab07
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:23:13 +02:00
Andreas Cadhalpun
63afe5b914 nutdec: check chapter creation in decode_info_header
This fixes a segmentation fault when accessing the metadata.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3ff1af2b0db7132d5717be6395227a94c8abab07)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:21:39 +02:00
Michael Niedermayer
2070149cbb Merge commit 'cb5324200ccdc693dd5b28dcd7d4b722fad83ea2' into release/2.4
* commit 'cb5324200ccdc693dd5b28dcd7d4b722fad83ea2':
  alac: Reject rice_limit 0 if compression is used

Conflicts:
	libavcodec/alac.c

See: 4b657a1b1eedcf38bcf36e89a2f4be6f76b5ce09
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:20:13 +02:00
Michael Niedermayer
3cc8285439 Merge commit 'ac1660509ecfbeca7b63eb5ab8360011180e705b' into release/2.4
* commit 'ac1660509ecfbeca7b63eb5ab8360011180e705b':
  ape: Support _0000 files with nblock smaller than 64

Conflicts:
	libavcodec/apedec.c

See: 699341d647f7af785fb8ceed67604467b0b9ab12
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:08:45 +02:00
Andreas Cadhalpun
4e4708ad80 apedec: prevent out of array writes in decode_array_0000
s->decoded_buffer is allocated with a min_size of:
    2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer)

Then it is assigned to s->decoded[0] (and s->decoded_buffer + FFALIGN(blockstodecode, 8)
to s->decoded[1]) and passed as out buffer to decode_array_0000.

In this function 64 elements of the out buffer are written
unconditionally and outside the array if blockstodecode is too small.

This causes memory corruption, leading to segmentation faults or other
crashes.

Thus change decode_array_0000 to write at most blockstodecode elements
of the out buffer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 699341d647f7af785fb8ceed67604467b0b9ab12)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:08:36 +02:00
Michael Niedermayer
8624b49276 Merge commit '386e80610de282c92ad5897683ccaf2675766ac5' into release/2.4
* commit '386e80610de282c92ad5897683ccaf2675766ac5':
  mux: Do not leave stale side data pointers in ff_interleave_add_packet()

Conflicts:
	libavformat/mux.c

See: bfb3ed1a9d5dafdc185080fdd88d02ff7221d30a
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:07:42 +02:00
Michael Niedermayer
39cb08cdc2 Merge commit '744d813bcf527481f2217428fa08bfee8642935b' into release/2.4
* commit '744d813bcf527481f2217428fa08bfee8642935b':
  avresample: Reallocate the internal buffer to the correct size

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 21:07:02 +02:00
Michael Niedermayer
8f3787d068 avformat/mpegts: Detect changes in packet through CRC instead of just the 5bit version
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e0153145f6f8f3aa813652980862bafc8fd9b5c9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 20:57:48 +02:00
Michael Niedermayer
5b1befb074 avformat/mpegts: reset last_ver on corrupted packets
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4b6be54bed27eb7fc8f005505ff38e71b3c86cec)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-19 20:57:42 +02:00