generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge commit '2c1d84499bfe06d75e9160b824eeffd9f5587337' into release/0.10

Browse Source 
* commit '2c1d84499bfe06d75e9160b824eeffd9f5587337':
  lagarith: pad RGB buffer by 1 byte.
  truemotion1: check the header size
  shorten: pad the internal bitstream buffer
  samplefmt: avoid integer overflow in av_samples_get_buffer_size()
  h264: Fix a typo from the previous commit
  h264: Lower bound check for slice offsets
  rpza: limit the number of blocks to the total remaining blocks in the frame

Conflicts:
	libavcodec/lagarith.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2014-03-10 18:39:02 +01:00
parent 15efd9a7c0 2c1d84499b
commit 5640ea43d7
7 changed files with 38 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
libavcodec/h264.c
View File

@@ -3231,8 +3231,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
} }
h->deblocking_filter = 1; h->deblocking_filter = 1;
h->slice_alpha_c0_offset = 52; h->slice_alpha_c0_offset = 0;
h->slice_beta_offset = 52; h->slice_beta_offset = 0;
if( h->pps.deblocking_filter_parameters_present ) { if( h->pps.deblocking_filter_parameters_present ) {
tmp= get_ue_golomb_31(&s->gb); tmp= get_ue_golomb_31(&s->gb);
if(tmp > 2){ if(tmp > 2){
@@ -3243,12 +3243,16 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
if(h->deblocking_filter < 2) if(h->deblocking_filter < 2)
h->deblocking_filter^= 1; // 1<->0 h->deblocking_filter^= 1; // 1<->0
if( h->deblocking_filter ) { if (h->deblocking_filter) {
h->slice_alpha_c0_offset += get_se_golomb(&s->gb) << 1; h->slice_alpha_c0_offset = get_se_golomb(&s->gb) * 2;
h->slice_beta_offset += get_se_golomb(&s->gb) << 1; h->slice_beta_offset = get_se_golomb(&s->gb) * 2;
if( h->slice_alpha_c0_offset > 104U if (h->slice_alpha_c0_offset > 12 ||
|| h->slice_beta_offset > 104U){ h->slice_alpha_c0_offset < -12 ||
av_log(s->avctx, AV_LOG_ERROR, "deblocking filter parameters %d %d out of range\n", h->slice_alpha_c0_offset, h->slice_beta_offset); h->slice_beta_offset > 12 ||
h->slice_beta_offset < -12) {
av_log(s->avctx, AV_LOG_ERROR,
"deblocking filter parameters %d %d out of range\n",
h->slice_alpha_c0_offset, h->slice_beta_offset);
return -1; return -1;
} }
} }
@@ -3277,14 +3281,12 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
} }
} }
} }
h->qp_thresh = 15 + 52 - FFMIN(h->slice_alpha_c0_offset, h->slice_beta_offset) h->qp_thresh = 15 -
- FFMAX3(0, h->pps.chroma_qp_index_offset[0], h->pps.chroma_qp_index_offset[1]) FFMIN(h->slice_alpha_c0_offset, h->slice_beta_offset) -
+ 6 * (h->sps.bit_depth_luma - 8); FFMAX3(0,
h->pps.chroma_qp_index_offset[0],
#if 0 //FMO h->pps.chroma_qp_index_offset[1]) +
if( h->pps.num_slice_groups > 1 && h->pps.mb_slice_group_map_type >= 3 && h->pps.mb_slice_group_map_type <= 5) 6 * (h->sps.bit_depth_luma - 8);
slice_group_change_cycle= get_bits(&s->gb, ?);
#endif
h0->last_slice_type = slice_type; h0->last_slice_type = slice_type;
h->slice_num = ++h0->current_slice; h->slice_num = ++h0->current_slice;
@@ -3345,7 +3347,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
s->current_picture_ptr->field_poc[0], s->current_picture_ptr->field_poc[1], s->current_picture_ptr->field_poc[0], s->current_picture_ptr->field_poc[1],
h->ref_count[0], h->ref_count[1], h->ref_count[0], h->ref_count[1],
s->qscale, s->qscale,
h->deblocking_filter, h->slice_alpha_c0_offset/2-26, h->slice_beta_offset/2-26, h->deblocking_filter,
h->slice_alpha_c0_offset, h->slice_beta_offset,
h->use_weight, h->use_weight,
h->use_weight==1 && h->use_weight_chroma ? "c" : "", h->use_weight==1 && h->use_weight_chroma ? "c" : "",
h->slice_type == AV_PICTURE_TYPE_B ? (h->direct_spatial_mv_pred ? "SPAT" : "TEMP") : "" h->slice_type == AV_PICTURE_TYPE_B ? (h->direct_spatial_mv_pred ? "SPAT" : "TEMP") : ""

8
libavcodec/h264_loopfilter.c
View File

@@ -254,8 +254,8 @@ static av_always_inline void h264_filter_mb_fast_internal(H264Context *h,
int top_type= h->top_type; int top_type= h->top_type;
int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8); int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8);
int a = h->slice_alpha_c0_offset - qp_bd_offset; int a = 52 + h->slice_alpha_c0_offset - qp_bd_offset;
int b = h->slice_beta_offset - qp_bd_offset; int b = 52 + h->slice_beta_offset - qp_bd_offset;
int mb_type = s->current_picture.f.mb_type[mb_xy]; int mb_type = s->current_picture.f.mb_type[mb_xy];
int qp = s->current_picture.f.qscale_table[mb_xy]; int qp = s->current_picture.f.qscale_table[mb_xy];
@@ -715,8 +715,8 @@ void ff_h264_filter_mb( H264Context *h, int mb_x, int mb_y, uint8_t *img_y, uint
av_unused int dir; av_unused int dir;
int chroma = !(CONFIG_GRAY && (s->flags&CODEC_FLAG_GRAY)); int chroma = !(CONFIG_GRAY && (s->flags&CODEC_FLAG_GRAY));
int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8); int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8);
int a = h->slice_alpha_c0_offset - qp_bd_offset; int a = 52 + h->slice_alpha_c0_offset - qp_bd_offset;
int b = h->slice_beta_offset - qp_bd_offset; int b = 52 + h->slice_beta_offset - qp_bd_offset;
if (FRAME_MBAFF if (FRAME_MBAFF
// and current and left pair do not have the same interlaced type // and current and left pair do not have the same interlaced type

2
libavcodec/lagarith.c
View File

@@ -509,7 +509,7 @@ static int lag_decode_frame(AVCodecContext *avctx,
if (!l->rgb_planes) { if (!l->rgb_planes) {
l->rgb_stride = FFALIGN(avctx->width, 16); l->rgb_stride = FFALIGN(avctx->width, 16);
l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * 4); l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * 4 + 1);
if (!l->rgb_planes) { if (!l->rgb_planes) {
av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n"); av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
return AVERROR(ENOMEM); return AVERROR(ENOMEM);

3
libavcodec/rpza.c
View File

@@ -38,6 +38,7 @@
#include <stdlib.h> #include <stdlib.h>
#include <string.h> #include <string.h>
#include "libavutil/common.h"
#include "libavutil/intreadwrite.h" #include "libavutil/intreadwrite.h"
#include "avcodec.h" #include "avcodec.h"
@@ -125,6 +126,8 @@ static void rpza_decode_stream(RpzaContext *s)
} }
} }
n_blocks = FFMIN(n_blocks, total_blocks);
switch (opcode & 0xe0) { switch (opcode & 0xe0) {
/* Skip blocks */ /* Skip blocks */

2
libavcodec/shorten.c
View File

@@ -431,7 +431,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
void *tmp_ptr; void *tmp_ptr;
s->max_framesize = 1024; // should hopefully be enough for the first header s->max_framesize = 1024; // should hopefully be enough for the first header
tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size,
s->max_framesize); s->max_framesize + FF_INPUT_BUFFER_PADDING_SIZE);
if (!tmp_ptr) { if (!tmp_ptr) {
av_log(avctx, AV_LOG_ERROR, "error allocating bitstream buffer\n"); av_log(avctx, AV_LOG_ERROR, "error allocating bitstream buffer\n");
return AVERROR(ENOMEM); return AVERROR(ENOMEM);

5
libavcodec/truemotion1.c
View File

@@ -320,6 +320,11 @@ static int truemotion1_decode_header(TrueMotion1Context *s)
return -1; return -1;
} }
if (header.header_size + 1 > s->size) {
av_log(s->avctx, AV_LOG_ERROR, "Input packet too small.\n");
return AVERROR_INVALIDDATA;
}
/* unscramble the header bytes with a XOR operation */ /* unscramble the header bytes with a XOR operation */
memset(header_buffer, 0, 128); memset(header_buffer, 0, 128);
for (i = 1; i < header.header_size; i++) for (i = 1; i < header.header_size; i++)

5
libavutil/samplefmt.c
View File

@@ -115,8 +115,11 @@ int av_samples_get_buffer_size(int *linesize, int nb_channels, int nb_samples,
return AVERROR(EINVAL); return AVERROR(EINVAL);
/* auto-select alignment if not specified */ /* auto-select alignment if not specified */
if (!align) if (!align) {
if (nb_samples > INT_MAX - 31)
return AVERROR(EINVAL);
align = 32; align = 32;
}
/* check for integer overflow */ /* check for integer overflow */
if (nb_channels > INT_MAX / align || if (nb_channels > INT_MAX / align ||