generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'qatar/release/0.6' into release/0.6

Browse Source 
* qatar/release/0.6: (58 commits)
  Bump version number for 0.6.4 release.
  qdm2: check output buffer size before decoding
  Fix qdm2 decoder packet handling to match the api
  4xm: Add a check in decode_i_frame to prevent buffer overreads
  wma: initialize prev_block_len_bits, next_block_len_bits, and block_len_bits.
  swscale: #include "libavutil/mathematics.h"
  vp3dec: Check coefficient index in vp3_dequant()
  svq1dec: call avcodec_set_dimensions() after dimensions changed.
  vp6: Fix illegal read.
  vp6: Fix illegal read.
  vp6: Reset the internal state when aborting key frames header parsing
  vp6: Check for huffman tree build errors
  vp6: partially propagate huffman tree building errors during coeff model parsing and fix misspelling
  Fix out of bound reads in the QDM2 decoder.
  Check for out of bound writes in the QDM2 decoder.
  vmd: fix segfaults on corruped streams
  rv34: Check for invalid slice offsets
  rv34: Fix potential overreads
  rv34: Avoid NULL dereference on corrupted bitstream
  rv10: Reject slices that does not have the same type as the first one
  ...

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2011-12-25 01:24:17 +01:00
commit 57eb787ed3
39 changed files with 427 additions and 223 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/4xm.c
View File

@ -641,9 +641,18 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){
uint16_t *dst= (uint16_t*)f->current_picture.data[0];
const int stride= f->current_picture.linesize[0]>>1;
const unsigned int bitstream_size= AV_RL32(buf);
const int token_count av_unused = AV_RL32(buf + bitstream_size + 8);
unsigned int prestream_size= 4*AV_RL32(buf + bitstream_size + 4);
const uint8_t *prestream= buf + bitstream_size + 12;
int token_count av_unused;
unsigned int prestream_size;
const uint8_t *prestream;
if (length < bitstream_size + 12) {
av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n");
return AVERROR_INVALIDDATA;
}
token_count = AV_RL32(buf + bitstream_size + 8);
prestream_size = 4 * AV_RL32(buf + bitstream_size + 4);
prestream = buf + bitstream_size + 12;
if(prestream_size + bitstream_size + 12 != length
|| bitstream_size > (1<<26)

19
libavcodec/aacps.c
View File

@ -813,14 +813,17 @@ static void stereo_processing(PSContext *ps, float (*l)[32][2], float (*r)[32][2
const float (*H_LUT)[8][4] = (PS_BASELINE || ps->icc_mode < 3) ? HA : HB;
//Remapping
memcpy(H11[0][0], H11[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H11[0][0][0]));
memcpy(H11[1][0], H11[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H11[1][0][0]));
memcpy(H12[0][0], H12[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H12[0][0][0]));
memcpy(H12[1][0], H12[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H12[1][0][0]));
memcpy(H21[0][0], H21[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H21[0][0][0]));
memcpy(H21[1][0], H21[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H21[1][0][0]));
memcpy(H22[0][0], H22[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H22[0][0][0]));
memcpy(H22[1][0], H22[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H22[1][0][0]));
if (ps->num_env_old) {
memcpy(H11[0][0], H11[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H11[0][0][0]));
memcpy(H11[1][0], H11[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H11[1][0][0]));
memcpy(H12[0][0], H12[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H12[0][0][0]));
memcpy(H12[1][0], H12[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H12[1][0][0]));
memcpy(H21[0][0], H21[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H21[0][0][0]));
memcpy(H21[1][0], H21[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H21[1][0][0]));
memcpy(H22[0][0], H22[0][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H22[0][0][0]));
memcpy(H22[1][0], H22[1][ps->num_env_old], PS_MAX_NR_IIDICC*sizeof(H22[1][0][0]));
}
if (is34) {
remap34(&iid_mapped, ps->iid_par, ps->nr_iid_par, ps->num_env, 1);
remap34(&icc_mapped, ps->icc_par, ps->nr_icc_par, ps->num_env, 1);

1
libavcodec/dca.c
View File

@ -1224,6 +1224,7 @@ static int dca_decode_frame(AVCodecContext * avctx,
//set AVCodec values with parsed data
avctx->sample_rate = s->sample_rate;
avctx->bit_rate = s->bit_rate;
avctx->frame_size = s->sample_blocks * 32;
channels = s->prim_channels + !!s->lfe;

25
libavcodec/h264.c
View File

@ -1448,15 +1448,17 @@ static void implicit_weight_table(H264Context *h, int field){
for(ref0=ref_start; ref0 < ref_count0; ref0++){
int poc0 = h->ref_list[0][ref0].poc;
for(ref1=ref_start; ref1 < ref_count1; ref1++){
int poc1 = h->ref_list[1][ref1].poc;
int td = av_clip(poc1 - poc0, -128, 127);
int w= 32;
if(td){
int tb = av_clip(cur_poc - poc0, -128, 127);
int tx = (16384 + (FFABS(td) >> 1)) / td;
int dist_scale_factor = (tb*tx + 32) >> 8;
if(dist_scale_factor >= -64 && dist_scale_factor <= 128)
w = 64 - dist_scale_factor;
int w = 32;
if (!h->ref_list[0][ref0].long_ref && !h->ref_list[1][ref1].long_ref) {
int poc1 = h->ref_list[1][ref1].poc;
int td = av_clip(poc1 - poc0, -128, 127);
if(td){
int tb = av_clip(cur_poc - poc0, -128, 127);
int tx = (16384 + (FFABS(td) >> 1)) / td;
int dist_scale_factor = (tb*tx + 32) >> 8;
if(dist_scale_factor >= -64 && dist_scale_factor <= 128)
w = 64 - dist_scale_factor;
}
}
if(field<0){
h->implicit_weight[ref0][ref1][0]=
@ -1840,7 +1842,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
h->prev_interlaced_frame = 1;
init_scan_tables(h);
ff_h264_alloc_tables(h);
if (ff_h264_alloc_tables(h) < 0) {
av_log(h->s.avctx, AV_LOG_ERROR, "Could not allocate memory for h264\n");
return AVERROR(ENOMEM);
}
for(i = 1; i < s->avctx->thread_count; i++) {
H264Context *c;

2
libavcodec/h264_refs.c
View File

@ -657,7 +657,7 @@ int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb){
}
if(opcode==MMCO_SHORT2LONG || opcode==MMCO_LONG2UNUSED || opcode==MMCO_LONG || opcode==MMCO_SET_MAX_LONG){
unsigned int long_arg= get_ue_golomb_31(gb);
if(long_arg >= 32 || (long_arg >= 16 && !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
if(long_arg >= 32 || (long_arg >= 16 && !(opcode == MMCO_SET_MAX_LONG && long_arg == 16) && !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
av_log(h->s.avctx, AV_LOG_ERROR, "illegal long ref in memory management control operation %d\n", opcode);
return -1;
}

10
libavcodec/indeo2.c
View File

@ -156,6 +156,13 @@ static int ir2_decode_frame(AVCodecContext *avctx,
return -1;
}
start = 48; /* hardcoded for now */
if (start >= buf_size) {
av_log(s->avctx, AV_LOG_ERROR, "input buffer size too small (%d)\n", buf_size);
return AVERROR_INVALIDDATA;
}
s->decode_delta = buf[18];
/* decide whether frame uses deltas or not */
@ -163,9 +170,8 @@ static int ir2_decode_frame(AVCodecContext *avctx,
for (i = 0; i < buf_size; i++)
buf[i] = av_reverse[buf[i]];
#endif
start = 48; /* hardcoded for now */
init_get_bits(&s->gb, buf + start, buf_size - start);
init_get_bits(&s->gb, buf + start, (buf_size - start) * 8);
if (s->decode_delta) { /* intraframe */
ir2_decode_plane(s, avctx->width, avctx->height,

3
libavcodec/libx264.c
View File

@ -127,7 +127,8 @@ static int X264_frame(AVCodecContext *ctx, uint8_t *buf,
}
x4->out_pic.key_frame = pic_out.b_keyframe;
x4->out_pic.quality = (pic_out.i_qpplus1 - 1) * FF_QP2LAMBDA;
if (bufsize)
x4->out_pic.quality = (pic_out.i_qpplus1 - 1) * FF_QP2LAMBDA;
return bufsize;
}

7
libavcodec/mjpegdec.c
View File

@ -839,9 +839,12 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, i
}
}
if (s->restart_interval && !--s->restart_count) {
if (s->restart_interval && show_bits(&s->gb, 8) == 0xFF){ /* skip RSTn */
--s->restart_count;
align_get_bits(&s->gb);
skip_bits(&s->gb, 16); /* skip RSTn */
while(show_bits(&s->gb, 8) == 0xFF)
skip_bits(&s->gb, 8);
skip_bits(&s->gb, 8);
for (i=0; i<nb_components; i++) /* reset dc */
s->last_dc[i] = 1024;
}

5
libavcodec/mpegvideo.c
View File

@ -282,9 +282,10 @@ int ff_alloc_picture(MpegEncContext *s, Picture *pic, int shared){
}
FF_ALLOCZ_OR_GOTO(s->avctx, pic->mbskip_table , mb_array_size * sizeof(uint8_t)+2, fail) //the +2 is for the slice end check
FF_ALLOCZ_OR_GOTO(s->avctx, pic->qscale_table , mb_array_size * sizeof(uint8_t) , fail)
FF_ALLOCZ_OR_GOTO(s->avctx, pic->qscale_table_base , (big_mb_num + s->mb_stride) * sizeof(uint8_t) , fail)
FF_ALLOCZ_OR_GOTO(s->avctx, pic->mb_type_base , (big_mb_num + s->mb_stride) * sizeof(uint32_t), fail)
pic->mb_type= pic->mb_type_base + 2*s->mb_stride+1;
pic->qscale_table = pic->qscale_table_base + 2*s->mb_stride + 1;
if(s->out_format == FMT_H264){
for(i=0; i<2; i++){
FF_ALLOCZ_OR_GOTO(s->avctx, pic->motion_val_base[i], 2 * (b4_array_size+4) * sizeof(int16_t), fail)
@ -335,7 +336,7 @@ static void free_picture(MpegEncContext *s, Picture *pic){
av_freep(&pic->mc_mb_var);
av_freep(&pic->mb_mean);
av_freep(&pic->mbskip_table);
av_freep(&pic->qscale_table);
av_freep(&pic->qscale_table_base);
av_freep(&pic->mb_type_base);
av_freep(&pic->dct_coeff);
av_freep(&pic->pan_scan);

1
libavcodec/mpegvideo.h
View File

@ -86,6 +86,7 @@ typedef struct Picture{
* halfpel luma planes.
*/
uint8_t *interpolated[3];
int8_t *qscale_table_base;
int16_t (*motion_val_base[2])[2];
uint32_t *mb_type_base;
#define MB_TYPE_INTRA MB_TYPE_INTRA4x4 //default mb_type if there is just one type

37
libavcodec/qdm2.c
View File

@ -75,6 +75,7 @@ do { \
#define SAMPLES_NEEDED_2(why) \
av_log (NULL,AV_LOG_INFO,"This file triggers some missing code. Please contact the developers.\nPosition: %s\n",why);
#define QDM2_MAX_FRAME_SIZE 512
typedef int8_t sb_int8_array[2][30][64];
@ -167,7 +168,7 @@ typedef struct {
/// I/O data
const uint8_t *compressed_data;
int compressed_size;
float output_buffer[1024];
float output_buffer[QDM2_MAX_FRAME_SIZE * 2];
/// Synthesis filter
DECLARE_ALIGNED(16, MPA_INT, synth_buf)[MPA_MAX_CHANNELS][512*2];
@ -1355,6 +1356,8 @@ static void qdm2_fft_decode_tones (QDM2Context *q, int duration, GetBitContext *
return;
local_int_14 = (offset >> local_int_8);
if (local_int_14 >= FF_ARRAY_ELEMS(fft_level_index_table))
return;
if (q->nb_channels > 1) {
channel = get_bits1(gb);
@ -1799,6 +1802,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
avctx->channels = s->nb_channels = s->channels = AV_RB32(extradata);
extradata += 4;
if (s->channels > MPA_MAX_CHANNELS)
return AVERROR_INVALIDDATA;
avctx->sample_rate = AV_RB32(extradata);
extradata += 4;
@ -1820,6 +1825,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
// something like max decodable tones
s->group_order = av_log2(s->group_size) + 1;
s->frame_size = s->group_size / 16; // 16 iterations per super block
if (s->frame_size > QDM2_MAX_FRAME_SIZE)
return AVERROR_INVALIDDATA;
s->sub_sampling = s->fft_order - 7;
s->frequency_range = 255 / (1 << (2 - s->sub_sampling));
@ -1883,7 +1890,7 @@ static av_cold int qdm2_decode_close(AVCodecContext *avctx)
}
static void qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
{
int ch, i;
const int frame_size = (q->frame_size * q->channels);
@ -1919,7 +1926,7 @@ static void qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
if (!q->has_errors && q->sub_packet_list_C[0].packet != NULL) {
SAMPLES_NEEDED_2("has errors, and C list is not empty")
return;
return -1;
}
}
@ -1940,6 +1947,8 @@ static void qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
out[i] = value;
}
return 0;
}
@ -1950,25 +1959,33 @@ static int qdm2_decode_frame(AVCodecContext *avctx,
const uint8_t *buf = avpkt->data;
int buf_size = avpkt->size;
QDM2Context *s = avctx->priv_data;
int16_t *out = data;
int i, out_size;
if(!buf)
return 0;
if(buf_size < s->checksum_size)
return -1;
*data_size = s->channels * s->frame_size * sizeof(int16_t);
out_size = 16 * s->channels * s->frame_size *
av_get_bits_per_sample_format(avctx->sample_fmt)/8;
if (*data_size < out_size) {
av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
return AVERROR(EINVAL);
}
av_log(avctx, AV_LOG_DEBUG, "decode(%d): %p[%d] -> %p[%d]\n",
buf_size, buf, s->checksum_size, data, *data_size);
qdm2_decode(s, buf, data);
// reading only when next superblock found
if (s->sub_packet == 0) {
return s->checksum_size;
for (i = 0; i < 16; i++) {
if (qdm2_decode(s, buf, out) < 0)
return -1;
out += s->channels * s->frame_size;
}
return 0;
*data_size = out_size;
return buf_size;
}
AVCodec qdm2_decoder =

6
libavcodec/rv10.c
View File

@ -454,6 +454,7 @@ static av_cold int rv10_decode_init(AVCodecContext *avctx)
s->avctx= avctx;
s->out_format = FMT_H263;
s->codec_id= avctx->codec_id;
avctx->flags |= CODEC_FLAG_EMU_EDGE;
s->orig_width = s->width = avctx->coded_width;
s->orig_height= s->height = avctx->coded_height;
@ -558,6 +559,11 @@ static int rv10_decode_packet(AVCodecContext *avctx,
if(MPV_frame_start(s, avctx) < 0)
return -1;
ff_er_frame_start(s);
} else {
if (s->current_picture_ptr->pict_type != s->pict_type) {
av_log(s->avctx, AV_LOG_ERROR, "Slice type mismatch\n");
return -1;
}
}
dprintf(avctx, "qscale=%d\n", s->qscale);

1
libavcodec/rv30.c
View File

@ -256,6 +256,7 @@ static av_cold int rv30_decode_init(AVCodecContext *avctx)
if(avctx->extradata_size - 8 < (r->rpr - 1) * 2){
av_log(avctx, AV_LOG_ERROR, "Insufficient extradata - need at least %d bytes, got %d\n",
6 + r->rpr * 2, avctx->extradata_size);
return AVERROR(EINVAL);
}
r->parse_slice_header = rv30_parse_slice_header;
r->decode_intra_types = rv30_decode_intra_types;

16
libavcodec/rv34.c
View File

@ -1439,12 +1439,14 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
slice_count = (*buf++) + 1;
slices_hdr = buf + 4;
buf += 8 * slice_count;
buf_size -= 1 + 8 * slice_count;
}else
slice_count = avctx->slice_count;
//parse first slice header to check whether this frame can be decoded
if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){
av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
if(get_slice_offset(avctx, slices_hdr, 0) < 0 ||
get_slice_offset(avctx, slices_hdr, 0) > buf_size){
av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
return -1;
}
init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), buf_size-get_slice_offset(avctx, slices_hdr, 0));
@ -1459,7 +1461,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
if( (avctx->skip_frame >= AVDISCARD_NONREF && si.type==FF_B_TYPE)
|| (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=FF_I_TYPE)
|| avctx->skip_frame >= AVDISCARD_ALL)
return buf_size;
return avpkt->size;
/* skip everything if we are in a hurry>=5 */
if(avctx->hurry_up>=5)
return buf_size;
@ -1472,8 +1474,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
else
size= get_slice_offset(avctx, slices_hdr, i+1) - offset;
if(offset > buf_size){
av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
if(offset < 0 || offset > buf_size || size < 0){
av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
break;
}
@ -1494,7 +1496,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
break;
}
if(last){
if(last && s->current_picture_ptr){
if(r->loop_filter)
r->loop_filter(r, s->mb_height - 1);
ff_er_frame_end(s);
@ -1511,7 +1513,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
}
s->current_picture_ptr= NULL; //so we can detect if frame_end wasnt called (find some nicer solution...)
}
return buf_size;
return avpkt->size;
}
av_cold int ff_rv34_decode_end(AVCodecContext *avctx)

30
libavcodec/smacker.c
View File

@ -133,11 +133,13 @@ static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx
return -1;
}
b1 = get_bits_count(gb);
i1 = get_vlc2(gb, ctx->v1->table, SMKTREE_BITS, 3);
i1 = ctx->v1->table ? get_vlc2(gb, ctx->v1->table, SMKTREE_BITS, 3) : 0;
b1 = get_bits_count(gb) - b1;
b2 = get_bits_count(gb);
i2 = get_vlc2(gb, ctx->v2->table, SMKTREE_BITS, 3);
i2 = ctx->v2->table ? get_vlc2(gb, ctx->v2->table, SMKTREE_BITS, 3) : 0;
b2 = get_bits_count(gb) - b2;
if (i1 < 0 || i2 < 0)
return -1;
val = ctx->recode1[i1] | (ctx->recode2[i2] << 8);
if(val == ctx->escapes[0]) {
ctx->last[0] = hc->current;
@ -289,7 +291,8 @@ static int decode_header_trees(SmackVContext *smk) {
smk->mmap_tbl[0] = 0;
smk->mmap_last[0] = smk->mmap_last[1] = smk->mmap_last[2] = 1;
} else {
smacker_decode_header_tree(smk, &gb, &smk->mmap_tbl, smk->mmap_last, mmap_size);
if (smacker_decode_header_tree(smk, &gb, &smk->mmap_tbl, smk->mmap_last, mmap_size))
return -1;
}
if(!get_bits1(&gb)) {
av_log(smk->avctx, AV_LOG_INFO, "Skipping MCLR tree\n");
@ -297,7 +300,8 @@ static int decode_header_trees(SmackVContext *smk) {
smk->mclr_tbl[0] = 0;
smk->mclr_last[0] = smk->mclr_last[1] = smk->mclr_last[2] = 1;
} else {
smacker_decode_header_tree(smk, &gb, &smk->mclr_tbl, smk->mclr_last, mclr_size);
if (smacker_decode_header_tree(smk, &gb, &smk->mclr_tbl, smk->mclr_last, mclr_size))
return -1;
}
if(!get_bits1(&gb)) {
av_log(smk->avctx, AV_LOG_INFO, "Skipping FULL tree\n");
@ -305,7 +309,8 @@ static int decode_header_trees(SmackVContext *smk) {
smk->full_tbl[0] = 0;
smk->full_last[0] = smk->full_last[1] = smk->full_last[2] = 1;
} else {
smacker_decode_header_tree(smk, &gb, &smk->full_tbl, smk->full_last, full_size);
if (smacker_decode_header_tree(smk, &gb, &smk->full_tbl, smk->full_last, full_size))
return -1;
}
if(!get_bits1(&gb)) {
av_log(smk->avctx, AV_LOG_INFO, "Skipping TYPE tree\n");
@ -313,7 +318,8 @@ static int decode_header_trees(SmackVContext *smk) {
smk->type_tbl[0] = 0;
smk->type_last[0] = smk->type_last[1] = smk->type_last[2] = 1;
} else {
smacker_decode_header_tree(smk, &gb, &smk->type_tbl, smk->type_last, type_size);
if (smacker_decode_header_tree(smk, &gb, &smk->type_tbl, smk->type_last, type_size))
return -1;
}
return 0;
@ -523,8 +529,8 @@ static av_cold int decode_init(AVCodecContext *avctx)
return -1;
}
decode_header_trees(c);
if (decode_header_trees(c))
return -1;
return 0;
}
@ -619,9 +625,9 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
if(bits) { //decode 16-bit data
for(i = stereo; i >= 0; i--)
pred[i] = bswap_16(get_bits(&gb, 16));
for(i = 0; i < stereo; i++)
for(i = 0; i <= stereo; i++)
*samples++ = pred[i];
for(i = 0; i < unp_size / 2; i++) {
for(; i < unp_size / 2; i++) {
if(i & stereo) {
if(vlc[2].table)
res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3);
@ -653,9 +659,9 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
} else { //8-bit data
for(i = stereo; i >= 0; i--)
pred[i] = get_bits(&gb, 8);
for(i = 0; i < stereo; i++)
for(i = 0; i <= stereo; i++)
*samples8++ = pred[i];
for(i = 0; i < unp_size; i++) {
for(; i < unp_size; i++) {
if(i & stereo){
if(vlc[1].table)
res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);

1
libavcodec/svq1dec.c
View File

@ -678,6 +678,7 @@ static int svq1_decode_frame(AVCodecContext *avctx,
#endif
return result;
}
avcodec_set_dimensions(avctx, s->width, s->height);
//FIXME this avoids some confusion for "B frames" without 2 references
//this should be removed after libavcodec can handle more flexible picture types & ordering

4
libavcodec/vc1.c
View File

@ -467,8 +467,8 @@ static int decode_sequence_header_adv(VC1Context *v, GetBitContext *gb)
if(ar && ar < 14){
v->s.avctx->sample_aspect_ratio = ff_vc1_pixel_aspect[ar];
}else if(ar == 15){
w = get_bits(gb, 8);
h = get_bits(gb, 8);
w = get_bits(gb, 8) + 1;
h = get_bits(gb, 8) + 1;
v->s.avctx->sample_aspect_ratio = (AVRational){w, h};
}
av_log(v->s.avctx, AV_LOG_DEBUG, "Aspect: %i:%i\n", v->s.avctx->sample_aspect_ratio.num, v->s.avctx->sample_aspect_ratio.den);

104
libavcodec/vmdav.c
View File

@ -72,9 +72,11 @@ typedef struct VmdVideoContext {
#define QUEUE_SIZE 0x1000
#define QUEUE_MASK 0x0FFF
static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_len)
static void lz_unpack(const unsigned char *src, int src_len,
unsigned char *dest, int dest_len)
{
const unsigned char *s;
unsigned int s_len;
unsigned char *d;
unsigned char *d_end;
unsigned char queue[QUEUE_SIZE];
@ -87,13 +89,16 @@ static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_le
unsigned int i, j;
s = src;
s_len = src_len;
d = dest;
d_end = d + dest_len;
dataleft = AV_RL32(s);
s += 4;
s += 4; s_len -= 4;
memset(queue, 0x20, QUEUE_SIZE);
if (s_len < 4)
return;
if (AV_RL32(s) == 0x56781234) {
s += 4;
s += 4; s_len -= 4;
qpos = 0x111;
speclen = 0xF + 3;
} else {
@ -101,32 +106,41 @@ static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_le
speclen = 100; /* no speclen */
}
while (dataleft > 0) {
tag = *s++;
while (dataleft > 0 && s_len > 0) {
tag = *s++; s_len--;
if ((tag == 0xFF) && (dataleft > 8)) {
if (d + 8 > d_end)
if (d + 8 > d_end || s_len < 8)
return;
for (i = 0; i < 8; i++) {
queue[qpos++] = *d++ = *s++;
qpos &= QUEUE_MASK;
}
s_len -= 8;
dataleft -= 8;
} else {
for (i = 0; i < 8; i++) {
if (dataleft == 0)
break;
if (tag & 0x01) {
if (d + 1 > d_end)
if (d + 1 > d_end || s_len < 1)
return;
queue[qpos++] = *d++ = *s++;
qpos &= QUEUE_MASK;
dataleft--;
s_len--;
} else {
if (s_len < 2)
return;
chainofs = *s++;
chainofs |= ((*s & 0xF0) << 4);
chainlen = (*s++ & 0x0F) + 3;
if (chainlen == speclen)
s_len -= 2;
if (chainlen == speclen) {
if (s_len < 1)
return;
chainlen = *s++ + 0xF + 3;
s_len--;
}
if (d + chainlen > d_end)
return;
for (j = 0; j < chainlen; j++) {
@ -143,7 +157,7 @@ static void lz_unpack(const unsigned char *src, unsigned char *dest, int dest_le
}
static int rle_unpack(const unsigned char *src, unsigned char *dest,
int src_len, int dest_len)
int src_count, int src_size, int dest_len)
{
const unsigned char *ps;
unsigned char *pd;
@ -152,31 +166,40 @@ static int rle_unpack(const unsigned char *src, unsigned char *dest,
ps = src;
pd = dest;
if (src_len & 1)
if (src_count & 1) {
if (src_size < 1)
return 0;
*pd++ = *ps++;
src_size--;
}
src_len >>= 1;
src_count >>= 1;
i = 0;
do {
if (src_size < 1)
break;
l = *ps++;
src_size--;
if (l & 0x80) {
l = (l & 0x7F) * 2;
if (pd + l > dest_end)
if (pd + l > dest_end || src_size < l)
return ps - src;
memcpy(pd, ps, l);
ps += l;
src_size -= l;
pd += l;
} else {
if (pd + i > dest_end)
if (pd + i > dest_end || src_size < 2)
return ps - src;
for (i = 0; i < l; i++) {
*pd++ = ps[0];
*pd++ = ps[1];
}
ps += 2;
src_size -= 2;
}
i += l;
} while (i < src_len);
} while (i < src_count);
return ps - src;
}
@ -191,6 +214,7 @@ static void vmd_decode(VmdVideoContext *s)
const unsigned char *p = s->buf + 16;
const unsigned char *pb;
unsigned int pb_size;
unsigned char meth;
unsigned char *dp; /* pointer to current frame */
unsigned char *pp; /* pointer to previous frame */
@ -205,6 +229,16 @@ static void vmd_decode(VmdVideoContext *s)
frame_y = AV_RL16(&s->buf[8]);
frame_width = AV_RL16(&s->buf[10]) - frame_x + 1;
frame_height = AV_RL16(&s->buf[12]) - frame_y + 1;
if (frame_x < 0 || frame_width < 0 ||
frame_x >= s->avctx->width ||
frame_width > s->avctx->width ||
frame_x + frame_width > s->avctx->width)
return;
if (frame_y < 0 || frame_height < 0 ||
frame_y >= s->avctx->height ||
frame_height > s->avctx->height ||
frame_y + frame_height > s->avctx->height)
return;
if ((frame_width == s->avctx->width && frame_height == s->avctx->height) &&
(frame_x || frame_y)) {
@ -217,8 +251,9 @@ static void vmd_decode(VmdVideoContext *s)
/* if only a certain region will be updated, copy the entire previous
* frame before the decode */
if (frame_x || frame_y || (frame_width != s->avctx->width) ||
(frame_height != s->avctx->height)) {
if (s->prev_frame.data[0] &&
(frame_x || frame_y || (frame_width != s->avctx->width) ||
(frame_height != s->avctx->height))) {
memcpy(s->frame.data[0], s->prev_frame.data[0],
s->avctx->height * s->frame.linesize[0]);
@ -236,14 +271,19 @@ static void vmd_decode(VmdVideoContext *s)
}
s->size -= (256 * 3 + 2);
}
if (s->size >= 0) {
if (s->size > 0) {
/* originally UnpackFrame in VAG's code */
pb = p;
meth = *pb++;
pb_size = s->buf + s->size - pb;
if (pb_size < 1)
return;
meth = *pb++; pb_size--;
if (meth & 0x80) {
lz_unpack(pb, s->unpack_buffer, s->unpack_buffer_size);
lz_unpack(pb, pb_size,
s->unpack_buffer, s->unpack_buffer_size);
meth &= 0x7F;
pb = s->unpack_buffer;
pb_size = s->unpack_buffer_size;
}
dp = &s->frame.data[0][frame_y * s->frame.linesize[0] + frame_x];
@ -254,17 +294,21 @@ static void vmd_decode(VmdVideoContext *s)
for (i = 0; i < frame_height; i++) {
ofs = 0;
do {
if (pb_size < 1)
return;
len = *pb++;
pb_size--;
if (len & 0x80) {
len = (len & 0x7F) + 1;
if (ofs + len > frame_width)
if (ofs + len > frame_width || pb_size < len)
return;
memcpy(&dp[ofs], pb, len);
pb += len;
pb_size -= len;
ofs += len;
} else {
/* interframe pixel copy */
if (ofs + len + 1 > frame_width)
if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
return;
memcpy(&dp[ofs], &pp[ofs], len + 1);
ofs += len + 1;
@ -282,8 +326,11 @@ static void vmd_decode(VmdVideoContext *s)
case 2:
for (i = 0; i < frame_height; i++) {
if (pb_size < frame_width)
return;
memcpy(dp, pb, frame_width);
pb += frame_width;
pb_size -= frame_width;
dp += s->frame.linesize[0];
pp += s->prev_frame.linesize[0];
}
@ -293,18 +340,27 @@ static void vmd_decode(VmdVideoContext *s)
for (i = 0; i < frame_height; i++) {
ofs = 0;
do {
if (pb_size < 1)
return;
len = *pb++;
pb_size--;
if (len & 0x80) {
len = (len & 0x7F) + 1;
if (pb_size < 1)
return;
if (*pb++ == 0xFF)
len = rle_unpack(pb, &dp[ofs], len, frame_width - ofs);
else
len = rle_unpack(pb, &dp[ofs], len, pb_size, frame_width - ofs);
else {
if (pb_size < len)
return;
memcpy(&dp[ofs], pb, len);
}
pb += len;
pb_size -= 1 + len;
ofs += len;
} else {
/* interframe pixel copy */
if (ofs + len + 1 > frame_width)
if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])
return;
memcpy(&dp[ofs], &pp[ofs], len + 1);
ofs += len + 1;

14
libavcodec/vp3.c
View File

@ -1285,6 +1285,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
case 1: // zero run
s->dct_tokens[plane][i]++;
i += (token >> 2) & 0x7f;
if (i > 63) {
av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
return i;
}
block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
i++;
break;
@ -1458,7 +1462,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)
/* invert DCT and place (or add) in final output */
if (s->all_fragments[i].coding_method == MODE_INTRA) {
vp3_dequant(s, s->all_fragments + i, plane, 0, block);
int index;
index = vp3_dequant(s, s->all_fragments + i, plane, 0, block);
if (index > 63)
continue;
if(s->avctx->idct_algo!=FF_IDCT_VP3)
block[0] += 128<<3;
s->dsp.idct_put(
@ -1466,7 +1473,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)
stride,
block);
} else {
if (vp3_dequant(s, s->all_fragments + i, plane, 1, block)) {
int index = vp3_dequant(s, s->all_fragments + i, plane, 1, block);
if (index > 63)
continue;
if (index > 0) {
s->dsp.idct_add(
output_plane + first_pixel,
stride,

3
libavcodec/vp5.c
View File

@ -116,7 +116,7 @@ static void vp5_parse_vector_models(VP56Context *s)
model->vector_pdv[comp][node] = vp56_rac_gets_nn(c, 7);
}
static void vp5_parse_coeff_models(VP56Context *s)
static int vp5_parse_coeff_models(VP56Context *s)
{
VP56RangeCoder *c = &s->c;
VP56Model *model = s->modelp;
@ -160,6 +160,7 @@ static void vp5_parse_coeff_models(VP56Context *s)
for (ctx=0; ctx<6; ctx++)
for (node=0; node<5; node++)
model->coeff_acct[pt][ct][cg][ctx][node] = av_clip(((model->coeff_ract[pt][ct][cg][node] * vp5_ract_lc[ct][cg][node][ctx][0] + 128) >> 8) + vp5_ract_lc[ct][cg][node][ctx][1], 1, 254);
return 0;
}
static void vp5_parse_coeff(VP56Context *s)

4
libavcodec/vp56.c
View File

@ -537,7 +537,8 @@ int vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
s->mb_type = VP56_MB_INTER_NOVEC_PF;
}
s->parse_coeff_models(s);
if (s->parse_coeff_models(s))
goto next;
memset(s->prev_dc, 0, sizeof(s->prev_dc));
s->prev_dc[1][VP56_FRAME_CURRENT] = 128;
@ -601,6 +602,7 @@ int vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
}
}
next:
if (p->key_frame || golden_frame) {
if (s->framep[VP56_FRAME_GOLDEN]->data[0] &&
s->framep[VP56_FRAME_GOLDEN] != s->framep[VP56_FRAME_GOLDEN2])

2
libavcodec/vp56.h
View File

@ -41,7 +41,7 @@ typedef void (*VP56Filter)(VP56Context *s, uint8_t *dst, uint8_t *src,
typedef void (*VP56ParseCoeff)(VP56Context *s);
typedef void (*VP56DefaultModelsInit)(VP56Context *s);
typedef void (*VP56ParseVectorModels)(VP56Context *s);
typedef void (*VP56ParseCoeffModels)(VP56Context *s);
typedef int (*VP56ParseCoeffModels)(VP56Context *s);
typedef int (*VP56ParseHeader)(VP56Context *s, const uint8_t *buf,
int buf_size, int *golden_frame);

48
libavcodec/vp6.c
View File

@ -136,8 +136,11 @@ static int vp6_parse_header(VP56Context *s, const uint8_t *buf, int buf_size,
if (coeff_offset) {
buf += coeff_offset;
buf_size -= coeff_offset;
if (buf_size < 0)
if (buf_size < 0) {
if (s->framep[VP56_FRAME_CURRENT]->key_frame)
avcodec_set_dimensions(s->avctx, 0, 0);
return 0;
}
if (s->use_huffman) {
s->parse_coeff = vp6_parse_coeff_huffman;
init_get_bits(&s->gb, buf, buf_size<<3);
@ -212,8 +215,8 @@ static int vp6_huff_cmp(const void *va, const void *vb)
return (a->count - b->count)*16 + (b->sym - a->sym);
}
static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
const uint8_t *map, unsigned size, VLC *vlc)
static int vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
const uint8_t *map, unsigned size, VLC *vlc)
{
Node nodes[2*size], *tmp = &nodes[size];
int a, b, i;
@ -228,12 +231,12 @@ static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
}
free_vlc(vlc);
/* then build the huffman tree accodring to probabilities */
ff_huff_build_tree(s->avctx, vlc, size, nodes, vp6_huff_cmp,
FF_HUFFMAN_FLAG_HNODE_FIRST);
/* then build the huffman tree according to probabilities */
return ff_huff_build_tree(s->avctx, vlc, size, nodes, vp6_huff_cmp,
FF_HUFFMAN_FLAG_HNODE_FIRST);
}
static void vp6_parse_coeff_models(VP56Context *s)
static int vp6_parse_coeff_models(VP56Context *s)
{
VP56RangeCoder *c = &s->c;
VP56Model *model = s->modelp;
@ -278,15 +281,18 @@ static void vp6_parse_coeff_models(VP56Context *s)
if (s->use_huffman) {
for (pt=0; pt<2; pt++) {
vp6_build_huff_tree(s, model->coeff_dccv[pt],
vp6_huff_coeff_map, 12, &s->dccv_vlc[pt]);
vp6_build_huff_tree(s, model->coeff_runv[pt],
vp6_huff_run_map, 9, &s->runv_vlc[pt]);
if (vp6_build_huff_tree(s, model->coeff_dccv[pt],
vp6_huff_coeff_map, 12, &s->dccv_vlc[pt]))
return -1;
if (vp6_build_huff_tree(s, model->coeff_runv[pt],
vp6_huff_run_map, 9, &s->runv_vlc[pt]))
return -1;
for (ct=0; ct<3; ct++)
for (cg = 0; cg < 6; cg++)
vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
vp6_huff_coeff_map, 12,
&s->ract_vlc[pt][ct][cg]);
if (vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
vp6_huff_coeff_map, 12,
&s->ract_vlc[pt][ct][cg]))
return -1;
}
memset(s->nb_null, 0, sizeof(s->nb_null));
} else {
@ -296,6 +302,7 @@ static void vp6_parse_coeff_models(VP56Context *s)
for (node=0; node<5; node++)
model->coeff_dcct[pt][ctx][node] = av_clip(((model->coeff_dccv[pt][node] * vp6_dccv_lc[ctx][node][0] + 128) >> 8) + vp6_dccv_lc[ctx][node][1], 1, 255);
}
return 0;
}
static void vp6_parse_vector_adjustment(VP56Context *s, VP56mv *vect)
@ -366,7 +373,7 @@ static void vp6_parse_coeff_huffman(VP56Context *s)
if (b > 3) pt = 1;
vlc_coeff = &s->dccv_vlc[pt];
for (coeff_idx=0; coeff_idx<64; ) {
for (coeff_idx = 0;;) {
int run = 1;
if (coeff_idx<2 && s->nb_null[coeff_idx][pt]) {
s->nb_null[coeff_idx][pt]--;
@ -403,6 +410,8 @@ static void vp6_parse_coeff_huffman(VP56Context *s)
}
}
coeff_idx+=run;
if (coeff_idx >= 64)
break;
cg = FFMIN(vp6_coeff_groups[coeff_idx], 3);
vlc_coeff = &s->ract_vlc[pt][ct][cg];
}
@ -430,7 +439,8 @@ static void vp6_parse_coeff(VP56Context *s)
model1 = model->coeff_dccv[pt];
model2 = model->coeff_dcct[pt][ctx];
for (coeff_idx=0; coeff_idx<64; ) {
coeff_idx = 0;
for (;;) {
if ((coeff_idx>1 && ct==0) || vp56_rac_get_prob(c, model2[0])) {
/* parse a coeff */
if (vp56_rac_get_prob(c, model2[2])) {
@ -471,8 +481,10 @@ static void vp6_parse_coeff(VP56Context *s)
run += vp56_rac_get_prob(c, model3[i+8]) << i;
}
}
cg = vp6_coeff_groups[coeff_idx+=run];
coeff_idx += run;
if (coeff_idx >= 64)
break;
cg = vp6_coeff_groups[coeff_idx];
model1 = model2 = model->coeff_ract[pt][ct][cg];
}

68
libavcodec/wavpack.c
View File

@ -275,7 +275,14 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
}
}else{
t = get_unary_0_33(gb);
if(t >= 2) t = get_bits(gb, t - 1) | (1 << (t-1));
if(t >= 2){
if(get_bits_left(gb) < t-1)
goto error;
t = get_bits(gb, t - 1) | (1 << (t-1));
}else{
if(get_bits_left(gb) < 0)
goto error;
}
ctx->zeroes = t;
if(ctx->zeroes){
memset(ctx->ch[0].median, 0, sizeof(ctx->ch[0].median));
@ -286,24 +293,24 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
}
}
if(get_bits_count(gb) >= ctx->data_size){
*last = 1;
return 0;
}
if(ctx->zero){
t = 0;
ctx->zero = 0;
}else{
t = get_unary_0_33(gb);
if(get_bits_count(gb) >= ctx->data_size){
*last = 1;
return 0;
}
if(get_bits_left(gb) < 0)
goto error;
if(t == 16) {
t2 = get_unary_0_33(gb);
if(t2 < 2) t += t2;
else t += get_bits(gb, t2 - 1) | (1 << (t2 - 1));
if(t2 < 2){
if(get_bits_left(gb) < 0)
goto error;
t += t2;
}else{
if(get_bits_left(gb) < t2 - 1)
goto error;
t += get_bits(gb, t2 - 1) | (1 << (t2 - 1));
}
}
if(ctx->one){
@ -343,9 +350,13 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
}
if(!c->error_limit){
ret = base + get_tail(gb, add);
if (get_bits_left(gb) <= 0)
goto error;
}else{
int mid = (base*2 + add + 1) >> 1;
while(add > c->error_limit){
if(get_bits_left(gb) <= 0)
goto error;
if(get_bits1(gb)){
add -= (mid - base);
base = mid;
@ -359,6 +370,10 @@ static int wv_get_value(WavpackContext *ctx, GetBitContext *gb, int channel, int
if(ctx->hybrid_bitrate)
c->slow_level += wp_log2(ret) - LEVEL_DECAY(c->slow_level);
return sign ? ~ret : ret;
error:
*last = 1;
return 0;
}
static inline int wv_get_value_integer(WavpackContext *s, uint32_t *crc, int S)
@ -368,7 +383,7 @@ static inline int wv_get_value_integer(WavpackContext *s, uint32_t *crc, int S)
if(s->extra_bits){
S <<= s->extra_bits;
if(s->got_extra_bits){
if(s->got_extra_bits && get_bits_left(&s->gb_extra_bits) >= s->extra_bits){
S |= get_bits(&s->gb_extra_bits, s->extra_bits);
*crc = *crc * 9 + (S&0xffff) * 3 + ((unsigned)S>>16);
}
@ -559,7 +574,10 @@ static inline int wv_unpack_stereo(WavpackContext *s, GetBitContext *gb, void *d
count++;
}while(!last && count < s->max_samples);
s->samples_left -= count;
if (last)
s->samples_left = 0;
else
s->samples_left -= count;
if(!s->samples_left){
if(crc != s->CRC){
av_log(s->avctx, AV_LOG_ERROR, "CRC error\n");
@ -632,7 +650,10 @@ static inline int wv_unpack_mono(WavpackContext *s, GetBitContext *gb, void *dst
count++;
}while(!last && count < s->samples);
s->samples_left -= count;
if (last)
s->samples_left = 0;
else
s->samples_left -= count;
if(!s->samples_left){
if(crc != s->CRC){
av_log(s->avctx, AV_LOG_ERROR, "CRC error\n");
@ -755,12 +776,13 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
}
switch(id & WP_IDF_MASK){
case WP_ID_DECTERMS:
s->terms = size;
if(s->terms > MAX_TERMS){
if(size > MAX_TERMS){
av_log(avctx, AV_LOG_ERROR, "Too many decorrelation terms\n");
s->terms = 0;
buf += ssize;
continue;
}
s->terms = size;
for(i = 0; i < s->terms; i++) {
s->decorr[s->terms - i - 1].value = (*buf & 0x1F) - 5;
s->decorr[s->terms - i - 1].delta = *buf >> 5;
@ -976,6 +998,9 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
else
samplecount = wv_unpack_stereo(s, &s->gb, samples, SAMPLE_FMT_FLT);
if (samplecount < 0)
return -1;
}else{
if(avctx->sample_fmt == SAMPLE_FMT_S16)
samplecount = wv_unpack_mono(s, &s->gb, samples, SAMPLE_FMT_S16);
@ -984,11 +1009,14 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
else
samplecount = wv_unpack_mono(s, &s->gb, samples, SAMPLE_FMT_FLT);
if (samplecount < 0)
return -1;
if(s->stereo && avctx->sample_fmt == SAMPLE_FMT_S16){
int16_t *dst = (int16_t*)samples + samplecount * 2;
int16_t *src = (int16_t*)samples + samplecount;
int cnt = samplecount;
while(cnt--){
while(cnt-- > 0){
*--dst = *--src;
*--dst = *src;
}
@ -997,7 +1025,7 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
int32_t *dst = (int32_t*)samples + samplecount * 2;
int32_t *src = (int32_t*)samples + samplecount;
int cnt = samplecount;
while(cnt--){
while(cnt-- > 0){
*--dst = *--src;
*--dst = *src;
}
@ -1006,7 +1034,7 @@ static int wavpack_decode_frame(AVCodecContext *avctx,
float *dst = (float*)samples + samplecount * 2;
float *src = (float*)samples + samplecount;
int cnt = samplecount;
while(cnt--){
while(cnt-- > 0){
*--dst = *--src;
*--dst = *src;
}

3
libavcodec/wma.c
View File

@ -135,6 +135,9 @@ int ff_wma_init(AVCodecContext *avctx, int flags2)
/* compute MDCT block size */
s->frame_len_bits = ff_wma_get_frame_len_bits(s->sample_rate, s->version, 0);
s->next_block_len_bits = s->frame_len_bits;
s->prev_block_len_bits = s->frame_len_bits;
s->block_len_bits = s->frame_len_bits;
s->frame_len = 1 << s->frame_len_bits;
if (s->use_variable_block_len) {

2
libavcodec/x86/cpuid.c
View File

@ -98,7 +98,7 @@ int mm_support(void)
if(max_ext_level >= 0x80000001){
cpuid(0x80000001, eax, ebx, ecx, ext_caps);
if (ext_caps & (1<<31))
if (ext_caps & (1U<<31))
rval |= FF_MM_3DNOW;
if (ext_caps & (1<<30))
rval |= FF_MM_3DNOWEXT;

10
libavcodec/xan.c
View File

@ -88,17 +88,18 @@ static av_cold int xan_decode_init(AVCodecContext *avctx)
return 0;
}
static int xan_huffman_decode(unsigned char *dest, const unsigned char *src,
int dest_len)
static int xan_huffman_decode(unsigned char *dest, int dest_len,
const unsigned char *src, int src_len)
{
unsigned char byte = *src++;
unsigned char ival = byte + 0x16;
const unsigned char * ptr = src + byte*2;
int ptr_len = src_len - 1 - byte*2;
unsigned char val = ival;
unsigned char *dest_end = dest + dest_len;
GetBitContext gb;
init_get_bits(&gb, ptr, 0); // FIXME: no src size available
init_get_bits(&gb, ptr, ptr_len * 8);
while ( val != 0x16 ) {
val = src[val - 0x17 + get_bits1(&gb) * byte];
@ -263,7 +264,8 @@ static void xan_wc3_decode_frame(XanContext *s) {
vector_segment = s->buf + AV_RL16(&s->buf[4]);
imagedata_segment = s->buf + AV_RL16(&s->buf[6]);
xan_huffman_decode(opcode_buffer, huffman_segment, opcode_buffer_size);
xan_huffman_decode(opcode_buffer, opcode_buffer_size,
huffman_segment, s->size - (huffman_segment - s->buf) );
if (imagedata_segment[0] == 2)
xan_unpack(s->buffer2, &imagedata_segment[1], s->buffer2_size);

2
libavdevice/alsa-audio-common.c
View File

@ -129,6 +129,8 @@ av_cold int ff_alsa_open(AVFormatContext *ctx, snd_pcm_stream_t mode,
}
snd_pcm_hw_params_get_period_size_min(hw_params, &period_size, NULL);
if (!period_size)
period_size = buffer_size / 4;
res = snd_pcm_hw_params_set_period_size_near(h, hw_params, &period_size, NULL);
if (res < 0) {
av_log(ctx, AV_LOG_ERROR, "cannot set ALSA period size (%s)\n",

2
libavformat/ape.c
View File

@ -263,6 +263,8 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)
if (ape->seektablelength > 0) {
ape->seektable = av_malloc(ape->seektablelength);
if (!ape->seektable)
return AVERROR(ENOMEM);
for (i = 0; i < ape->seektablelength / sizeof(uint32_t); i++)
ape->seektable[i] = get_le32(pb);
}

2
libavformat/flvenc.c
View File

@ -162,7 +162,7 @@ static int flv_write_header(AVFormatContext *s)
AVCodecContext *audio_enc = NULL, *video_enc = NULL;
int i;
double framerate = 0.0;
int metadata_size_pos, data_size;
int64_t metadata_size_pos, data_size;
for(i=0; i<s->nb_streams; i++){
AVCodecContext *enc = s->streams[i]->codec;

5
libavformat/mpegts.c
View File

@ -1140,7 +1140,7 @@ static int handle_packet(MpegTSContext *ts, const uint8_t *packet)
{
AVFormatContext *s = ts->stream;
MpegTSFilter *tss;
int len, pid, cc, cc_ok, afc, is_start;
int len, pid, cc, expected_cc, cc_ok, afc, is_start;
const uint8_t *p, *p_end;
int64_t pos;
@ -1158,7 +1158,8 @@ static int handle_packet(MpegTSContext *ts, const uint8_t *packet)
/* continuity check (currently not used) */
cc = (packet[3] & 0xf);
cc_ok = (tss->last_cc < 0) || ((((tss->last_cc + 1) & 0x0f) == cc));
expected_cc = (packet[3] & 0x10) ? (tss->last_cc + 1) & 0x0f : tss->last_cc;
cc_ok = (tss->last_cc < 0) || (expected_cc == cc);
tss->last_cc = cc;
/* skip adaptation field */

2
libavformat/mxfdec.c
View File

@ -592,7 +592,7 @@ static int mxf_read_generic_descriptor(MXFDescriptor *descriptor, ByteIOContext
default:
/* Private uid used by SONY C0023S01.mxf */
if (IS_KLV_KEY(uid, mxf_sony_mpeg4_extradata)) {
descriptor->extradata = av_malloc(size);
descriptor->extradata = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);
if (!descriptor->extradata)
return -1;
descriptor->extradata_size = size;

2
libavformat/mxfenc.c
View File

@ -1536,7 +1536,7 @@ static const uint8_t system_metadata_package_set_key[] = { 0x06,0x0E,0x2B,0x34,0
static uint32_t ff_framenum_to_12m_time_code(unsigned frame, int drop, int fps)
{
return (0 << 31) | // color frame flag
(0 << 30) | // drop frame flag
(drop << 30) | // drop frame flag
( ((frame % fps) / 10) << 28) | // tens of frames
( ((frame % fps) % 10) << 24) | // units of frames
(0 << 23) | // field phase (NTSC), b0 (PAL)

14
libavformat/oggdec.c
View File

@ -94,14 +94,24 @@ ogg_restore (AVFormatContext * s, int discard)
ogg->state = ost->next;
if (!discard){
struct ogg_stream *old_streams = ogg->streams;
for (i = 0; i < ogg->nstreams; i++)
av_free (ogg->streams[i].buf);
url_fseek (bc, ost->pos, SEEK_SET);
ogg->curidx = ost->curidx;
ogg->nstreams = ost->nstreams;
memcpy(ogg->streams, ost->streams,
ost->nstreams * sizeof(*ogg->streams));
ogg->streams = av_realloc (ogg->streams,
ogg->nstreams * sizeof (*ogg->streams));
if (ogg->streams) {
memcpy(ogg->streams, ost->streams,
ost->nstreams * sizeof(*ogg->streams));
} else {
av_free(old_streams);
ogg->nstreams = 0;
}
}
av_free (ost);

2
libavformat/riff.c
View File

@ -123,6 +123,8 @@ const AVCodecTag ff_codec_bmp_tags[] = {
{ CODEC_ID_MPEG2VIDEO, MKTAG('L', 'M', 'P', '2') }, /* Lead MPEG2 in avi */
{ CODEC_ID_MPEG2VIDEO, MKTAG('s', 'l', 'i', 'f') },
{ CODEC_ID_MPEG2VIDEO, MKTAG('E', 'M', '2', 'V') },
{ CODEC_ID_MPEG2VIDEO, MKTAG('M', '7', '0', '1') }, /* Matrox MPEG2 intra-only */
{ CODEC_ID_MPEG2VIDEO, MKTAG('m', 'p', 'g', 'v') },
{ CODEC_ID_MJPEG, MKTAG('M', 'J', 'P', 'G') },
{ CODEC_ID_MJPEG, MKTAG('L', 'J', 'P', 'G') },
{ CODEC_ID_MJPEG, MKTAG('d', 'm', 'b', '1') },

11
libavformat/smacker.c
View File

@ -289,10 +289,15 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
if(flags & 1) {
int size;
size = get_le32(s->pb) - 4;
uint8_t *tmpbuf;
frame_size -= size;
frame_size -= 4;
smk->curstream++;
smk->bufs[smk->curstream] = av_realloc(smk->bufs[smk->curstream], size);
tmpbuf = av_realloc(smk->bufs[smk->curstream], size);
if (!tmpbuf)
return AVERROR(ENOMEM);
smk->bufs[smk->curstream] = tmpbuf;
smk->buf_sizes[smk->curstream] = size;
ret = get_buffer(s->pb, smk->bufs[smk->curstream], size);
if(ret != size)
@ -301,7 +306,9 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt)
}
flags >>= 1;
}
if (av_new_packet(pkt, frame_size + 768))
if (frame_size < 0)
return AVERROR_INVALIDDATA;
if (av_new_packet(pkt, frame_size + 769))
return AVERROR(ENOMEM);
if(smk->frm_size[smk->cur_frame] & 1)
palchange |= 2;

6
libpostproc/postprocess.c
View File

@ -86,6 +86,7 @@ try to unroll inner for(x=0 ... loop to avoid these damn if(x ... checks
//#define DEBUG_BRIGHTNESS
#include "postprocess.h"
#include "postprocess_internal.h"
#include "libavutil/avstring.h"
unsigned postproc_version(void)
{
@ -766,7 +767,8 @@ pp_mode *pp_get_mode_by_name_and_quality(const char *name, int quality)
ppMode->maxClippedThreshold= 0.01;
ppMode->error=0;
strncpy(temp, name, GET_MODE_BUFFER_SIZE);
memset(temp, 0, GET_MODE_BUFFER_SIZE);
av_strlcpy(temp, name, GET_MODE_BUFFER_SIZE - 1);
av_log(NULL, AV_LOG_DEBUG, "pp: %s\n", name);
@ -822,7 +824,7 @@ pp_mode *pp_get_mode_by_name_and_quality(const char *name, int quality)
plen= strlen(p);
spaceLeft= p - temp + plen;
if(spaceLeft + newlen >= GET_MODE_BUFFER_SIZE){
if(spaceLeft + newlen >= GET_MODE_BUFFER_SIZE - 1){
ppMode->error++;
break;
}

1
libswscale/utils.c
View File

@ -42,6 +42,7 @@
#include "libavutil/x86_cpu.h"
#include "libavutil/avutil.h"
#include "libavutil/bswap.h"
#include "libavutil/mathematics.h"
#include "libavutil/pixdesc.h"
unsigned swscale_version(void)

160
tests/ref/fate/smacker
View File

@ -1,5 +1,5 @@
0, 0, 192000, 0x8926d7fc
1, 0, 47240, 0xad778a78
1, 0, 47240, 0x9974897c
0, 6390, 192000, 0x2506d384
0, 12780, 192000, 0x9a8dc93a
0, 19170, 192000, 0x4badb7f2
@ -15,163 +15,163 @@
0, 83070, 192000, 0x1a3d7971
0, 89460, 192000, 0xa1a65bd5
0, 95850, 192000, 0x344957b9
1, 96408, 3128, 0x4c1564ae
1, 96408, 3128, 0x7e4064b4
0, 102240, 192000, 0xe23b5f4e
1, 102792, 3128, 0x34553309
1, 102792, 3128, 0x80883301
0, 108630, 192000, 0xb5c2710b
1, 109176, 3136, 0xb474d246
1, 109176, 3136, 0x2ad2d341
0, 115020, 192000, 0x7a25938f
1, 115576, 3128, 0x87b868ea
1, 115576, 3128, 0xda8468e3
0, 121410, 192000, 0x0a84e4c9
1, 121959, 3136, 0xf1516dc3
1, 121959, 3136, 0x9d6f6cdf
0, 127800, 192000, 0x94209b0d
1, 128359, 3128, 0x867563cb
1, 128359, 3128, 0x1aaa64b5
0, 134190, 192000, 0xf940e51f
1, 134743, 3128, 0x5200728c
1, 134743, 3128, 0x9182728b
0, 140580, 192000, 0xb9fdec42
1, 141127, 3136, 0xeda118a0
1, 141127, 3136, 0xfa8e17b3
0, 146970, 192000, 0x7b04a376
1, 147527, 3128, 0x03e2c1d6
1, 147527, 3128, 0x0dc3c1cf
0, 153360, 192000, 0x5fe0026b
1, 153910, 3136, 0xc3e862b6
1, 153910, 3136, 0x0109639d
0, 159750, 192000, 0x775aca39
1, 160310, 3128, 0x937a13be
1, 160310, 3128, 0x6d8a12d9
0, 166140, 192000, 0xae14fb32
1, 166694, 3128, 0x7b1b9577
1, 166694, 3128, 0x4b9a9597
0, 172530, 192000, 0x661106e5
1, 173078, 3136, 0x042c7113
1, 173078, 3136, 0x9112710e
0, 178920, 192000, 0xe8658dbf
1, 179478, 3128, 0xac48f451
1, 179478, 3128, 0x8cccf522
0, 185310, 192000, 0x5359f0f9
1, 185861, 3128, 0x018fbbe9
1, 185861, 3128, 0x6594bbf3
0, 191700, 192000, 0xc1ec80f4
1, 192245, 3136, 0xc62aa7ce
1, 192245, 3136, 0xd878a7d5
0, 198090, 192000, 0xca53806b
1, 198645, 3128, 0x106e3924
1, 198645, 3128, 0xaa6e3905
0, 204480, 192000, 0xf0766b2e
1, 205029, 3136, 0xfeb82ecc
1, 205029, 3136, 0x2a062e04
0, 210870, 192000, 0x39962da8
1, 211429, 3128, 0x7e7c005b
1, 211429, 3128, 0x84e4006a
0, 217260, 192000, 0x4171c37f
1, 217812, 3128, 0x949d3560
1, 217812, 3128, 0x85183633
0, 223650, 192000, 0x3abf3b46
1, 224196, 3136, 0x02bd4aff
1, 224196, 3136, 0xb62d4b02
0, 230040, 192000, 0xecc68313
1, 230596, 3128, 0x4aaf4715
1, 230596, 3128, 0xe209462a
0, 236430, 192000, 0xea339baf
1, 236980, 3136, 0x2958825f
1, 236980, 3136, 0x57c4824b
0, 242820, 192000, 0x616b8f16
1, 243380, 3128, 0x99a5914d
1, 243380, 3128, 0x664a9163
0, 249210, 192000, 0xf77a8581
1, 249763, 3128, 0xe67277a4
1, 249763, 3128, 0xb4287874
0, 255600, 192000, 0xb315678b
1, 256147, 3136, 0x11296973
1, 256147, 3136, 0xde626885
0, 261990, 192000, 0x0a4a5218
1, 262547, 3128, 0x5cc362f7
1, 262547, 3128, 0x919763c2
0, 268380, 192000, 0x98802be4
1, 268931, 3128, 0x0c5e6586
1, 268931, 3128, 0xa4f664e1
0, 274770, 192000, 0xa2f0fd94
1, 275314, 3136, 0xe940b0f9
1, 275314, 3136, 0xa0bab0d4
0, 281160, 192000, 0x6671c84f
1, 281714, 3128, 0x2c9292cc
1, 281714, 3128, 0xe938939c
0, 287550, 192000, 0x38327e31
1, 288098, 3136, 0xa807c096
1, 288098, 3136, 0x3679bfc7
0, 293940, 192000, 0xb85d3e08
1, 294498, 3128, 0x9d2254d8
1, 294498, 3128, 0xc96c55c3
0, 300330, 192000, 0xdc69eba9
1, 300882, 3128, 0xe68015b0
1, 300882, 3128, 0x119114d6
0, 306720, 192000, 0x8955a0b3
1, 307265, 3136, 0x65d58029
1, 307265, 3136, 0x42f3800f
0, 313110, 192000, 0x714a548b
1, 313665, 3128, 0xcffcc48c
1, 313665, 3128, 0x4250c4ad
0, 319500, 192000, 0xc0471de9
1, 320049, 3136, 0x8c704944
1, 320049, 3136, 0x5cdd4925
0, 325890, 192000, 0x2e16e039
1, 326449, 3128, 0x1459231d
1, 326449, 3128, 0xa4c12360
0, 332280, 192000, 0x9fa4b033
1, 332833, 3128, 0x7dde4839
1, 332833, 3128, 0x849f48de
0, 338670, 192000, 0x4a0f9402
1, 339216, 3136, 0xbb6890e2
1, 339216, 3136, 0x6acd8ff9
0, 345060, 192000, 0x1f3e6843
1, 345616, 3128, 0xcd9a8524
1, 345616, 3128, 0xb2758556
0, 351450, 192000, 0x31774850
1, 352000, 3128, 0xa244fc31
1, 352000, 3128, 0x10f2fcb1
0, 357840, 192000, 0x9d5336a2
1, 358384, 3136, 0x504e2bd9
1, 358384, 3136, 0xf0f02b23
0, 364230, 192000, 0xf7de27a2
1, 364784, 3128, 0x655858d8
1, 364784, 3128, 0x64f759c6
0, 370620, 192000, 0x98c717ce
1, 371167, 3136, 0x46027610
1, 371167, 3136, 0x7ec075e3
0, 377010, 192000, 0x615b10b8
1, 377567, 3128, 0x4192d5e3
1, 377567, 3128, 0xf981d51e
0, 383400, 192000, 0xd5bc0e7e
1, 383951, 3128, 0x21d2e7fe
1, 383951, 3128, 0xc622e8b9
0, 389790, 192000, 0xd5bc0e7e
1, 390335, 3136, 0x7c93e329
1, 390335, 3136, 0xf632e2f8
0, 396180, 192000, 0xd5bc0e7e
1, 396735, 3128, 0xa67718c0
1, 396735, 3128, 0xda561864
0, 402570, 192000, 0xd5bc0e7e
1, 403118, 3136, 0x9bb6e8a3
1, 403118, 3136, 0x14d2e888
0, 408960, 192000, 0xd5bc0e7e
1, 409518, 3128, 0x0933b7a6
1, 409518, 3128, 0x015bb869
0, 415350, 192000, 0xd5bc0e7e
1, 415902, 3128, 0x07f1fb57
1, 415902, 3128, 0xedb1fb62
0, 421740, 192000, 0xd5bc0e7e
1, 422286, 3136, 0x8a050cfd
1, 422286, 3136, 0xe0560c41
0, 428130, 192000, 0xd5bc0e7e
1, 428686, 3128, 0xdb773c0b
1, 428686, 3128, 0x14773c9a
0, 434520, 192000, 0xd5bc0e7e
1, 435069, 3136, 0xd1281c53
1, 435069, 3136, 0x850f1c82
0, 440910, 192000, 0xd5bc0e7e
1, 441469, 3128, 0x9f395324
1, 441469, 3128, 0xb0bd5347
0, 447300, 192000, 0xd5bc0e7e
1, 447853, 3128, 0x5f13edec
1, 447853, 3128, 0x8f82edbf
0, 453690, 192000, 0xd5bc0e7e
1, 454237, 3136, 0x871cbecf
1, 454237, 3136, 0x493abee2
0, 460080, 192000, 0xd5bc0e7e
1, 460637, 3128, 0x799eff3e
1, 460637, 3128, 0xf5daff3f
0, 466470, 192000, 0xd5bc0e7e
1, 467020, 3128, 0x3f902762
1, 467020, 3128, 0x78ad2690
0, 472860, 192000, 0xd5bc0e7e
1, 473404, 3136, 0x29f8bb04
1, 473404, 3136, 0x490ebafc
0, 479250, 192000, 0xd5bc0e7e
1, 479804, 3128, 0xf3523ee9
1, 479804, 3128, 0x70333fd2
0, 485640, 192000, 0xd5bc0e7e
1, 486188, 3136, 0x4405c435
1, 486188, 3136, 0x8cb1c350
0, 492030, 192000, 0xd5bc0e7e
1, 492588, 3128, 0x892957cb
1, 492588, 3128, 0x8bd057cb
0, 498420, 192000, 0xd5bc0e7e
1, 498971, 3128, 0xdf483dbd
1, 498971, 3128, 0x161b3dbc
0, 504810, 192000, 0xd5bc0e7e
1, 505355, 3136, 0x5e8ab797
1, 505355, 3136, 0xb47fb88a
0, 511200, 192000, 0xd5bc0e7e
1, 511755, 3128, 0x92e13820
1, 511755, 3128, 0x474b381e
0, 517590, 192000, 0xd5bc0e7e
1, 518139, 3136, 0xfde719b6
1, 518139, 3136, 0x07c519bb
0, 523980, 192000, 0xd5bc0e7e
1, 524539, 3128, 0x442f17ae
1, 524539, 3128, 0x15b916c8
0, 530370, 192000, 0xd5bc0e7e
1, 530922, 3128, 0x011af61f
1, 530922, 3128, 0x0ed7f6fb
0, 536760, 192000, 0xd5bc0e7e
1, 537306, 3136, 0x4e3e3a6d
1, 537306, 3136, 0x54d6397b
0, 543150, 192000, 0xd5bc0e7e
1, 543706, 3128, 0xc11242b9
1, 543706, 3128, 0x437242bb
0, 549540, 192000, 0xd5bc0e7e
1, 550090, 3128, 0x01415b59
1, 550090, 3128, 0x38f05c4d
0, 555930, 192000, 0xd5bc0e7e
1, 556473, 3136, 0x302e0e55
1, 556473, 3136, 0x5d000e59
0, 562320, 192000, 0xd5bc0e7e
1, 562873, 3128, 0x20522d04
1, 562873, 3128, 0xdeab2d04
0, 568710, 192000, 0xd5bc0e7e
1, 569257, 3136, 0x316a697d
1, 569257, 3136, 0x77de6880
0, 575100, 192000, 0xd5bc0e7e
1, 575657, 3128, 0x6d75ee27
1, 575657, 3128, 0xbc87ef25
0, 581490, 192000, 0xd5bc0e7e
1, 582041, 3128, 0xcb008ae8
1, 582041, 3128, 0xc1638ade
0, 587880, 192000, 0xd5bc0e7e
1, 588424, 3136, 0xd2664b51
1, 588424, 3136, 0xcfb64a5f
0, 594270, 192000, 0xd5bc0e7e
1, 594824, 3128, 0xdfcab728
1, 594824, 3128, 0x90b1b826
0, 600660, 192000, 0xd5bc0e7e
1, 601208, 3136, 0x00000000
0, 607050, 192000, 0xd5bc0e7e