generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge commit '8f558c3e101859aec9adcb4b4b270ae1ef8f88b5' into release/1.1

Browse Source 
* commit '8f558c3e101859aec9adcb4b4b270ae1ef8f88b5':
  af_channelmap: sanity check input channel indices in all cases.
  id3v2: pad the APIC packets as required by lavc.
  lavf: make sure stream probe data gets freed.
  dfa: check for invalid access in decode_wdlt().

Conflicts:
	libavformat/id3v2.c
	libavformat/utils.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2013-05-12 13:35:30 +02:00
parent 63235b8d41 8f558c3e10
commit a367ab657f
4 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/dfa.c
View File

@@ -263,6 +263,8 @@ static int decode_wdlt(GetByteContext *gb, uint8_t *frame, int width, int height
segments = bytestream2_get_le16(gb);
}
line_ptr = frame;
if (frame_end - frame < width)
return AVERROR_INVALIDDATA;
frame += width;
y++;
while (segments--) {

21
libavfilter/af_channelmap.c
View File

@@ -361,23 +361,32 @@ static int channelmap_config_input(AVFilterLink *inlink)
{
AVFilterContext *ctx = inlink->dst;
ChannelMapContext *s = ctx->priv;
int nb_channels = av_get_channel_layout_nb_channels(inlink->channel_layout);
int i, err = 0;
const char *channel_name;
char layout_name[256];
if (s->mode == MAP_PAIR_STR_INT || s->mode == MAP_PAIR_STR_STR) {
for (i = 0; i < s->nch; i++) {
for (i = 0; i < s->nch; i++) {
if (s->mode == MAP_PAIR_STR_INT || s->mode == MAP_PAIR_STR_STR) {
s->map[i].in_channel_idx = av_get_channel_layout_channel_index(
inlink->channel_layout, s->map[i].in_channel);
if (s->map[i].in_channel_idx < 0) {
}
if (s->map[i].in_channel_idx < 0 ||
s->map[i].in_channel_idx >= nb_channels) {
av_get_channel_layout_string(layout_name, sizeof(layout_name),
0, inlink->channel_layout);
if (s->map[i].in_channel) {
channel_name = av_get_channel_name(s->map[i].in_channel);
av_get_channel_layout_string(layout_name, sizeof(layout_name),
0, inlink->channel_layout);
av_log(ctx, AV_LOG_ERROR,
"input channel '%s' not available from input layout '%s'\n",
channel_name, layout_name);
err = AVERROR(EINVAL);
} else {
av_log(ctx, AV_LOG_ERROR,
"input channel #%d not available from input layout '%s'\n",
s->map[i].in_channel_idx, layout_name);
}
err = AVERROR(EINVAL);
}
}

3
libavformat/id3v2.c
View File

@@ -490,9 +490,10 @@ static void read_apic(AVFormatContext *s, AVIOContext *pb, int taglen, char *tag
}
apic->len = taglen;
apic->data = av_malloc(taglen);
apic->data = av_malloc(taglen + FF_INPUT_BUFFER_PADDING_SIZE);
if (!apic->data || !apic->len || avio_read(pb, apic->data, taglen) != taglen)
goto fail;
memset(apic->data + taglen, 0, FF_INPUT_BUFFER_PADDING_SIZE);
new_extra->tag = "APIC";
new_extra->data = apic;

2
libavformat/utils.c
View File

@@ -3177,13 +3177,13 @@ void ff_free_stream(AVFormatContext *s, AVStream *st){
if (st->attached_pic.data)
av_free_packet(&st->attached_pic);
av_dict_free(&st->metadata);
av_freep(&st->probe_data.buf);
av_freep(&st->index_entries);
av_freep(&st->codec->extradata);
av_freep(&st->codec->subtitle_header);
av_freep(&st->codec);
av_freep(&st->priv_data);
av_freep(&st->info);
av_freep(&st->probe_data.buf);
av_freep(&s->streams[ --s->nb_streams ]);
}