generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'qatar/release/9' into release/1.1

Browse Source 
* qatar/release/9:
  mpegvideo: Avoid 32-bit wrapping of linesize multiplications
  mjpegb: Detect changing number of planes in interlaced video
  alac: Check that the channels fit at the given offset
  4xm: Check that the read track value is non-negative

Conflicts:
	libavcodec/alac.c
	libavcodec/mjpegdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2013-09-07 14:27:10 +02:00
parent 5c6aea5c31 b01e4d80c6
commit de5e003369
3 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/alac.c
View File

@@ -462,9 +462,8 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data,
} }
channels = (element == TYPE_CPE) ? 2 : 1; channels = (element == TYPE_CPE) ? 2 : 1;
if ( ch + channels > alac->channels if (ch + channels > alac->channels ||
|| ff_alac_channel_layout_offsets[alac->channels - 1][ch] + channels > alac->channels ff_alac_channel_layout_offsets[alac->channels - 1][ch] + channels > alac->channels) {
) {
av_log(avctx, AV_LOG_ERROR, "invalid element channel count\n"); av_log(avctx, AV_LOG_ERROR, "invalid element channel count\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }

3
libavcodec/mjpegdec.c
View File

@@ -254,7 +254,8 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
return -1; return -1;
if (s->interlaced && (s->bottom_field == !s->interlace_polarity)) { if (s->interlaced && (s->bottom_field == !s->interlace_polarity)) {
if (nb_components != s->nb_components) { if (nb_components != s->nb_components) {
av_log(s->avctx, AV_LOG_ERROR, "nb_components changing in interlaced picture\n"); av_log(s->avctx, AV_LOG_ERROR,
"nb_components changing in interlaced picture\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
} }

2
libavformat/4xm.c
View File

@@ -135,6 +135,8 @@ static int parse_strk(AVFormatContext *s,
av_log(s, AV_LOG_ERROR, "current_track too large\n"); av_log(s, AV_LOG_ERROR, "current_track too large\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
if (track < 0)
return AVERROR_INVALIDDATA;
if (track + 1 > fourxm->track_count) { if (track + 1 > fourxm->track_count) {
fourxm->tracks = av_realloc_f(fourxm->tracks, track + 1, sizeof(AudioTrack)); fourxm->tracks = av_realloc_f(fourxm->tracks, track + 1, sizeof(AudioTrack));
if (!fourxm->tracks) if (!fourxm->tracks)