The loop condition `x = ex' is incorrect. It should be `x <= ex'.
This bug was introduced in commit c65dfac4 "mpegvideo.c: K&R formatting
and cosmetics."
CC:libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Since resolution change support this also was exploitable, which is
how it was found.
Fixes read after free and out of array reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Move some functions from dsputil. The idea is that videodsp contains
functions that are useful for a large and varied set of video decoders.
Currently, it contains emulated_edge_mc() and prefetch().
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
These where reduced in f1d8763a02b5fce9a7d9789e049d74a45b15e1e8
and this change can cause out of array accesses.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'f1d8763a02b5fce9a7d9789e049d74a45b15e1e8':
mpegvideo: allocate scratch buffers after linesize is known
Conflicts:
libavcodec/mpegvideo.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The VC1 decoder uses edge_emu_buffer simultaneously for luma and chroma
and needs more space. That was not a problem before f1d8763a02b5fce
since the size for edge_emu_buffer was always calculated with 2 byte per
pixel since the linesize was not known.
Fixes occasionally fate errors in vc1_sa10143.
Since we can't know which stride a custom get_buffer() implementation is
going to use we have to allocate this scratch buffers after the linesize
is known. It was pretty safe for 8 bit per pixel pixel formats since we
always allocated memory for up to 16 bits per pixel. It broke hoever
with cmdutis.c's alloc_buffer() and high pixel bit depth since it
allocated larger edges than mpegvideo expected.
Fixes fuzzed sample nasa-8s2.ts_s244342.
* commit '6a27ae28f9bde981e85c82cf5bf42c5f43fb6f13':
mpegvideo: treat delayed pictures as used
Conflicts:
libavcodec/h264.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This requires to move the avcodec_default_free_buffers() call to
ff_MPV_common_end() since otherwise delayed pictures would get freed
during a size change.
This does not seem to have an effect currently. Fate-h264 passes with
THREADS=1..16 and both threading types as before. It fixes however a
segfault during error resilience with my adaptive-frame-mt patchset.
A picture in use during error resilience gets realloced in another
thread in the fuzzed sample sample_varPAR.avi_s226019.
* commit 'c9ef43215c7d68c2cdcdbe02287aa114f27a32ed':
fate-vc1: add dependencies
ARM: fix overreads in neon h264 chroma mc
rtsp: Make sure the ret variable is initialized in ff_rtsp_fetch_packet
gitignore: ignore files created by msvc
fate: Add proper dependencies for the tests in video.mak
configure: Disable Snow decoder and encoder by default
lzo: Drop obsolete fast_memcpy reference
build: Drop OBJS declaration for non-existing PCM_DVD encoder
mpeg4videodec: Disable frame multithreading for GMC, its not implemented at all
Conflicts:
libavcodec/mpegvideo.c
libavformat/rtsp.c
tests/fate/microsoft.mak
tests/fate/video.mak
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '0a7005bebd23ade7bb852bce0401af1a8fdbb723':
rtpdec_xiph: fix function return type
smjpeg: fix type of 'ret' variable in smjpeg_read_packet()
mpegvideo: remove write-only variable
Use proper return values in case of missing features
fate: add avstring test
rangecoder-test: Set error message log level to error, instead of debug
Conflicts:
libavcodec/aacdec.c
libavcodec/amrnbdec.c
libavcodec/mpegvideo.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '9734b8ba56d05e970c353dfd5baafa43fdb08024':
Move avutil tables only used in libavcodec to libavcodec.
Conflicts:
libavcodec/mathtables.c
libavutil/intmath.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'ab35ec29a4071871934856c00da7d6ebcc0c095b':
vf_overlay: get rid of pointless messing with timebase.
samplefmt: make av_samples_alloc() initialize the data to silence.
libspeexdec: handle NULL return value from speex_packet_to_header()
h264probe: Don't error out on bits that no longer are reserved
mpegvideo: set extended_data in ff_update_duplicate_context()
libspeexdec: properly handle DTX for multiple frames-per-packet
libspeexdec: move the SpeexHeader from LibSpeexContext to where it is used
libspeexdec: simplify setting of frame_size
libspeexdec: set channel_layout
Conflicts:
libavfilter/vf_overlay.c
libavformat/h264dec.c
libavutil/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
AVFrame.extended_data has to reset to the AVFrame.data of the current
thread context after copying the frame contents.
Fixes crashes with frame-threading after 2bc0de38584.
* commit '581281e242609a222233a2e5538b89dfb88fb18e':
matroskadec: check realloc in lzo encoding
matroska: honor error_recognition on unknown doctypes
tiffdec: Add support for GRAY16LE.
tiffenc: Add support for little endian RGB48 and GRAY16
mpeg4: support frame parameter changes with frame-mt
mpegvideo: check ff_find_unused_picture() return value for errors
mpegvideo: release frame buffers before freeing them
configure: msvc: default to 'lib' as 'ar' tool
build: support some non-standard ar variants
Conflicts:
libavcodec/h263dec.c
libavcodec/mpegvideo.c
libavcodec/tiff.c
libavcodec/tiffenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Adds a flag context_reinit to MpegEncContext to relieable keep track
of frame parameter changes which require a context reinitialization.
This is required for broken inputs which change the frame size but
error out before the context can be reinitialized.
