Conversion of the luma intra prediction mode to one of the constrained
("alzheimer") ones can happen by crafting special bitstreams, causing
a crash because we'll call a NULL function pointer for 16x16 block intra
prediction, since constrained intra prediction functions are only
implemented for chroma (8x8 blocks).
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
in , else (1) { if (!1) } the if conditional will never evaluate to be true.
So as making the check useless.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The added tests are limited to the case where timestamp discontinuities
are not allowed. The default is 30 hours which is arbitrarily picked and
quite conservative.
This prevents a out of memory condition due to duplicating a frame
millions of times.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
We need to do unsigned saturation in order to cover the corner case when the
absolute coefficient value is 16777215 (the maximum value).
Fixes Bug #216
That way all mix levels as exported by avpriv_ac3_parse_header()
will have the same meaning.
Previously the 3-bit center mix level for E-AC-3 was used to index in a
4-entry table, leading to out-of-array reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
Signed-off-by: Alex Converse <alex.converse@gmail.com>
* qatar/master: (26 commits)
eac3dec: replace undefined 1<<31 with INT32_MIN in noise generation
yadif: specify array size outside DECLARE_ALIGNED
prores: specify array size outside DECLARE_ALIGNED brackets.
WavPack demuxer: set packet duration
tta: use skip_bits_long()
mxfdec: Ignore the last entry in Avid's index table segments
mxfdec: Sanity-check SampleRate
mxfdec: Handle small EditUnitByteCount
mxfdec: Consider OPAtom files that do not have exactly one EC to be OP1a
mxfdec: Don't crash in mxf_packet_timestamps() if current_edit_unit overflows
mxfdec: Zero nb_ptses in mxf_compute_ptses_fake_index()
mxfdec: Sanity check PreviousPartition
mxfdec: Never seek back in local sets and KLVs
mxfdec: Move the current_partition check inside mxf_read_header()
mxfdec: Fix infinite loop in mxf_packet_timestamps()
mxfdec: Check eof_reached in mxf_read_local_tags()
mxfdec: Check for NULL component
mxfdec: Make sure mxf->nb_index_tables > 0 in mxf_packet_timestamps()
mxfdec: Make sure x < index_table->nb_ptses
build: Add missing directories to DIRS declarations.
...
Conflicts:
doc/build_system.txt
doc/fate.texi
libavfilter/x86/yadif_template.c
libavformat/mxfdec.c
libavutil/Makefile
tests/fate/audio.mak
tests/fate/prores.mak
tests/fate/screen.mak
tests/fate/video.mak
tests/ref/fate/bethsoft-vid
tests/ref/fate/cscd
tests/ref/fate/dfa4
tests/ref/fate/nuv
tests/ref/fate/vp8-sign-bias
tests/ref/fate/wmv8-drm
tests/ref/lavf/gxf
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Comment-by-michael: iam commiting this as the code cannot work without it and likely works with it.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes crashes on exit when closing a bitstream filter that
hasn't allocated any private data, on OS X.
Signed-off-by: Martin Storsjö <martin@martin.st>
The last entry is the total size of the essence container.
Previously a TemporalOffset error would be logged, even though
segments like these are expected.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
These are common with audio atoms. Without this the demuxer would read two
bytes at a time for a mono 16-bit file.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Specially crafted files can lead the parsing code to take too long.
We fix a lot of these problems by not allowing local tags to extend
past the end of the set and not allowing other KLVs to be read past
the end of themselves.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
