This is identical to what e.g. vp8 does, and prevents the function call
overhead (plus dependency on dsputil for this particular function).
Arm asm updated by Janne Grunau <janne-libav@jannau.net>.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
The loop condition `x = ex' is incorrect. It should be `x <= ex'.
This bug was introduced in commit c65dfac4 "mpegvideo.c: K&R formatting
and cosmetics."
CC:libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
ref_list is constructed from other fields per slice when needed, so do
not copy it for both frame and slice threading.
default_ref_list is constructed per frame and still needs to be copied
to per-slice contexts for slice threading, but a copy is not needed for
frame threading.
The mask `x && (1 << y)' is incorrect and always yields true.
The correct form should be `x & (1 << y)'.
CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This fixes a regression since d9cf5f51 with theora over RTP
(possibly with other variants of theora as well).
In theora over RTP, the second of the 3 headers turns out to be
0 bytes long, which prior to d9cf5f51 worked just fine. After
d9cf5f51, reading from the bitstream reader fails (since the reader
wasn't initialized but returned an error if initialized with 0 bits).
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
If the motion vector is at a subpixel position, we need 3 pixels below
the motion vector's wholepel position available, not 2, since the MC
filter is a sixtap filter for the hpel position, and then a bilin filter
for the qpel position.
This patch fixes highly irreproducible (0.1%) fate failures in frame 2
and 4 of h264-conformance-cama2_vtc_b (e.g. first P-frame, first field,
last line of MB x=40,y=2 and second field and last lines of MBs x=39-40,
y=3). These used pre-loopfilter instead of post-loopfilter data because
the await_progress() waited for one line too little in that field, and
the motion vector of these particular MBs happened to align exactly to a
position where that demonstrates the bug.
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Matroska stores palette information as plain text in extradata.
Signed-off-by: Alexandra Khirnova <alexandra.khirnova@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
rc_buffer_size is not set before.
Solve the initial the rate control underflow issue reported in
bug 222.
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The floating point version of av_clip has to be used when
converting the quality level.
Signed-off-by: Maximilian Seesslen <mes@seesslen.net>
Signed-off-by: Martin Storsjö <martin@martin.st>
Clobbering these tables will temporarily clobber the template used
as a basis for other threads to start decoding from. If the other
decoding thread updates from the template right at that moment,
subsequent threads will get invalid (or, usually, none at all) mmco
tables. This leads to invalid reference lists and subsequent decode
failures.
Therefore, instead, decode the mmco tables only for the first slice in
a field or frame. For other slices, decode the bits and ensure they
are identical to the mmco tables in the first slice, but don't ever
clobber the context state. This prevents other threads from using a
clobbered/invalid template as starting point for decoding, and thus
fixes decoding in these cases.
This fixes occasional (~1%) failures of h264-conformance-mr1_bt_a with
frame-multithreading enabled.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Fixes null pointer dereference later, since if this function failed,
a positive return value was returned to the caller.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Martin Storsjö <martin@martin.st>
Freeing it in av_destruct_packet(), as is done currently, would mean
that we allow it to be allocated with other means. But that would make
av_packet_new_side_data() unsafe.
Side data is not expected to be large, so copying it if required
shouldn't be a problem.
Handle pred_flag parameter not given to get_mvdata_interlaced()
Signed-off-by: Vladimir Pantelic <vladoman@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The function find_things() in configure is confused by component
registration calls as part of multiline macros defining combined
component registration. Coalesce those macros into one line to
work around the issue.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Signed-off-by: Martin Storsjö <martin@martin.st>
Comparing AVCodecContext.pix_fmt against the get_pixel_format() return
value has the side effect of calling the get_format() callback on each
slice. Users of the callback will probably handle hardware accelerator
initialization in the callback.
It does not use any of the mpegvideo infrastructure, just a few fields
from the context.
Fixes a segfault with the emu edge flag, since emu edge buffer is now
allocated as a part of the frame buffer allocation and cavs calls
ff_get_buffer() directly, it does not use mpegvideo buffer management.
Fixes a memleak of the last frame.
Do not overwrite linesize set by get_buffer().
The last frame in the FATE test is not decoded anymore, since the file
is cut and a part of it is missing.
The description as updated in 6e5c44b0f made it sound like it is
handled exactly like the pts, which it is not. Clarify that it
is the packet that triggered returning the frame instead of just
the last avpacket (in case of frame threading, it won't be the
dts of the last packet).
Signed-off-by: Martin Storsjö <martin@martin.st>
Using a frame count, as is done currently, does not work at all with
seeking. Instead, when the number of samples in the final frame has
been decoded, we check if only the 32-bit CRC is remaining. If so, we
assume that it is the final frame.
There is no longer a need to keep total_frames in TTAContext.
Sometimes the extradata has duplicate atoms, but that shouldn't prevent
decoding. Just ensure that it is at least 36 bytes as a sanity check.
CC: libav-stable@libav.org
Move some functions from dsputil. The idea is that videodsp contains
functions that are useful for a large and varied set of video decoders.
Currently, it contains emulated_edge_mc() and prefetch().
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The VC1 decoder uses edge_emu_buffer simultaneously for luma and chroma
and needs more space. That was not a problem before f1d8763a02
since the size for edge_emu_buffer was always calculated with 2 byte per
pixel since the linesize was not known.
Fixes occasionally fate errors in vc1_sa10143.
Since we can't know which stride a custom get_buffer() implementation is
going to use we have to allocate this scratch buffers after the linesize
is known. It was pretty safe for 8 bit per pixel pixel formats since we
always allocated memory for up to 16 bits per pixel. It broke hoever
with cmdutis.c's alloc_buffer() and high pixel bit depth since it
allocated larger edges than mpegvideo expected.
Fixes fuzzed sample nasa-8s2.ts_s244342.
It is not posible to call get_buffer during frame-mt codec
initialization. Libavformat might pass huge amounts of data as
extradata after parsing broken files. The 'extradata' for the fuzzed
sample sample_varPAR_s5374_r001-02.avi is 2.8M large and contains
multiple slices.
This requires to move the avcodec_default_free_buffers() call to
ff_MPV_common_end() since otherwise delayed pictures would get freed
during a size change.
Direct rendering capable decoders call get_buffer() which will set the
frame parameters.
Prevents frames with wrong parameters when a decoder outputs delayed
frames after a resolution or pixel format change.
Use this in VP8/H264-8bit loopfilter functions so they can be used if
there is no aligned stack (e.g. MSVC 32bit or ICC 10.x).
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This changes the LOCAL_ALIGNED definition on systems where
DECLARE_ALIGNED is used so it matches the manual alignment
case, ensuring invalid use will not compile on x86 only to
fail on everything else.
Signed-off-by: Mans Rullgard <mans@mansr.com>
The initial testing of the VFW binary codec was flawed,
likely due to an AviSynth bug.
Re-testing using VirtualDub and various professional editing
applications has revealed it should have been flipped.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Prevent an invalid write into coeffs[scantable[-1]] if zeros_left
itself was an invalid VLC code (and thus -1).
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This prevents undefined behaviour of signed left shift if the coded
value is larger than 2^31. Large values are most likely invalid and
caused errors or by feeding random.
Validate every use of svq3_get_ue_golomb() and changed the place there
the return value was compared with negative numbers. dirac.c was clean,
fixed rv30 and svq3.
Also remove a duplicate function in the MPEG-TS demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
This is consistent with usual ARM nomenclature as well as with the
VFPV3 and NEON symbols which both lack the ARM prefix.
Signed-off-by: Mans Rullgard <mans@mansr.com>
When initialising an FFTContext for a plain FFT, mdct_bits is not set
and can contain a garbage value. Since nbits is always valid and for
MDCT operation is mdct_bits - 2 checking this instead avoids using an
uninitialised value while having the same effect.
Signed-off-by: Mans Rullgard <mans@mansr.com>
When called from the v4l2 input device, pix_fmt can be
AV_PIX_FMT_NONE (for jpeg formats). Before 50ba57e0, this wasn't
an issue for avpicture_get_size, but after that commit, this
lead to crashes.
Signed-off-by: Martin Storsjö <martin@martin.st>
Avoid use of uninitialized and uncomputed linear least square models
during ff_lpc_calc_coefs() for FF_LPC_TYPE_CHOLESKY. Fixes running
make fate-flac-16-lpc-cholesk with valgrind --undef-value-errors=yes.
Start and end index are multiple of 2, therefore guaranteeing aligned access.
Also, this allows to generate 4 floats per loop, keeping the alignment all
along.
Timing:
- 32 bits: 326c -> 172c
- 64 bits: 323c -> 156c
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Swapping buffer indices allows saving one memcpy that accounts for 1% of the
runtime, according to oprofile.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Some combinations of OS, VirtualDub, and VBLE can accidentally
set the version to a value other than 1. Since no other version
of VBLE was ever released, simply warn about it.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
This does not seem to have an effect currently. Fate-h264 passes with
THREADS=1..16 and both threading types as before. It fixes however a
segfault during error resilience with my adaptive-frame-mt patchset.
A picture in use during error resilience gets realloced in another
thread in the fuzzed sample sample_varPAR.avi_s226019.
When the extra rear channel is present but unused, the
s->channel_order_tab[] value for that channel is -1. The QMF can be
skipped for the extra channel, and doing so avoids an out-of-array read
on s->samples_chanptr[].
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
This fixes segfault caused by 3d3cf6745e
when SingleChannelElement.ret was renamed to SingleChannelElement.ret_buf.
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
Dropping frames is undesirable but that is the only way by which the
decoder could return to low delay mode. Instead emit a warning and
continue with delayed frames.
Fixes a crash in fuzzed sample nasa-8s2.ts_s20033 caused by a larger
than expected has_b_frames value. Low delay keeps getting re-enabled
from a presumely broken SPS.
CC: libav-stable@libav.org
The qpel functions referenced here are not related to h264 and should
thus never have been under CONFIG_H264QPEL.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Signed-off-by: Diego Biurrun <diego@biurrun.de>
The only CPUs that have 3dnow and don't have mmxext are 12 years old.
Moreover, AMD has dropped 3dnow extensions from newer CPUs.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
The vertical offset mask 0x07 is suspicious.
v_off = FFMIN(data[2] & 0x07, CDG_BORDER_HEIGHT - 1);
Note that v_off is up to 11 (CDG_BORDER_HEIGHT - 1), the correct mask
should be 0x0F.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The sample count is decremented by the DECODE() macro and needs to be reset
in each loop iteration. Also, DECODE() increments the src pointer so that does
not need to be done separately.
s->mb_x is reset to zero a couple of lines above. It does not make
sense to call ff_er_add_slice() with 0 as endx when the end of the
macroblock row was reached. Fixes unnecessary and counterproductive
error resilience in https://bugzilla.libav.org/show_bug.cgi?id=394.
CC: libav-stable@libav.org
The third argument of OP_U8_ALTIVEC is evaluated at most once so
there is no need for a potentially unused temporary variable.
Signed-off-by: Mans Rullgard <mans@mansr.com>
The alternative to zeroing on init is setting the corrupted flag in
all cases where pal_pic is not fully written, at the cost of added
complexity.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
This fixes use of uninitialized values when the FLAC encoder uses the
2-level, 4-level, and 8-level search methods. Fixes failure of the
fate-flac-24-comp-8 test when run using valgrind.
This allows getting rid of redundant checks later in the codec
specific init functions.
Move the check to before actually initializing the decoder lib,
to simplify error handling.
This fixes a case of returning a value from a void function, present since
d40dab907.
Signed-off-by: Martin Storsjö <martin@martin.st>
Ensures the decoder did not set channel count to an insanely high value
during initialization, which could cause large memory usage when it tries to
get a buffer during decoding.
After a flush, don't average the output envelope and energy with
previous iterations.
Also start directly from the target values for the first iteration
at startup.
Signed-off-by: Martin Storsjö <martin@martin.st>
This was a leftover from previous iterations of the code, where the
refl coef arrays were statically allocated.
Signed-off-by: Martin Storsjö <martin@martin.st>
Replace INIT_AVX by INIT_XMM avx. Port the whole file to use cpuflag
based function declarations. Remove (now unused) cputype argument in
function declaration macros. Change function prototypes to have mmx2
instead of mmxext as suffix, since that's required by cpuflags.
This isn't too useful as a normal codec, but can be used in
voip style applications. The decoder updates the noise
generator parameters when a packet is given to it for decoding,
but if called with an empty packet, it generates more noise
according to the last parameters.
Signed-off-by: Martin Storsjö <martin@martin.st>
Subtracting a (positive) value from the address of an array violates
C99 section 6.5.6:
If both the pointer operand and the result point to elements of the
same array object, or one past the last element of the array object,
the evaluation shall not produce an overflow; otherwise, the
behavior is undefined.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Subtracting a (positive) value from the address of an array violates
C99 section 6.5.6:
If both the pointer operand and the result point to elements of the
same array object, or one past the last element of the array object,
the evaluation shall not produce an overflow; otherwise, the
behavior is undefined.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Avoids memleaks with audio when extended_data is nontrivial and the user
doesn't reset the frame.
Shouldn't have any effect for video for now, but might be useful in the
future.
This defines an AVCodec only if the corresponding CONFIG option is
enabled instead of using the broad CONFIG_ENCODERS/DECODERS.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Since it is declared as a string AVOption, the generic freeing code
attempts to free it on codec close. Some codecs might have already freed
it elsewhere (or didn't even allocate it with av_malloc() in the first
place), so this might lead to an invalid free.
There is no point in having this field accessible as an AVOption, so
remove it from the options table.
Fixes Bug 380.
CC: libav-stable@libav.org
Error out on init if a codec with CODEC_CAP_EXPERIMENTAL is requested
and strict_std_compliance is not FF_COMPLIANCE_EXPERIMENTAL.
Move the check from avconv to avcodec_open2() and return
AVERROR_EXPERIMENTAL accordingly.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Earlier versions of for instance of libavcodec expect this symbol to be
present in libavutil. This commit can be reverted after the next major
bump.
New shared builds of avcodec will link to the internal copy of the
table within that library, so those builds won't rely on this table
being present in avutil any longer either.
Signed-off-by: Martin Storsjö <martin@martin.st>
The loops were reading ahead one line, which could end up outside the
buffer for reference blocks at the edge of the picture. Removing
this readahead has no measurable performance impact.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Internally chroma planes have multiple of four height while allocated image
planes might be smaller if CODEC_FLAG_EMU_EDGE is set. Thus we should not
output more lines of chroma than frame can accept.
Also the decoder can be safely switched to direct rendering now.
aac_tablegen.h includes aac.h for the POW_SF2_ZERO definition, but
this also pulls in a raft of other headers, some of which are not
safe to use in code built with the host compiler.
Moving POW_SF2_ZERO to aac_tablegen_decl.h, where the declaration
of the array it relates to already resides, fixes the problems.
Signed-off-by: Mans Rullgard <mans@mansr.com>
This requires the makedef perl script by Derek, from the
c89-to-c99 repo. That scripts produces a .def file, listing
the symbols to be exported, based on the gcc version scripts
and the built object files.
To properly load non-function symbols from DLL files, the
data symbol declarations need to have the attribute
__declspec(dllimport) when building the calling code. (On mingw,
the linker can fix this up automatically, which is why it has not
been an issue so far. If this attribute is omitted, linking
actually succeeds, but reads from the table will not produce the
desired results at runtime.)
MSVC seems to manage to link DLLs (and run properly) even if
this attribute is present while building the library itself
(which normally isn't recommended) - other object files in the
same library manage to link to the symbol (with a small warning
at link time, like "warning LNK4049: locally defined symbol
_avpriv_mpa_bitrate_tab imported" - it doesn't seem to be possible
to squelch this warning), and the definition of the tables
themselves produce a warning that can be squelched ("warning C4273:
'avpriv_mpa_bitrate_tab' : inconsistent dll linkage, see previous
definition of 'avpriv_mpa_bitrate_tab').
In this setup, mingw isn't able to link object files that refer to
data symbols with __declspec(dllimport) without those symbols
actually being linked via a DLL (linking avcodec.dll ends up with
errors like "undefined reference to `__imp__avpriv_mpa_freq_tab'").
The dllimport declspec isn't needed at all in mingw, so we simply
choose not to declare it for other compilers than MSVC that requires
it. (If ICL support later requires it, the condition can be extended
later to include both of them.)
This also implies that code that is built to link to a certain
library as a DLL can't link to the same library as a static library.
Therefore, we only allow building either static or shared but not
both at the same time. (That is, static libraries as such can be,
and actually are, built - this is used for linking the test tools to
internal symbols in the libraries - but e.g. libavformat built to
link to libavcodec as a DLL cannot link statically to libavcodec.)
Also, linking to DLLs is slightly different from linking to shared
libraries on other platforms. DLLs use a thing called import
libraries, which is basically a stub library allowing the linker
to know which symbols exist in the DLL and what name the DLL will
have at runtime.
In mingw/gcc, the import library is usually named libfoo.dll.a,
which goes next to a static library named libfoo.a. This allows
gcc to pick the dynamic one, if available, from the normal -lfoo
switches, just as it does for libfoo.a vs libfoo.so on Unix. On
MSVC however, you need to literally specify the name of the import
library instead of the static library.
Signed-off-by: Martin Storsjö <martin@martin.st>
This table doesn't need to be shared with libavformat any longer.
Add mpeg12 to the name to make it less ambiguous, while renaming it.
Signed-off-by: Martin Storsjö <martin@martin.st>
The LAME API documentation for the required buffer size refers to the size for
a single encode call. However, we store multiple frames in the same output
buffer but only read 1 frame at a time out of it. As a result, the buffer size
given in lame_encode_buffer() is actually smaller than what it should be.
Since we do not know how many frames it will end up buffering, it is best to
just reallocate if needed.
Bitrate calculation is off since the bluray spec always specifies
an even number of coded channels. This was honored in the decoder,
but not for bitrate calculation.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This fixes a segfault with samples that I have (both of them MPEG-TS). Looks like
avctx->codec is not being set during parsing.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
Fixes:
libavcodec/svq3.c:661:9: warning: passing argument 2 of 'svq3_decode_block' from incompatible pointer type
libavcodec/svq3.c:208:19: note: expected 'DCTELEM *' but argument is of type 'DCTELEM (*)[32]'
Signed-off-by: Mans Rullgard <mans@mansr.com>
The existing code is not in the right place and it should cover both
interlaced frame and field pictures.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
This is required due to the way VC-1 handles chroma pull-back which may end
up causing negative chroma MV for zero luma MV. Edge emulation needs to be
invoked in such cases.
This only affects vertical component of chroma motion vector.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Interlaced field pictures can have one or two reference pictures, signaled
by NUMREF syntax element. For single reference pictures, reference picture
is determined by REFFIELD syntax element.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
GCC cannot proof that c->mc_frame_counter is always >- 0, changing the
type from int to unsigned fixes following warning:
libavcodec/a64multienc.c: In function ‘a64multi_encode_frame’:
libavcodec/a64multienc.c:342:17: warning: ‘buf’ may be used uninitialized in this function[-Wuninitialized]
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
Some invocations include a verb in the log message, others do not. Yet
av_log_missing_feature expects callers to provide a verb. Change the
function to include a verb instead and update the callers accordingly.
The result is a more natural function API and correct English in the
function invocations.
The vec_splat() intrinsic requires a constant argument for the
element number, and the code relies on the compiler unrolling
the loop to provide this. Manually unrolling the loop avoids
this reliance and works with all compilers.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Instead of using an evil VLA, fall back to C version when edge
emulation is needed. MPEG4 GMC is a rarely used fringe feature
so the speed loss is an acceptable cost for safer code.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Discontinuous transmission is an addition to VAD/VBR operation, that
allows to greatly reduce bitrate for silent chunks or stationary
noises.
Signed-off-by: Martin Storsjö <martin@martin.st>
The variable is copied to subsequent threads at the same time, so this
may cause wrong ref_count[] values to be copied to subsequent threads.
This bug was found using TSAN.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
AVFrame.extended_data has to reset to the AVFrame.data of the current
thread context after copying the frame contents.
Fixes crashes with frame-threading after 2bc0de3858.
Speex detects non-speech periods and encodes them with just enough bits
to reproduce the background noise, aka ``comfort noise generation''.
Signed-off-by: Martin Storsjö <martin@martin.st>
All our ARM asm preserves alignment so setting this attribute
in a common location is simpler. This removes numerous warnings
when linking with armcc.
Signed-off-by: Mans Rullgard <mans@mansr.com>
If there is an error during frame parsing, but AVCodecContext.channels was
changed and AC3DecodeContext.out_channels was set previously, the two may not
match.
Fixes CVE-2012-2802
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
When decode_nal_units() previously encountered a NAL_END_SEQUENCE,
and there are some junk bytes left in the input buffer, but no start codes,
buf_index gets stuck 3 bytes before the end of the buffer.
This can trigger an infinite loop in the caller code, eg. in
try_decode_trame(), as avcodec_decode_video() then keeps returning zeroes,
with 3 bytes of the input packet still available.
With this change, the remaining bytes are skipped so the whole packet gets
consumed.
CC:libav-stable@libav.org
Signed-off-by: Jindřich Makovička <makovick@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The decode function assumes that the video will have those dimensions.
Fixes CVE-2012-2801
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Fixes a part of CVE-2012-2795
CC:libav-stable@libav.org
Based on a patch by Michael Niedermayer <michaelni@gmx.at>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Fixes a part of CVE-2012-2795
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Fixes a part of CVE-2012-2795
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents writing into a too small array if some parameters changed
without the tile being reallocated.
Based on a patch by Michael Niedermayer <michaelni@gmx.at>
Fixes CVE-2012-2800
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
This prevents writing into a too small array if some parameters changed
without the tile being reallocated.
Fixes CVE-2012-2794
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents decoding happening on a half initialized context.
Fixes CVE-2012-2779
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Our decoder does not support changing w/h.
Fixes CVE-2012-2777 and CVE-2012-2784.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The value should be always 3, as it follows from the specification.
Fix a stack buffer overflow in exponents_from_scale_factors as reported
by asan. Thanks to Dale Curtis for the sample vector.
This way we can directly remap channels from Opus' channel order to
libav's internal channel order, instead of mapping channels from
Opus' order to Vorbis' order then to libav's order.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Do not use rlelen field for buffer size in init_get_bits, it is
only the size of the data for the first field.
Since it is not reliable, just use the size of the whole buffer.
Additional comments add removal of unused rlelen variable by
Reimar Döffinger.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This avoids using the global_quality field and QSCALE flag for
passing the VBR modes, since the value range of the global_quality
field doesn't really map cleanly to this codec's VBR modes.
Signed-off-by: Martin Storsjö <martin@martin.st>
These modes were not originally exposed by the library at all.
In practice, only a few of them work for each sample rate/profile
combination, and they don't work at all for the more uncommon
sample rates.
Signed-off-by: Martin Storsjö <martin@martin.st>
