* qatar/master:
lavf: fix signed overflow in avformat_find_stream_info()
vp8: fix signed overflows
motion_est: fix some signed overflows
dca: fix signed overflow in shift
aacdec: fix undefined shifts
bink: Check for various out of bound writes
bink: Check for out of bound writes when building tree
put_bits: fix invalid shift by 32 in flush_put_bits()
Conflicts:
libavcodec/bink.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
On the first iteration through this code, last_dts is always
INT64_MIN (AV_NOPTS_VALUE) and the subtraction overflows in
an invalid manner. Although the result is only used if the
input values are valid, performing the subtraction is still
not allowed in a strict environment.
Signed-off-by: Mans Rullgard <mans@mansr.com>
In addition to avoiding undefined behaviour, an unsigned type
makes more sense for packing multiple 8-bit values.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Bug introduced by:
commit e3bf4e292c
Author: Anton Khirnov <anton@khirnov.net>
Date: Tue Aug 30 04:10:54 2011 +0200
ffmpeg: replace -vcodec/-acodec/-scodec with a better system.
The new option doesn't depend on its placement wrt -new* options (which
don't exist anymore) and works in a similar way as per-stream AVOptions.
-[vas]codec remain as aliases to -codec:[vas]
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
If flush_put_bits() is called when the 32-bit buffer is empty,
e.g. after writing a multiple of 32 bits, and invalid shift by
32 is performed. Since flush_put_bits() is called infrequently,
this additional check should have negligible performance impact.
Signed-off-by: Mans Rullgard <mans@mansr.com>
* qatar/master: (24 commits)
mpegps: Use av_get_packet() instead of poorly emulating it.
motionpixels: decode only the 111 complete frames for fate
mpc8: Check out of bound bands limit
xan: Prevent NULL dereference with missing palette
xan: Check for out of bound reads in xan_huffman_decode()
xan: Fixed out of bound accesses in xan_unpack()
motionpixels: Prevent calling init_vlc() with invalid parameters
shorten: Fix out of bound writes in fix_bitshift()
dsicinav: Check for out of bounds writes
tiertexseqv: Check for out of bound reads
quickdraw: Check for out of bound reads
dsicinav: Check for out of bounds reads
motionpixels: Fix the size of workspace buffers
motionpixels: Clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffer
wmavoice: Check for corrupted extra data
wmavoice: Check for out of bound writes
xan: Prevent NULL dereferences with missing reference frame
bink: Prevent NULL dereferences with missing reference frame
wavpack: Reset internal state on corrupted blocks
wmapro: Validate the number of audio channels before using it
...
Conflicts:
libavcodec/h264.c
libavcodec/xan.c
tests/ref/fate/motionpixels
Merged-by: Michael Niedermayer <michaelni@gmx.at>
