32485 Commits

Author SHA1 Message Date
Michael Niedermayer
1e7ff902f2 avcodec/tta: Check init_get_bits8() for failure
Fixes: CID1322319

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f1593e4ca564cdb7f3194a9eee1dea16df41142d)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 02:55:46 +01:00
Michael Niedermayer
dceec28eac avcodec/vp3: Check init_get_bits8() for failure
Fixes CID1322316

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cbd3cd8eb2de2280d83da5ee875c35581b46a3a3)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 02:55:46 +01:00
Michael Niedermayer
19a29c92db avcodec/truemotion1: Check for even width
Fixes out of array access
Fixes: 87196d8bbc633629fc9dd851fce73e70/asan_heap-oob_26f6853_862_cov_585961513_sonic3dblast_intro-partial.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 63fb5a6aefb4223334001fd2c0d82a5e22e3b528)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 02:55:46 +01:00
Michael Niedermayer
ffcd26d25b avcodec/mpeg12dec: Set dimensions in mpeg1_decode_sequence() only in absence of errors
Fixes assertion failure
Fixes: 56dcafde14a8397161bb61a16c511179/signal_sigabrt_7ffff6ac8cc9_686_cov_1897408623_microsoft_new_way_to_shove_mpeg2_in_asf.dvr_ms

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b54e03c9dc2a05324c08b503bfe7535c49c0f281)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 02:55:46 +01:00
Michael Niedermayer
42fd94b514 avcodec/libopusenc: Fix infinite loop on flushing after 0 input
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6701c92fa4269872856c70c3170a9b3291b46247)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 02:55:46 +01:00
Michael Niedermayer
b87fc3526f avcodec/flashsvenc: Correct max dimension in error message
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b1f59bb6606721ef5eeade4ada541630d51510fe)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 02:55:45 +01:00
Michael Niedermayer
d165ec179e avcodec/svq1enc: Check dimensions
Fixes assertion failure

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 88fe45e0fe379d7ea86c8ac1e1e8cf2c3f62389f)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 02:55:45 +01:00
Michael Niedermayer
94541f5f76 avcodec/dcaenc: clear bitstream end
This avoids leaving uninitialized bits in the output

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e322b7061f873e8fd33b9e518caa19b87616a528)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-11-12 02:55:45 +01:00
Emanuel Czirai
5e71f4aa6a libavcodec/aacdec_template: Use init_get_bits8() in aac_decode_frame()
related to ticket4749

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ab1c57a64b629455805d7fa74a8a20c689fc1f6)

Conflicts:

	libavcodec/aacdec_template.c
2015-11-12 02:55:45 +01:00
Ronald S. Bultje
131f2c366e videodsp: don't overread edges in vfix3 emu_edge.
Fixes trac ticket 3226. Also see Andreas' analysis in
https://bugs.debian.org/801745, which was very helpful.
(cherry picked from commit 52f84d82bdf1851ecfcc412c1719e5f6f3396209)
2015-10-25 01:09:12 +02:00
Michael Niedermayer
8f00ff5ae0 avcodec/h264_mp4toannexb_bsf: Reorder operations in nal_size check
Fixes Ticket4778

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2bb54b82b5094fd906aa28c0443be08c95662a31)
2015-10-09 21:36:11 +02:00
Hendrik Leppkes
98fdd0baf3 hevc: properly handle no_rasl_output_flag when removing pictures from the DPB
Fixes ticket #4185.

Reviewed-By: Mickael Raulet <Mickael.Raulet@insa-rennes.fr>
Signed-off-by: Hendrik Leppkes <h.leppkes@gmail.com>
(cherry picked from commit 0118158efa8e45761f9f65a3bb74f33907bd2aec)
2015-10-09 21:33:56 +02:00
Ronald S. Bultje
f7cb979766 hevc: fix wpp threading deadlock.
Fixes ticket 4258.
(cherry picked from commit 74e4948235bc8f8946eeca20525258bbf383f75d)
2015-10-09 21:33:35 +02:00
Michael Niedermayer
0fb4a85603 avcodec/ffv1: seperate slice_count from max_slice_count
Fix segfault with too large slice_count
Fixes Ticket4879

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa6c43f3fdec8a7518534b9dab20c9eb4be11568)

Conflicts:
	libavcodec/ffv1enc.c
2015-10-09 21:32:52 +02:00
wm4
114c0f002a avcodec/mp3: fix skipping zeros
Commits 43bc5cf9 and c5371f77 add code for skipping initial zeros in mp3
packets. This code forgot to report to the user that data was skipped at
all.

Since audio codecs allow partial packet decoding, the user application
has to rely on the return value. It will remove the data reported as
consumed by the decoder, and feed it to the decoder again. This resulted
in the mp3 frame after the zero region to be decoded over and over
again, until the zero region was finally skipped by the application.

Fix this by including the amount of skipped bytes to the number of
consumed bytes returned by the decode call.

Fixes trac ticket #4890.
(cherry picked from commit cb1da9fb8d71bb611a7b0028914c97afc3f5711d)
2015-10-09 21:29:03 +02:00
Michael Niedermayer
b1863e3d94 avcodec/ffv1enc: fix assertion failure with unset bits per raw sample
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 749f85496ccff345ec811976ce45ec9e1900e9a8)

Fixes ticket #4751.
2015-08-04 12:56:52 +02:00
James Almer
a3d45dbcc1 mips/hevcdsp: fix string concatenation on macros
Needed for old compilers like GCC 4.2

Tested by trac user brad. Fixes ticket #4745

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit a0092cea462ff4f203aaff09c42c6731c6516b44)
2015-07-30 21:01:32 -03:00
Andreas Cadhalpun
27816fb9ef imc: use correct position for flcoeffs2 calculation
flcoeffs2[pos] should be the log2 of flcoeffs1[pos].
flcoeffs1[0] can be 0 here, thus flcoeffs2[pos] gets set to -inf,
causing problems further down.

This seems to have been copied from imc_decode_level_coefficients in
commit 4eb4bb3 without updating the position.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 75fd5ce4c1c0b2d96d71c74b650cefaaef519d27)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 10:14:31 +02:00
Andreas Cadhalpun
f06d9dced4 hevc: check slice address length
It is used as get_bits argument and reading 0 bits isn't supported.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 05cc8c8e4b7008ff3be8ec477c901b2ceca4b16b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 10:01:30 +02:00
Andreas Cadhalpun
26cb351452 snow: remove an obsolete av_assert2
It asserts that the frame linesize is larger than 37, but it can be
smaller and decoding such frames works.

Before commit cc884a35 src_stride > 7*MB_SIZE was necessary, because the
blocks were interleaved in the tmp buffer and the last block was added
with an offset of 6*MB_SIZE.
It was changed for src_stride <= 7*MB_SIZE to write the blocks
sequentially, hence the larger tmp_step.
After that the assert was only necessary to make sure that the buffer
remained large enough.
Since commit bd2b6b33 s->scratchbuf is used as tmp buffer.
As part of commit 86e107a7 the minimal scratchbuf size was increased to
256*7*MB_SIZE, which is enough for any src_stride <= 7*MB_SIZE.

Also add a comment explaining the tmp_step calculation.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 3526a120f92929cb0a4009e403ee2f141030c487)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 10:01:18 +02:00
Andreas Cadhalpun
762a5878a6 webp: fix infinite loop in webp_decode_frame
The loop always needs at least 8 bytes for chunk_type and chunk_size.
If fewer are left, bytestream2_get_le32 just returns 0 without
reading any bytes, leading to an infinite loop.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0762152f7af6cd93bc8f504d5503723500c3f369)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 10:00:07 +02:00
Andreas Cadhalpun
f0af6e705f wavpack: limit extra_bits to 32 and use get_bits_long
More than 32 bits can't be stored in an integer and get_bits should not
be used with more than 25 bits.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit d0eff8857ceff2601f85037c930cbe61a88b611e)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 09:43:20 +02:00
Andreas Cadhalpun
acfad331ad pthread_frame: forward error codes when flushing
This is the first part of the fix for ticket #4370.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 32a5b631267e1f8bf279e407039b9a99d012d033)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 09:37:42 +02:00
Andreas Cadhalpun
43f8a422b3 huffyuvdec: validate image size
Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 9a345802edf7f430b3335f486aecdd8552f8367b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 09:37:19 +02:00
Andreas Cadhalpun
95bd0f3a4b wavpack: use get_bits_long to read up to 32 bits
get_bits should not be used for more than 25 bits.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit f9883a669c3df05a5c453428e080298c6511a17e)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 09:37:03 +02:00
Andreas Cadhalpun
7293372959 s302m: fix arithmetic exception
If nb_samples is zero, the bit_rate calculation results in a division by
zero.

Since ff_get_buffer fails if frame->nb_samples is zero, this can be
fixed by moving the bit_rate calculation after that function call.

That also makes it possible to reuse the already calculated
frame->nb_samples value.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 04dfbc9441beed93984568c1547f1ed588122627)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 09:36:13 +02:00
Andreas Cadhalpun
2e1226a695 vc1dec: use get_bits_long and limit the read bits to 32
get_bits should not be used with more than 25 bits.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 1f1e0a2971b2a01f275bb5088c2e36166514be64)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 09:35:56 +02:00
Andreas Cadhalpun
f66d2bf949 mpegaudiodec: copy AVFloatDSPContext from first context to all contexts
This fixes a segfault when decoding multi-channel MP3onMP4 files.

This is similar to commit cb72230d for MPADSPContext.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 151dbe4579601a81662b4b366d0e10df3c00027a)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-07-19 09:35:30 +02:00
Michael Niedermayer
08337cca05 avcodec/vp8: Check buffer size in vp8_decode_frame_header()
avoids null pointer dereference
Fixes: signal_sigsegv_d5de40_964_vp80-00-comprehensive-010.ivf with memlimit of 1048576

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 599d746e07319dc792ed2e511b666fe482f1ff88)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:46 +02:00
Michael Niedermayer
9c655d2a57 avcodec/vp8: Fix null pointer dereference in ff_vp8_decode_free()
Fixes: signal_sigsegv_d5de23_967_vp80_00_comprehensive_010.ivf with memlimit 524288

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a84f0e8d8f293df3c535f9b893730a835bed6520)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:46 +02:00
Michael Niedermayer
f00f799833 avcodec/diracdec: Check for hpel_base allocation failure
Fixes null pointer dereference
Fixes: signal_sigsegv_b02a96_280_RL_420p_ffdirac.drc with memlimit of 67108864

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1c5b712c0a643a039d6f34269b4102de313a050a)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:46 +02:00
Michael Niedermayer
05684cee42 avcodec/rv34: Clear pointers in ff_rv34_decode_init_thread_copy()
Avoids leaving stale pointers
Fixes: signal_sigabrt_7ffff70eccc9_819_sabtriple.rm with memlimit 536870912

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:46 +02:00
Michael Niedermayer
73ebc4046e avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case
Fixes: b4b47bc2b3fb7ca710bfffe5aa969e37_signal_sigabrt_7ffff70eccc9_744_nc_sample2.avi with memlimit of 4194304

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f1a38264f20382731cf2cc75fdd98f4c9a84a626)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:46 +02:00
Michael Niedermayer
6e53134f98 avcodec/pthread_frame: check avctx on deallocation
Fixes null pointer dereferences
Fixes: af1a5a33e67e479f439239097bd0d4fd_signal_sigsegv_7ffff713351a_152_Dolby_Rain_Logo.pmp with memlimit of 8388608

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5d346feafa817c4fbc30f7ed0b93b2dad6cef15b)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:46 +02:00
Michael Niedermayer
237751eb25 avcodec/sanm: Reset sizes in destroy_buffers()
Fixes crash in 1288a2fe8e9ae6b00ca40e089d08ca65_signal_sigsegv_7ffff71426a7_354_accident.san with allocation limit 65536

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:46 +02:00
Michael Niedermayer
264eb0074f avcodec/alac: Clear pointers in allocate_buffers()
Fixes: 06a4edb39ad8a9883175f9bd428334a2_signal_sigsegv_7ffff713351a_706_mov__alac__ALAC_6ch.mov

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f7068bf277a37479aecde2832208d820682b35e6)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:46 +02:00
Anton Khirnov
7db809a373 bytestream2: set the reader to the end when reading more than available
This prevents possible infinite loops with the calling code along the
lines of while (bytestream2_get_bytes_left()) { ... }, where the reader
does not advance.

CC: libav-stable@libav.org
(cherry picked from commit 86eee85daddb682fa072c2e2657c90a514b855e3)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
0df814cf97 avcodec/utils: use a minimum 32pixel width in avcodec_align_dimensions2() for H.264
Fixes Assertion failure
Found-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ef6656b1e5bfbc7499013d3b38b093b6b2f31ec)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
88fa3243dd avcodec/mpegvideo: Clear pointers in ff_mpv_common_init()
This ensures that no stale pointers leak through on any path

Fixes: signal_sigsegv_c3097a_991_xtrem_e2_m64q15_a32sxx.3gp

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b160fc290cf49b516c5b6ee0730fd9da7fc623b1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Andreas Cadhalpun
c001472226 wmalosslessdec: reset frame->nb_samples on packet loss
Otherwise a frame with non-zero nb_samples but without any data can be
returned.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 42e7a5b3c704985c2c18970cc94a837b413df9d9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Andreas Cadhalpun
1ec0541ae0 wmalosslessdec: avoid reading 0 bits with get_bits
Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit f9020d514e9ed5043496a710b36daba1ab182e97)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
ac91bfe086 avcodec/rawenc: Use ff_alloc_packet() instead of ff_alloc_packet2()
the later is not optimal when the buffer size is well known at allocation time

This avoids a memcpy()
Overall 2.5% speedup with a random 1920x1080 video

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 47496eb97cff8130991313d1b7292613620d8592)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
bbcf6f5c62 avcodec/aacsbr: Assert that bs_num_env is positive
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2e13a45b1a9a69456631e582bbb06954d169eb55)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
e740506d31 avcodec/aacsbr: check that the element type matches before applying SBR
Fixes out of array access
Fixes: signal_sigsegv_3670fc0_2818_cov_2307326154_moon.mux

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 79a98294da6cd85f8c86b34764c5e0c43b09eea3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
65aac419e5 avcodec/h264_slice: Use w/h from the AVFrame instead of mb_w/h
Fixes out of array access
Fixes: asan_heap-oob_4d5bb0_682_cov_3124593265_Fraunhofer__a_driving_force_in_innovation__small.mp4

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 330863c9f19a23c500ba7901a23f1cc377b353bb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
James Zern
662714abbe vp9/update_prob: prevent out of bounds table read
the max value of the lookup in expanded form is:
(((1 << 7) - 1) << 1) - 65 + 1 + 64 = 254

add one entry of padding to inv_map_table[] to prevent out of bounds
access with non-conforming / fuzzed bitstreams

Signed-off-by: James Zern <jzern@google.com>
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e91f860ea74e11e9178500fe8794c47f57dbf48c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
0afb004d3c avcodec/h264_refs: discard mismatching references
Fixes inconsistency and out of array access
Fixes: asan_heap-oob_17301a3_2100_cov_3226131691_ff_add_pixels_clamped_mmx.m2ts

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4aa0de644a2de62f0bc3013a4533ab9283aa0a65)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
a9c3b588af avcodec/mjpegdec: Fix small picture upscale
Fixes out of array access

Fixes: asan_heap-oob_1dd60fd_267_cov_2954683513_5baad44ca4702949724234e35c5bb341.jpg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 84afc6b70d24fc0bf686e43138c96cf60a9445fe)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
f775a92054 avcodec/pngdec: Check values before updating context in decode_fctl_chunk()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b54ac8403bfea4e7fab0799ccfe728ba76959a38)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00
Michael Niedermayer
cccb06b095 avcodec/pngdec: Copy IHDR & plte state from last thread
Previously these chunks where parsed again for each frame with threads
but not without leading to a different path and the potential for
inconsistencies

This also removes a related special case from decode_ihdr_chunk()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f1ffa01dd3dad983481bf05ec47246e7ec0c8932)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-18 20:23:45 +02:00