Fixes not yet fixed parts of CVE-2011-3946.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Previously, it would not be read if refdist_flag was not set, however
according to the spec and the reference decoder, it should always be read.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
* qatar/master: (22 commits)
wma: Clip WMA1 and WMA2 frame length to 11 bits.
movenc: Don't require frame_size to be set for modes other than mov
doc: Update APIchanges with info on muxer flushing
movenc: Reindent a block
tools: Remove some unnecessary #undefs.
rv20: prevent calling ff_h263_decode_mba() with unset height/width
tools: K&R reformatting cosmetics
Ignore generated aviocat and ismindex tools.
build: Automatically include architecture-specific library Makefile snippets.
indeo5: prevent null pointer dereference on broken files
pktdumper: Use usleep instead of sleep
cosmetics: Remove some unnecessary block braces.
Drop unnecessary prefix from *sink* variable and struct names.
Add a tool for creating smooth streaming manifests
movdec: Calculate an average bit rate for fragmented streams, too
movenc: Write the sample rate instead of time scale in the stsd atom
movenc: Add a separate ismv/isma (smooth streaming) muxer
movenc: Allow the caller to decide on fragmentation
libavformat: Add a flag for muxers that support write_packet(NULL) for flushing
movenc: Add support for writing fragmented mov files
...
Conflicts:
Changelog
cmdutils.c
cmdutils.h
doc/APIchanges
ffmpeg.c
ffplay.c
libavfilter/Makefile
libavformat/Makefile
libavformat/avformat.h
libavformat/movenc.c
libavformat/movenc.h
libavformat/version.h
tools/graph2dot.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The MDCT buffers in the decoder are only sized for up to 11 bits. The
reverse engineered documentation for WMA1/2 headers say that that for
all samplerates above 32kHz 11 bits are used. 12 and 13 bit support
were added for WMAPro. I was unable to make any Microsoft tools generate
a test file at a samplerate above 48kHz.
Discovered by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This fixes a double release of the current frame on deinit.
Fixes CVE-2011-3934
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The index of the motion vector has to be checked before being
multiplied by 2 for the array index.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master: (23 commits)
aacenc: Fix identification padding when the bitstream is already aligned.
aacenc: Write correct length for long identification strings.
aud: remove unneeded field, audio_stream_index from context
aud: fix time stamp calculation for ADPCM IMA WS
aud: simplify header parsing
aud: set pts_wrap_bits to 64.
cosmetics: indentation
aud: support Westwood SND1 audio in AUD files.
adpcm_ima_ws: fix stereo decoding
avcodec: add a new codec_id for CRYO APC IMA ADPCM.
vqa: remove unused context fields, audio_samplerate and audio_bits
vqa: clean up audio header parsing
vqa: set time base to frame rate as coded in the header.
vqa: set packet duration.
vqa: use 1/sample_rate as the audio stream time base
vqa: set stream start_time to 0.
lavc: postpone the removal of AVCodecContext.request_channels.
lavf: postpone removing av_close_input_file().
lavc: postpone removing old audio encoding and decoding API
avplay: remove the -er option.
...
Conflicts:
Changelog
libavcodec/version.h
libavdevice/v4l.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Although it has been deprecated for a long time, its intended
replacement (request_channel_layout) is not actually used anywhere, so
request_channels is currently the only way to access that functionality.
Previously this was just checked in case of slice threads,
but frame threads do not support this either currently.
Making them support this is of course the long term goal
Fixes bug155
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
Remove ffmpeg.
aacenc: Simplify windowing
aacenc: Move saved overlap samples to the beginning of the same buffer as incoming samples.
aacenc: Deinterleave input samples before processing.
aacenc: Store channel count in AACEncContext.
aacenc: Move Q^3/4 calculation to it's own table
aacenc: Request normalized float samples instead of converting s16 samples to float.
aacpsy: Replace an if with FFMAX in LAME windowing.
aacenc: cosmetics, replace 'rd' with 'bits' in codebook_trellis_rate to make it more clear what is being calculated.
aacpsy: cosmetics, change a FIXME to a NOTE about subshort comparisons
aacenc: cosmetics: move init() and end() to the bottom of the file.
aacenc: aac_encode_init() cleanup
XWD encoder and decoder
vc1: don't read the interpfrm and bfraction elements for interlaced frames
mxfdec: fix memleak on mxf_read_close()
westwood: split the AUD and VQA demuxers into separate files.
Conflicts:
.gitignore
Changelog
Makefile
configure
doc/ffmpeg.texi
ffmpeg.c
libavcodec/Makefile
libavcodec/aacenc.c
libavcodec/allcodecs.c
libavcodec/avcodec.h
libavcodec/version.h
libavformat/Makefile
libavformat/img2.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The previous implementation assumed that a new picture would always
supersede the previous picture. Similarly, presentation segments
were assumed to pertain to the most-recently-read picture.
However, each presentation segment may refer to 0 or more pictures
by their ID. Picture IDs may repeat, and a repeated picture ID
indicates that the old picture for that ID is no longer needed
and may be discarded.
The new implementation allocates a buffer with one slot for each
possible picture ID (the picture ID is a 16-bit field) and
properly decodes presentation segments so that all relevant
pictures are output upon encountering a display segment.
Given that most PGS streams are unlikely to use more than a small
fraction of the available picture IDs, it would probably be better
to use a more memory-efficient data structure. I'm lazy though, so
I leave this to a more motivated individual.
I've tested the code with MKV files in VLC (a recent revision from
their git repo) and with HandBrake (a version that I hacked up to
use ffmpeg's PGS subtitle decoder).
Review-by: Hendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes memory corruption when seeking in broken streams.
a random mpeg4 in nut file was used to debug.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This matches the spec as well as the reference decoder, and fixes a bug
with interlaced frame decoding.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
* qatar/master: (25 commits)
riff: fix invalid av_freep() calls on EOF in ff_read_riff_info
pam: Fix a typo that broke writing and reading PAM files.
mxfdec: fix memleak on av_realloc failures
mxfdec: Do not parse slices or DeltaEntryArrays.
mxfdec: hybrid demuxing/seeking solution
mxfdec: Add Avid's essence element key.
mfxdec: Separate mxf_essence_container_uls for audio and video.
mxfdec: Compute packet offsets properly.
mxfdec: Use MaterialPackage - Track - TrackID instead of the system_item hack.
mxfdec: use av_dlog() for 'no corresponding source package found'
mxfdec: Make mxf->partitions sorted by offset.
mxfdec: parse ThisPartition
mxfdec: Speed up metadata and index parsing.
mxfdec: Make sure DataDefinition is consistent between material track and source track.
mxfdec: add EssenceContainer UL found in 0001GL00.MXF.A1.mxf_opatom.mxf
mxfdec: Add hack that adjusts the n_delta calculation when system items are present.
mxfdec: Parse IndexTableSegments and convert them into AVIndexEntry arrays.
mxfdec: Move FooterPartition to MXFContext and make sure it is never zero.
mxfdec: check return value of avio_seek
mxfdec: skip to end of structural sets
...
Conflicts:
configure
libavcodec/pnm.c
libavformat/mxfdec.c
libavformat/riff.c
libavformat/rtsp.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This was a regression that came in when I switched to using the
h.264 annex b filter all the time. As the filter modifies extradata,
its use violates the statelessness assumption that exists in the
'ffmpeg' command line tool, and maybe elsewhere. It assumes that
a docoder can be reinitalised and pointed to an existing stream and
get the same results.
For now, the only way to meet this requirement is to backup the
extradata.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
the written length was off by 2 causing aac decoders to fail with the data.
lucky the encoder was marked as experimental and not used much
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
rtpdec: Use our own SSRC in the SDES field when sending RRs
Finalize changelog for 0.8 Release
Prepare for 0.8 Release
threads: change the default for threads back to 1
threads: update slice_count and slice_offset from user context
aviocat: Remove useless includes
doc/APIChanges: fill in missing dates and hashes
Revert "avserver: fix build after the next bump."
mpegaudiodec: switch error detection check to AV_EF_BUFFER
lavf: rename fer option and document resulting (f_)err_detect options
lavc: rename err_filter option to err_detect and document it
mpegvideo: fix invalid memory access for small video dimensions
movenc: Reorder entries in the MOVIentry struct, for tigheter packing
rtsp: Remove extern declarations for variables that don't exist
aviocat: Flush the output before closing
Conflicts:
Changelog
RELEASE
libavcodec/mpegaudiodec.c
libavcodec/pthread.c
libavformat/options.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Using threaded decoding by default breaks backward compatibility if
AVHWAccel is used or if an appliction sets threadunsafe callbacks.
Avconv and avplay still use -threads auto if not specified.
When either video dimension is only one macroblock, subtractions
based on v_edge_pos and the macroblock size may be negative. In
that situation, an unsigned comparison isn't sufficent to test for
MV overruns, because a limit of (unsigned)-1 will let any other
value pass.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
That way all mix levels as exported by the parser
will have the same meaning.
Previously the 3bit center mix level for eac3 was
used to index in a 4 entry table leading to out of array reads.
this change removes the table and offsets the ac3 variable by 4
so it matches the meanings for eac3 except the reserved case.
The reserved case is then explicitly handled.
Idea-by: Justin Ruggles <justin.ruggles@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
Add a tool that uses avio to read and write, doing a plain copy of data
ARM: fix build with FFT enabled and MDCT disabled
lavf: force single-threaded decoding in avformat_find_stream_info
avidec: migrate last of lavf from FF_ER_* to AV_EF_*
avserver: fix build after the next bump.
Conflicts:
libavformat/Makefile
libavformat/avidec.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
mpeg12: check for available bits to avoid an infinite loop
fate: add some shorthands to run groups of tests
fate: Give some tests more sensible names.
cosmetics: Rename ffsink to avsink.
Conflicts:
avconv.c
cmdutils.c
cmdutils.h
ffmpeg.c
ffplay.c
tests/fate/audio.mak
tests/fate/demux.mak
tests/fate/dpcm.mak
tests/fate/image.mak
tests/fate/lossless-audio.mak
tests/fate/lossless-video.mak
tests/fate/microsoft.mak
tests/fate/pcm.mak
tests/fate/real.mak
tests/fate/screen.mak
tests/fate/video.mak
tests/fate/voice.mak
tests/fate/wma.mak
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This one was missed in the previous fraps fix, the
allocation is exactly the same in both cases.
Fixes fraps-v5 under valgrind.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
This is needed in case the get_buffer() callback doesnt set
width/height.
Ideally all decoders would make calls through some wraper
to the callbacks and that wraper would call ff_init_buffer_info()
But until thats done, the default reget buffer must call this
itself as it needs the values for the changed size check later.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
tta: cast output data pointer to the correct type
avconv: fix -frames for video encoders with delay.
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The same as av_fast_malloc but uses av_mallocz and keeps extra
always-0 padding.
This does not mean the memory will be 0-initialized after each call,
but actually only after each growth of the buffer.
However this makes sure that
a) all data anywhere in the buffer is always initialized
b) the padding is always 0
c) the user does not have to bother with adding the padding themselves
Fixes another valgrind warning about use of uninitialized data,
this time with fate-vsynth1-jpegls.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
This combination is quite odd and almost certainly a bug if
it happens.
Reviewed-by: Justin Ruggles <justin.ruggles@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
rv34: add NEON rv34_idct_add
rv34: 1-pass inter MB reconstruction
add SMJPEG muxer
avformat: split out common SMJPEG code
pictordec: Use bytestream2 functions
avconv: use avcodec_encode_audio2()
pcmenc: use AVCodec.encode2()
avcodec: bump minor version and add APIChanges for the new audio encoding API
avcodec: Add avcodec_encode_audio2() as replacement for avcodec_encode_audio()
avcodec: add a public function, avcodec_fill_audio_frame().
rv34: Intra 16x16 handling
rv34: Inter/intra MB code split
Conflicts:
Changelog
libavcodec/avcodec.h
libavcodec/pictordec.c
libavcodec/utils.c
libavcodec/version.h
libavcodec/x86/rv34dsp.asm
libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Overall almost 4% faster, idct_add down from 350 to 85 cycles, idct_dc_add
down from 83 to 30 cycles.
squash: rv34 idct rearrange partial register loads
This reworks the frame skipping code such that the reference
buffers are still updated according to the header.
However it also ensures that the current frame will not end
up in any reference buffer.
Also fixes a hang with frame-multithreading, probably because
get_buffer was already called and would have reset the progress,
however the frame could remain in framep due to the missing update
(or it could be assigned to next_framep and a skip_frame skip would
then write it into framep - there might be even more failure modes).
Sample might become available at samples/nsv/vp8.nsv
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
This is required by the spec and fixes video-1frag.ogg.48.ogg. (FPE)
Based on the debuging work of Oana Stratulat and ubitux.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This allows audio encoders to optionally take an AVFrame as input and write
encoded output to an AVPacket.
This also adds AVCodec.encode2() which will also be usable by video and
subtitle encoders once support is implemented in the public functions.
* qatar/master:
fate: split ADPCM and DPCM test references into separate files.
mov, mxfdec: Employ more meaningful return values.
lavc: Relax API strictness in avcodec_decode_audio3 with a custom get_buffer()
wavpack: fix clipping for 32-bit lossy mode
vb: Use bytestream2 functions
Conflicts:
libavcodec/utils.c
libavcodec/vb.c
libavformat/mxfdec.c
tests/fate/dpcm.mak
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Extract processing of intra 16x16 blocks from intra macroblock
processing.
Also implement a function performing inverse transform and block
reconstruction for DC-only blocks in 1 pass instead of 2.
Split inter/intra macroblock handling code. This will allow further
optimizations such as performing inverse transform and block reconstruction
in a single pass as well as specialize code.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
Do not fail audio decoding with avcodec_decode_audio3 if user has set a
custom get_buffer. Strictly speaking, this was never allowed by the API,
but it seems that some software packages did so anyways. In order to
unbreak applications (cf. http://bugs.debian.org/655890), this change
clarifies the API and overrides the custom get_buffer() with the defaults.
This change is inspired by a similar
commit (c3846e3eba) in FFmpeg.
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Reference decoder clips data before shifting it to final range and also
forces 32-bit lossy mode to be actually 24-bit lossy mode in order to be
able to perform proper clipping.
This is not a real error and memsetting always even when the
size did not change is overkill, but it still should be
an acceptable trade-off.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
* qatar/master:
sgidec: Use bytestream2 functions to prevent buffer overreads.
cosmetics: Move static and inline attributes to more standard places.
configure: provide libavfilter/version.h header to get_version()
swscale: change yuv2yuvX code to use cpuflag().
libx264: Don't leave max_b_frames as -1 if the user didn't set it
FATE: convert output to rgba for the targa tests which currently output pal8
fate: add missing reference files for targa tests in 9c2f9b0e2
FATE: enable the 2 remaining targa conformance suite tests
targa: add support for rgb555 palette
FATE: fix targa tests on big-endian systems
Conflicts:
libavcodec/sgidec.c
libavcodec/targa.c
libswscale/x86/output.asm
tests/fate/image.mak
Merged-by: Michael Niedermayer <michaelni@gmx.at>
At the very least this should fix warnings about unused static
functions if one or more of these is not defined.
However even compilation might be broken if the compiler does
not optimize the function away completely.
This actually happens in case of the AVX function, since the
function pointer is used in an assignment that is not under
an #if and thus probably only optimized away after the function
was already marked as used.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
