The function find_things() in configure is confused by component
registration calls as part of multiline macros defining combined
component registration. Coalesce those macros into one line to
work around the issue.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Signed-off-by: Martin Storsjö <martin@martin.st>
Comparing AVCodecContext.pix_fmt against the get_pixel_format() return
value has the side effect of calling the get_format() callback on each
slice. Users of the callback will probably handle hardware accelerator
initialization in the callback.
It does not use any of the mpegvideo infrastructure, just a few fields
from the context.
Fixes a segfault with the emu edge flag, since emu edge buffer is now
allocated as a part of the frame buffer allocation and cavs calls
ff_get_buffer() directly, it does not use mpegvideo buffer management.
Fixes a memleak of the last frame.
Do not overwrite linesize set by get_buffer().
The last frame in the FATE test is not decoded anymore, since the file
is cut and a part of it is missing.
The description as updated in 6e5c44b0f made it sound like it is
handled exactly like the pts, which it is not. Clarify that it
is the packet that triggered returning the frame instead of just
the last avpacket (in case of frame threading, it won't be the
dts of the last packet).
Signed-off-by: Martin Storsjö <martin@martin.st>
Using a frame count, as is done currently, does not work at all with
seeking. Instead, when the number of samples in the final frame has
been decoded, we check if only the 32-bit CRC is remaining. If so, we
assume that it is the final frame.
There is no longer a need to keep total_frames in TTAContext.
Sometimes the extradata has duplicate atoms, but that shouldn't prevent
decoding. Just ensure that it is at least 36 bytes as a sanity check.
CC: libav-stable@libav.org
Move some functions from dsputil. The idea is that videodsp contains
functions that are useful for a large and varied set of video decoders.
Currently, it contains emulated_edge_mc() and prefetch().
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The VC1 decoder uses edge_emu_buffer simultaneously for luma and chroma
and needs more space. That was not a problem before f1d8763a02
since the size for edge_emu_buffer was always calculated with 2 byte per
pixel since the linesize was not known.
Fixes occasionally fate errors in vc1_sa10143.
Since we can't know which stride a custom get_buffer() implementation is
going to use we have to allocate this scratch buffers after the linesize
is known. It was pretty safe for 8 bit per pixel pixel formats since we
always allocated memory for up to 16 bits per pixel. It broke hoever
with cmdutis.c's alloc_buffer() and high pixel bit depth since it
allocated larger edges than mpegvideo expected.
Fixes fuzzed sample nasa-8s2.ts_s244342.
It is not posible to call get_buffer during frame-mt codec
initialization. Libavformat might pass huge amounts of data as
extradata after parsing broken files. The 'extradata' for the fuzzed
sample sample_varPAR_s5374_r001-02.avi is 2.8M large and contains
multiple slices.
This requires to move the avcodec_default_free_buffers() call to
ff_MPV_common_end() since otherwise delayed pictures would get freed
during a size change.
Direct rendering capable decoders call get_buffer() which will set the
frame parameters.
Prevents frames with wrong parameters when a decoder outputs delayed
frames after a resolution or pixel format change.
Use this in VP8/H264-8bit loopfilter functions so they can be used if
there is no aligned stack (e.g. MSVC 32bit or ICC 10.x).
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This changes the LOCAL_ALIGNED definition on systems where
DECLARE_ALIGNED is used so it matches the manual alignment
case, ensuring invalid use will not compile on x86 only to
fail on everything else.
Signed-off-by: Mans Rullgard <mans@mansr.com>
The initial testing of the VFW binary codec was flawed,
likely due to an AviSynth bug.
Re-testing using VirtualDub and various professional editing
applications has revealed it should have been flipped.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Prevent an invalid write into coeffs[scantable[-1]] if zeros_left
itself was an invalid VLC code (and thus -1).
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This prevents undefined behaviour of signed left shift if the coded
value is larger than 2^31. Large values are most likely invalid and
caused errors or by feeding random.
Validate every use of svq3_get_ue_golomb() and changed the place there
the return value was compared with negative numbers. dirac.c was clean,
fixed rv30 and svq3.
Also remove a duplicate function in the MPEG-TS demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
This is consistent with usual ARM nomenclature as well as with the
VFPV3 and NEON symbols which both lack the ARM prefix.
Signed-off-by: Mans Rullgard <mans@mansr.com>
When initialising an FFTContext for a plain FFT, mdct_bits is not set
and can contain a garbage value. Since nbits is always valid and for
MDCT operation is mdct_bits - 2 checking this instead avoids using an
uninitialised value while having the same effect.
Signed-off-by: Mans Rullgard <mans@mansr.com>
When called from the v4l2 input device, pix_fmt can be
AV_PIX_FMT_NONE (for jpeg formats). Before 50ba57e0, this wasn't
an issue for avpicture_get_size, but after that commit, this
lead to crashes.
Signed-off-by: Martin Storsjö <martin@martin.st>
Avoid use of uninitialized and uncomputed linear least square models
during ff_lpc_calc_coefs() for FF_LPC_TYPE_CHOLESKY. Fixes running
make fate-flac-16-lpc-cholesk with valgrind --undef-value-errors=yes.
Start and end index are multiple of 2, therefore guaranteeing aligned access.
Also, this allows to generate 4 floats per loop, keeping the alignment all
along.
Timing:
- 32 bits: 326c -> 172c
- 64 bits: 323c -> 156c
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Swapping buffer indices allows saving one memcpy that accounts for 1% of the
runtime, according to oprofile.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Some combinations of OS, VirtualDub, and VBLE can accidentally
set the version to a value other than 1. Since no other version
of VBLE was ever released, simply warn about it.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
This does not seem to have an effect currently. Fate-h264 passes with
THREADS=1..16 and both threading types as before. It fixes however a
segfault during error resilience with my adaptive-frame-mt patchset.
A picture in use during error resilience gets realloced in another
thread in the fuzzed sample sample_varPAR.avi_s226019.
When the extra rear channel is present but unused, the
s->channel_order_tab[] value for that channel is -1. The QMF can be
skipped for the extra channel, and doing so avoids an out-of-array read
on s->samples_chanptr[].
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
This fixes segfault caused by 3d3cf6745e
when SingleChannelElement.ret was renamed to SingleChannelElement.ret_buf.
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
Dropping frames is undesirable but that is the only way by which the
decoder could return to low delay mode. Instead emit a warning and
continue with delayed frames.
Fixes a crash in fuzzed sample nasa-8s2.ts_s20033 caused by a larger
than expected has_b_frames value. Low delay keeps getting re-enabled
from a presumely broken SPS.
CC: libav-stable@libav.org
The qpel functions referenced here are not related to h264 and should
thus never have been under CONFIG_H264QPEL.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Signed-off-by: Diego Biurrun <diego@biurrun.de>
The only CPUs that have 3dnow and don't have mmxext are 12 years old.
Moreover, AMD has dropped 3dnow extensions from newer CPUs.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
The vertical offset mask 0x07 is suspicious.
v_off = FFMIN(data[2] & 0x07, CDG_BORDER_HEIGHT - 1);
Note that v_off is up to 11 (CDG_BORDER_HEIGHT - 1), the correct mask
should be 0x0F.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The sample count is decremented by the DECODE() macro and needs to be reset
in each loop iteration. Also, DECODE() increments the src pointer so that does
not need to be done separately.
s->mb_x is reset to zero a couple of lines above. It does not make
sense to call ff_er_add_slice() with 0 as endx when the end of the
macroblock row was reached. Fixes unnecessary and counterproductive
error resilience in https://bugzilla.libav.org/show_bug.cgi?id=394.
CC: libav-stable@libav.org
The third argument of OP_U8_ALTIVEC is evaluated at most once so
there is no need for a potentially unused temporary variable.
Signed-off-by: Mans Rullgard <mans@mansr.com>
The alternative to zeroing on init is setting the corrupted flag in
all cases where pal_pic is not fully written, at the cost of added
complexity.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
This fixes use of uninitialized values when the FLAC encoder uses the
2-level, 4-level, and 8-level search methods. Fixes failure of the
fate-flac-24-comp-8 test when run using valgrind.
This allows getting rid of redundant checks later in the codec
specific init functions.
Move the check to before actually initializing the decoder lib,
to simplify error handling.
This fixes a case of returning a value from a void function, present since
d40dab907.
Signed-off-by: Martin Storsjö <martin@martin.st>
Ensures the decoder did not set channel count to an insanely high value
during initialization, which could cause large memory usage when it tries to
get a buffer during decoding.
After a flush, don't average the output envelope and energy with
previous iterations.
Also start directly from the target values for the first iteration
at startup.
Signed-off-by: Martin Storsjö <martin@martin.st>
This was a leftover from previous iterations of the code, where the
refl coef arrays were statically allocated.
Signed-off-by: Martin Storsjö <martin@martin.st>
Replace INIT_AVX by INIT_XMM avx. Port the whole file to use cpuflag
based function declarations. Remove (now unused) cputype argument in
function declaration macros. Change function prototypes to have mmx2
instead of mmxext as suffix, since that's required by cpuflags.
This isn't too useful as a normal codec, but can be used in
voip style applications. The decoder updates the noise
generator parameters when a packet is given to it for decoding,
but if called with an empty packet, it generates more noise
according to the last parameters.
Signed-off-by: Martin Storsjö <martin@martin.st>
Subtracting a (positive) value from the address of an array violates
C99 section 6.5.6:
If both the pointer operand and the result point to elements of the
same array object, or one past the last element of the array object,
the evaluation shall not produce an overflow; otherwise, the
behavior is undefined.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Subtracting a (positive) value from the address of an array violates
C99 section 6.5.6:
If both the pointer operand and the result point to elements of the
same array object, or one past the last element of the array object,
the evaluation shall not produce an overflow; otherwise, the
behavior is undefined.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Avoids memleaks with audio when extended_data is nontrivial and the user
doesn't reset the frame.
Shouldn't have any effect for video for now, but might be useful in the
future.
This defines an AVCodec only if the corresponding CONFIG option is
enabled instead of using the broad CONFIG_ENCODERS/DECODERS.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Since it is declared as a string AVOption, the generic freeing code
attempts to free it on codec close. Some codecs might have already freed
it elsewhere (or didn't even allocate it with av_malloc() in the first
place), so this might lead to an invalid free.
There is no point in having this field accessible as an AVOption, so
remove it from the options table.
Fixes Bug 380.
CC: libav-stable@libav.org
Error out on init if a codec with CODEC_CAP_EXPERIMENTAL is requested
and strict_std_compliance is not FF_COMPLIANCE_EXPERIMENTAL.
Move the check from avconv to avcodec_open2() and return
AVERROR_EXPERIMENTAL accordingly.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Earlier versions of for instance of libavcodec expect this symbol to be
present in libavutil. This commit can be reverted after the next major
bump.
New shared builds of avcodec will link to the internal copy of the
table within that library, so those builds won't rely on this table
being present in avutil any longer either.
Signed-off-by: Martin Storsjö <martin@martin.st>
The loops were reading ahead one line, which could end up outside the
buffer for reference blocks at the edge of the picture. Removing
this readahead has no measurable performance impact.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Internally chroma planes have multiple of four height while allocated image
planes might be smaller if CODEC_FLAG_EMU_EDGE is set. Thus we should not
output more lines of chroma than frame can accept.
Also the decoder can be safely switched to direct rendering now.
aac_tablegen.h includes aac.h for the POW_SF2_ZERO definition, but
this also pulls in a raft of other headers, some of which are not
safe to use in code built with the host compiler.
Moving POW_SF2_ZERO to aac_tablegen_decl.h, where the declaration
of the array it relates to already resides, fixes the problems.
Signed-off-by: Mans Rullgard <mans@mansr.com>
This requires the makedef perl script by Derek, from the
c89-to-c99 repo. That scripts produces a .def file, listing
the symbols to be exported, based on the gcc version scripts
and the built object files.
To properly load non-function symbols from DLL files, the
data symbol declarations need to have the attribute
__declspec(dllimport) when building the calling code. (On mingw,
the linker can fix this up automatically, which is why it has not
been an issue so far. If this attribute is omitted, linking
actually succeeds, but reads from the table will not produce the
desired results at runtime.)
MSVC seems to manage to link DLLs (and run properly) even if
this attribute is present while building the library itself
(which normally isn't recommended) - other object files in the
same library manage to link to the symbol (with a small warning
at link time, like "warning LNK4049: locally defined symbol
_avpriv_mpa_bitrate_tab imported" - it doesn't seem to be possible
to squelch this warning), and the definition of the tables
themselves produce a warning that can be squelched ("warning C4273:
'avpriv_mpa_bitrate_tab' : inconsistent dll linkage, see previous
definition of 'avpriv_mpa_bitrate_tab').
In this setup, mingw isn't able to link object files that refer to
data symbols with __declspec(dllimport) without those symbols
actually being linked via a DLL (linking avcodec.dll ends up with
errors like "undefined reference to `__imp__avpriv_mpa_freq_tab'").
The dllimport declspec isn't needed at all in mingw, so we simply
choose not to declare it for other compilers than MSVC that requires
it. (If ICL support later requires it, the condition can be extended
later to include both of them.)
This also implies that code that is built to link to a certain
library as a DLL can't link to the same library as a static library.
Therefore, we only allow building either static or shared but not
both at the same time. (That is, static libraries as such can be,
and actually are, built - this is used for linking the test tools to
internal symbols in the libraries - but e.g. libavformat built to
link to libavcodec as a DLL cannot link statically to libavcodec.)
Also, linking to DLLs is slightly different from linking to shared
libraries on other platforms. DLLs use a thing called import
libraries, which is basically a stub library allowing the linker
to know which symbols exist in the DLL and what name the DLL will
have at runtime.
In mingw/gcc, the import library is usually named libfoo.dll.a,
which goes next to a static library named libfoo.a. This allows
gcc to pick the dynamic one, if available, from the normal -lfoo
switches, just as it does for libfoo.a vs libfoo.so on Unix. On
MSVC however, you need to literally specify the name of the import
library instead of the static library.
Signed-off-by: Martin Storsjö <martin@martin.st>
This table doesn't need to be shared with libavformat any longer.
Add mpeg12 to the name to make it less ambiguous, while renaming it.
Signed-off-by: Martin Storsjö <martin@martin.st>
The LAME API documentation for the required buffer size refers to the size for
a single encode call. However, we store multiple frames in the same output
buffer but only read 1 frame at a time out of it. As a result, the buffer size
given in lame_encode_buffer() is actually smaller than what it should be.
Since we do not know how many frames it will end up buffering, it is best to
just reallocate if needed.
Bitrate calculation is off since the bluray spec always specifies
an even number of coded channels. This was honored in the decoder,
but not for bitrate calculation.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This fixes a segfault with samples that I have (both of them MPEG-TS). Looks like
avctx->codec is not being set during parsing.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
Fixes:
libavcodec/svq3.c:661:9: warning: passing argument 2 of 'svq3_decode_block' from incompatible pointer type
libavcodec/svq3.c:208:19: note: expected 'DCTELEM *' but argument is of type 'DCTELEM (*)[32]'
Signed-off-by: Mans Rullgard <mans@mansr.com>
The existing code is not in the right place and it should cover both
interlaced frame and field pictures.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
This is required due to the way VC-1 handles chroma pull-back which may end
up causing negative chroma MV for zero luma MV. Edge emulation needs to be
invoked in such cases.
This only affects vertical component of chroma motion vector.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Interlaced field pictures can have one or two reference pictures, signaled
by NUMREF syntax element. For single reference pictures, reference picture
is determined by REFFIELD syntax element.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
GCC cannot proof that c->mc_frame_counter is always >- 0, changing the
type from int to unsigned fixes following warning:
libavcodec/a64multienc.c: In function ‘a64multi_encode_frame’:
libavcodec/a64multienc.c:342:17: warning: ‘buf’ may be used uninitialized in this function[-Wuninitialized]
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
Some invocations include a verb in the log message, others do not. Yet
av_log_missing_feature expects callers to provide a verb. Change the
function to include a verb instead and update the callers accordingly.
The result is a more natural function API and correct English in the
function invocations.
The vec_splat() intrinsic requires a constant argument for the
element number, and the code relies on the compiler unrolling
the loop to provide this. Manually unrolling the loop avoids
this reliance and works with all compilers.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Instead of using an evil VLA, fall back to C version when edge
emulation is needed. MPEG4 GMC is a rarely used fringe feature
so the speed loss is an acceptable cost for safer code.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Discontinuous transmission is an addition to VAD/VBR operation, that
allows to greatly reduce bitrate for silent chunks or stationary
noises.
Signed-off-by: Martin Storsjö <martin@martin.st>
The variable is copied to subsequent threads at the same time, so this
may cause wrong ref_count[] values to be copied to subsequent threads.
This bug was found using TSAN.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
AVFrame.extended_data has to reset to the AVFrame.data of the current
thread context after copying the frame contents.
Fixes crashes with frame-threading after 2bc0de3858.
Speex detects non-speech periods and encodes them with just enough bits
to reproduce the background noise, aka ``comfort noise generation''.
Signed-off-by: Martin Storsjö <martin@martin.st>
All our ARM asm preserves alignment so setting this attribute
in a common location is simpler. This removes numerous warnings
when linking with armcc.
Signed-off-by: Mans Rullgard <mans@mansr.com>
If there is an error during frame parsing, but AVCodecContext.channels was
changed and AC3DecodeContext.out_channels was set previously, the two may not
match.
Fixes CVE-2012-2802
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
When decode_nal_units() previously encountered a NAL_END_SEQUENCE,
and there are some junk bytes left in the input buffer, but no start codes,
buf_index gets stuck 3 bytes before the end of the buffer.
This can trigger an infinite loop in the caller code, eg. in
try_decode_trame(), as avcodec_decode_video() then keeps returning zeroes,
with 3 bytes of the input packet still available.
With this change, the remaining bytes are skipped so the whole packet gets
consumed.
CC:libav-stable@libav.org
Signed-off-by: Jindřich Makovička <makovick@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The decode function assumes that the video will have those dimensions.
Fixes CVE-2012-2801
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Fixes a part of CVE-2012-2795
CC:libav-stable@libav.org
Based on a patch by Michael Niedermayer <michaelni@gmx.at>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Fixes a part of CVE-2012-2795
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Fixes a part of CVE-2012-2795
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents writing into a too small array if some parameters changed
without the tile being reallocated.
Based on a patch by Michael Niedermayer <michaelni@gmx.at>
Fixes CVE-2012-2800
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
This prevents writing into a too small array if some parameters changed
without the tile being reallocated.
Fixes CVE-2012-2794
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents decoding happening on a half initialized context.
Fixes CVE-2012-2779
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Our decoder does not support changing w/h.
Fixes CVE-2012-2777 and CVE-2012-2784.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The value should be always 3, as it follows from the specification.
Fix a stack buffer overflow in exponents_from_scale_factors as reported
by asan. Thanks to Dale Curtis for the sample vector.
This way we can directly remap channels from Opus' channel order to
libav's internal channel order, instead of mapping channels from
Opus' order to Vorbis' order then to libav's order.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Do not use rlelen field for buffer size in init_get_bits, it is
only the size of the data for the first field.
Since it is not reliable, just use the size of the whole buffer.
Additional comments add removal of unused rlelen variable by
Reimar Döffinger.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This avoids using the global_quality field and QSCALE flag for
passing the VBR modes, since the value range of the global_quality
field doesn't really map cleanly to this codec's VBR modes.
Signed-off-by: Martin Storsjö <martin@martin.st>
These modes were not originally exposed by the library at all.
In practice, only a few of them work for each sample rate/profile
combination, and they don't work at all for the more uncommon
sample rates.
Signed-off-by: Martin Storsjö <martin@martin.st>
Not all applications (e.g. MPlayer) set block_align, and
when using a different demuxer it might not even be
easily available.
So fall back to selecting mode based on bit rate as before
if block_align has not useful value.
It can't be worse than failing to decode completely.
(cherry picked from commit 1d0d63052b)
CC: libav-stable@libav.org
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Inline functions declared without extern do not provide an external
definition in standard C99. This code only works because most
compilers do not implement the inline semantics correctly. With a
stricter compiler, linking fails with unresolved references to these
functions.
Declaring the functions extern inline works correctly with some
compilers while some others still fail to create external definitions.
For maximum portability, create a static inline version with an
externally visible wrapper for ff_get_mb_score. ff_epzs_motion_search
is so large that no sane compiler inlines it anyway, so there the
inline keyword can simply be dropped with no effect.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Adds a flag context_reinit to MpegEncContext to relieable keep track
of frame parameter changes which require a context reinitialization.
This is required for broken inputs which change the frame size but
error out before the context can be reinitialized.
This is mainly required for frame parameter changes during frame based
multithreading but single threaded usage profits too from avoiding
ff_MPV_common_end()/ff_MPV_common_init() cycles.
ALS spec:
11.6.3.1.1 Quantization and encoding of parcor coefficients
...
In all cases the resulting quantized values ak are restricted to the range [-64,63].
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
Fixes out of array write in quant_cof.
Also make sure no invalid opt_order stays in the context.
Fixes CVE-2012-2775
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
Values that fail this check will cause failure of decode_rice()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
These arguments are either constants or copies of MpegEncContext
fields just as easily accessed within the function.
Signed-off-by: Mans Rullgard <mans@mansr.com>
These functions do not benefit from being inlined. They are large,
and there are no opportunities for constant propagation.
Signed-off-by: Mans Rullgard <mans@mansr.com>
In both usages of FASTDIV the denominator might be 1.
Using a branch could make the function slower than using a normal
division.
Both denominator and numerator can be multiplied by 2 safely and
using shifts is faster than using a branch.
For some reason add_hfyu_median_prediction_cmov is only selected
on 3Dnow-capable CPUs, even though it uses no 3Dnow instructions.
This patch allows it to be selected on any cpu with cmov with the
possibility of being overridden by the mmxext version.
Signed-off-by: Mans Rullgard <mans@mansr.com>
It calculates the sum of power of two series, which can be done in one step.
Suggested by Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
That division can be replaced with a comparison:
((c->value - c->low) << 1) + 1 >= range
By expanding 'range' definition and simplifying this inequation we obtain
the final expression.
Suggested by Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
Prevents dangling pointers and makes access after free more obvious.
Setting AVFrame.qscale_table to NULL is required for successfully
allocating a previously freed Picture with ff_alloc_picture().
It is possible in various error paths as well as gap handling
that this has already been allocated. It is not clear why that
would be a problem with the current code, thus disable the
assert to avoid a common assert failure when asserts are enabled.
Signed-off-by: Martin Storsjö <martin@martin.st>
The data in coded_frame isn't allocated using get_buffer, but
is copied from the input frame to the encoder, so we should
not try to free it ourselves.
This fixes an assert failure when running in debug mode.
Signed-off-by: Martin Storsjö <martin@martin.st>
Previously, the put_bits call writing the value wrote a value
larger than the number of bits specified, failing asserts
in debug mode. There was no actual bitstream writer corruption,
since the overwritten bit already always was set to 1.
Signed-off-by: Martin Storsjö <martin@martin.st>
Previously, the value given to put_bits was 10 bits long for positive
predictors, even though 9 bits were to be written. The extra bit could
in some cases overwrite existing bits in the bitstream writer cache.
This fixes a failed assert in put_bits.h, when running a version
built with -DDEBUG.
The fate test result gets slightly improved, thanks to getting rid
of the overwritten bits in the bitstream writer cache.
Signed-off-by: Martin Storsjö <martin@martin.st>
This way it won't interfere with WMV9 initialisation inside MSS2 decoder and
avplay will play it fine.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
Also, align the mangled RGB planes, which is required for the
SIMD versions of dsputils' median predict.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The optimized dct_quantize template functions reference optimized
fdct symbols, so these functions must only be enabled if the relevant
optimizations have been enabled by configure.
Using the malloc variant avoids pointless memcpy on size
increase and simplifies handling allocation failure.
Also change code to ensure that allocation, bswap and bitstream
reader all use the same size, even when the packet size is odd
for example.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
This fixes building with DEBUG defined after the function was made
static and the prototype removed in d7f9786cbc.
Signed-off-by: Martin Storsjö <martin@martin.st>
This is a preparatory step for the MSS2 decoder which needs to use
the WMV9 decoder to decode some kinds of frames.
From the patch by Alberto Delmás <adelmas@gmail.com>
This reverts commit 484a337cd7.
These functions were used in f8bed30 "VC1: merge idct8x8, coeff
adjustments and put_pixels" which was reverted in 18b6a69.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Instead, use it on the first member, since by definition, if
any member is aligned, the whole struct must be, in order to
maintain that alignment.
Fixes compilation with some finicky compilers.
Idea for fix from Måns Rullgård.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
