Commit Graph

36328 Commits

Author SHA1 Message Date
Michael Niedermayer
494ddd377a vorbisdec: Error on bark_map_size equal to 0.
The value is used to calculate output LSP curve and a division by zero
and out of array accesses would occur.

CVE-2013-0894

CC: libav-stable@libav.org

Reported-by: Dale Curtis <dalecurtis@chromium.org>
Found-by: inferno@chromium.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 11dcecfcca)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-26 20:21:01 +01:00
Luca Barbato
37e99e384e vorbisdec: Add missing checks
Rate and order must not be 0 even if the specification does not say that
explicitly.
(cherry picked from commit 5b47c19bfd)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-26 20:21:01 +01:00
Justin Ruggles
73d6f4651e ac3dec: validate channel output mode against channel count
Damaged frames can lead to a mismatch, which can cause a segfault
due to using an incorrect channel mapping.

CC:libav-stable@libav.org
(cherry picked from commit d7c450436f)

Conflicts:

	libavcodec/ac3dec.c
2013-02-26 20:21:01 +01:00
Diego Biurrun
dc745b76aa doc: developer: Allow tabs in the vim configuration for Automake files
While we do not use Automake in libav, this allows our config to be
used more globally without introducing unwanted breakage.
(cherry picked from commit 040c565e51)

Conflicts:

	doc/developer.texi
2013-02-24 18:42:02 +01:00
Vicente Jimenez Aguilar
b6ae41e7f4 doc: filters: Correct BNF FILTER description
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit b5ad422bf4)
2013-02-24 18:42:02 +01:00
Reinhard Tartler
670128ff13 Prepare for 9.3 Release 2013-02-24 09:29:17 +01:00
Reinhard Tartler
a991c0673f update Changelog 2013-02-23 14:49:16 +01:00
Anton Khirnov
77493bfd97 cavs: initialize various context tables to 0
Avoids crashes with corrupted files.

CC:libav-stable@libav.org
(cherry picked from commit 4f3b058c84)

Conflicts:

	libavcodec/cavs.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:46:54 +01:00
Anton Khirnov
bb3f1cad17 4xm: check the return value of read_huffman_tables().
CC:libav-stable@libav.org
(cherry picked from commit 8097fc9a2d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:41:24 +01:00
Anton Khirnov
a6403a3b69 qtrle: add more checks against pixel_ptr being negative.
CC:libav-stable@libav.org
(cherry picked from commit e106592447)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:41:10 +01:00
Anton Khirnov
e2cf32ca5f mlpdec: do not try to allocate a zero-sized output buffer.
CC:libav-stable@libav.org
(cherry picked from commit 0dff40bfb9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:40:48 +01:00
Anton Khirnov
48fd461977 av_memcpy_backptr: avoid an infinite loop for back = 0
CC:libav-stable@libav.org
(cherry picked from commit f935aca44c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:40:30 +01:00
Anton Khirnov
612b28194b flicvideo: avoid an infinite loop in byte run compression
When byte_run is 0, pixel_countdown is not touched and the loop will run
forever.

CC:libav-stable@libav.org
(cherry picked from commit ddfe1246d9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:40:13 +01:00
Anton Khirnov
8bce2c60b8 lagarith: avoid infinite loop in lag_rac_refill()
range == 0 happens with corrupted files

CC:libav-stable@libav.org
(cherry picked from commit de6dfa2bb8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:40:04 +01:00
Anton Khirnov
488ffb8135 mov: use the format context for logging.
CC:libav-stable@libav.org
(cherry picked from commit 56daf10e03)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:39:52 +01:00
Anton Khirnov
b786ddc0f2 loco: check that there is data left after decoding a plane.
CC:libav-stable@libav.org
(cherry picked from commit 067432c1c9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:39:19 +01:00
Reinhard Tartler
88ae77cea4 update Changelog 2013-02-23 08:15:10 +01:00
Matt Wolenetz
bc9d341be8 x86: h264: Don't use redzone in AVX h264_deblock on Win64
This fixes crashes in chromium on win64 on machines with AVX
(crashes that apparently aren't triggered by fate).

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 311443f6c7)

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-02-22 23:48:35 +02:00
Vicente Jimenez Aguilar
6626a7df53 doc: Fix some obsolete references to av* tools as ff* tools
Signed-off-by: Diego Biurrun <diego@biurrun.de>

CC: libav-stable@libav.org
(cherry picked from commit 202b5f6deb)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-19 08:11:11 +01:00
Michael Niedermayer
ab434bf0d0 vqavideo: check chunk sizes before reading chunks
Fixes out of array writes

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ab6c9332bf)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 13093f9767)

CC: libav-stable@libav.org

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit f7d18deb73)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-19 08:10:24 +01:00
Michael Niedermayer
52b18c1fde roqvideodec: check dimensions validity
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3ae6104511)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fee26d352a)

CC: libav-stable@libav.org

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 488f87be87)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-19 08:10:03 +01:00
Michael Niedermayer
0b2b8ab979 qdm2: check array index before use, fix out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

(cherry picked from commit a7ee6281f7)

CC: libav-stable@libav.org

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 39bec05ed4)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-19 08:09:48 +01:00
Martin Storsjö
65bf4c9c45 mpegvideo: Do REBASE_PICTURE with byte pointers
REBASE_PICTURE (more specifically, this half of it) takes a Picture
pointer that points into one larger struct, finds the offset of
that Picture within the struct and finds the corresponding field
within another instance of a similar struct.

The pointer difference "pic - (Picture*)old_ctx" is a value given
in sizeof(Picture) units, and when applied back on
(Picture*)new_ctx gets multiplied back with sizeof(Picture). Many
compilers seem to optimize out this division/multiplication, but
not all do.

GCC 4.2 on OS X doesn't seem to remove the division/multiplication,
therefore the new pointer didn't turn out to point to exactly
the right place in the new struct since it only had sizeof(Picture)
granularity (and the Picture is not aligned on a sizeof(Picture)
boundary within the encompassing struct). This bug has been present
before 47318953d as well - with H264, pointers to h->ref_list[0][0]
pointed to 88 bytes before h->ref_list[0][0] after the rebase. After
shrinking Picture, the difference ended up even larger, making
writes via such a Picture pointer overwrite other fields at random
in H264Context, ending up in crashes later.

This fixes H264 multithreaded decoding on OS X with GCC 4.2.

Fixes Bug: #439

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a65f965c04)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-19 08:09:08 +01:00
Matti Hamalainen
d61c6ebccf svq3: unbreak decoding
a7d2861d36 removed necessary braces.
2013-02-18 02:49:45 +01:00
Luca Barbato
b9a287f237 build: make audio_frame_queue a stand-alone component
Encoders requiring it have the dependency expressed in the configure.
2013-02-17 22:38:37 +01:00
Diego Biurrun
6c62098827 build: The libopencore-amrnb encoder depends on audio_frame_queue
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit d0fd1dd559b8362bdbca3405f739e0cc202d62e7)
2013-02-16 23:41:31 +01:00
Diego Biurrun
a23d6ea1e4 libopencore-amrwb: Make AMR-WB ifdeffery more precise
The library might provide an encoder in the future, so it's better to
check for the presence of the decoder rather than just the library.

CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit ed89cad6aa04bbd692b3eb21c0e0bb56aca77130)
2013-02-16 23:41:31 +01:00
Diego Biurrun
e492818d89 libopencore-amr: Conditionally compile decoder and encoder bits
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit f6ad3ca159edcd2e48634bf39b9cd4a85af29cb1)
2013-02-16 23:41:31 +01:00
Diego Biurrun
1ca25bc387 libopencore-amrnb: cosmetics: Group all encoder-related code together
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 81ae57a269782fbfc9e11548d1e6605f13d65c9b)
2013-02-16 23:41:31 +01:00
Martin Storsjö
5310da7e83 arm: Fall back to runtime cpu feature detection via /proc/cpuinfo
On recent android versions, /proc/self/auxw is unreadable
(unless the process is running running under the shell uid or
in debuggable mode, which makes it hard to notice). See
http://b.android.com/43055 and
https://android-review.googlesource.com/51271 for more information
about the issue.

This makes sure e.g. neon optimizations are enabled at runtime in
android apps even when built in release mode, if configured to
use the runtime detection.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit ab8f1a6989)

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-02-14 10:39:23 +02:00
Derek Buitenhuis
4eede1fca2 doc/platform: Fix 10l typo
This error was somehow missed for months.

(cherry picked from commit 130cefc9dc)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
2013-02-13 21:35:10 -05:00
Kostya Shishkov
5479e08cc4 xxan: properly handle odd heights.
Duplicate the last one or two chroma lines.

Signed-off-by: Anton Khirnov <anton@khirnov.net>
CC:libav-stable@libav.org
(cherry picked from commit 685e6f2e39)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:18:57 +01:00
Anton Khirnov
b7765d00f9 msrledec: check bounds before constructing a possibly invalid pointer,
CC:libav-stable@libav.org
(cherry picked from commit 9bd6375d5f)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:18:57 +01:00
Kostya Shishkov
d0249f1c2e qtrle: fix the topmost line for 1bit
Signed-off-by: Anton Khirnov <anton@khirnov.net>
CC:libav-stable@libav.org
(cherry picked from commit 89f11f498b)

Conflicts:

	cmdutils.c
2013-02-07 07:18:57 +01:00
Anton Khirnov
1f8bf163e4 aasc: fix output for msrle compression.
The bottom line was invalid before.

CC:libav-stable@libav.org
(cherry picked from commit da7baaaae7)

Conflicts:

	cmdutils.c
2013-02-07 07:18:56 +01:00
Anton Khirnov
108ca6fad1 yop: check for input overreads.
CC:libav-stable@libav.org
(cherry picked from commit 8136f23444)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:18:56 +01:00
Anton Khirnov
7e35c50b81 yop: check that extradata is large enough.
CC:libav-stable@libav.org
(cherry picked from commit 06cf597c35)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:18:56 +01:00
Anton Khirnov
00bf66785f fraps: fix off-by one bug for version 1.
CC:libav-stable@libav.org
(cherry picked from commit 2cd4068071)

Conflicts:

	cmdutils.c
	libavcodec/fraps.c
2013-02-07 07:18:56 +01:00
Anton Khirnov
5bee21d724 vf_delogo: fix copying the input frame.
CC:libav-stable@libav.org
(cherry picked from commit 7194330bcd)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:18:56 +01:00
Anton Khirnov
e835ce83e2 vf_delogo: fix an uninitialized read.
CC:libav-stable@libav.org
(cherry picked from commit f81c37e40f)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:18:56 +01:00
Anton Khirnov
e0e4250421 dnxhdenc: fix invalid reads in dnxhd_mb_var_thread().
Do not assume that frame dimensions are mod16 (or that height is mod32
for interlaced).

CC:libav-stable@libav.org
(cherry picked from commit 69c25c9284)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:18:56 +01:00
Michael Karcher
901682ff78 atrac3: use correct loop variable in add_tonal_components()
Signed-off-by: Michael Karcher <ffmpeg@mkarcher.dialup.fu-berlin.de>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

CC:libav-stable@libav.org
(cherry picked from commit 0e3afacd4d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:18:56 +01:00
Tim Walker
5af78cc98d mlp: store the channel layout for each substream.
Also stop storing the channel arrangement in the header info, as it's unused outside of ff_mlp_read_major_sync.

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

CC:libav-stable@libav.org
(cherry picked from commit 99ccd2ba10)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:15:01 +01:00
Tim Walker
59f22ef91a mlpdec: TrueHD: use Libav channel order.
Fixes bug 208.

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

CC:libav-stable@libav.org
(cherry picked from commit 3ffcccb4fb)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:15:01 +01:00
Tim Walker
5393a5600d mlpdec: set the channel layout.
Fixes bug 401.

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

CC:libav-stable@libav.org
(cherry picked from commit 1fd2deedcc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:15:01 +01:00
Diego Biurrun
077beee465 x86: ac3: Fix HAVE_MMXEXT condition to only refer to external assembly
CC: libav-stable@libav.org
(cherry picked from commit 4f56e773fe)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-07 07:15:01 +01:00
Martin Storsjö
3d67f52f9d arm: vp8: Fix the plain-armv6 version of vp8_luma_dc_wht
This makes the plain-armv6 version use the same registers as the
armv6t2 version above.

This fixes fate-vp8 on plain-armv6 devices.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 2026eb1408)

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-28 22:57:07 +02:00
Reinhard Tartler
8d55c2441c Prepare for 9.2 Release 2013-01-24 12:02:57 +01:00
Justin Ruggles
d7e7e12abc lavr: call mix_function_init() in ff_audio_mix_set_matrix()
This is needed if a custom matrix is set by the user after opening the
AVAudioResampleContext because the matrix channel count can change if
different mixing coefficients are used.

CC:libav-stable@libav.org
(cherry picked from commit f07ef2d9c9)

Conflicts:

	libavresample/audio_mix.c
2013-01-24 12:00:08 +01:00
Martin Storsjö
a856623e87 rtpenc_chain: Use the original AVFormatContext for getting payload type
In ff_rtp_get_payload_type, the AVFormatContext is used for checking
whether the payload_type or rtpflags options are set. In rtpenc_chain,
the rtpctx struct is a newly initialized struct where no options have
been set yet, so no options can be fetched from there.

All muxers that internally chain rtp muxers have the "rtpflags" field
that allows passing such options on (which is how this worked before
8034130e06), so this works just as intended.

This makes it possible to produce H263 in RFC2190 format with chained
RTP muxers.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4a4a7e138c)

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-24 11:58:09 +02:00