Commit Graph

36418 Commits

Author SHA1 Message Date
Martin Storsjö
b4c479a82a vp3: Check the framerate for validity
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 6fc8226e29)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:25 +02:00
Martin Storsjö
9f883e75e6 cavsdec: Make sure a sequence header has been decoded before decoding pictures
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e90a6846c2)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/cavsdec.c
2013-10-04 03:26:24 +02:00
Martin Storsjö
e47543eda5 vocdec: Don't update codec parameters mid-stream
If we really want to support parameter changes, they need to be
signalled along with the AVPackets as parameter change side data,
not just changing the AVCodecContext parameters when a packet
is demuxed (since there may be other earlier packets yet undecoded).

Something similar was already done for the sample rate in 0883109b2,
but some parameters were left changeable.

This avoids having to recheck the channel count for validity for
each decoded frame in (ad)pcm decoders, unless the decoders
explicitly say that they accept parameter changes.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5bbfe193a0)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 23:31:38 +02:00
Martin Storsjö
153deed18b sierravmd: Do sanity checking of frame sizes
Limit the size to INT_MAX/2 (for simplicity) to be sure that
size + BYTES_PER_FRAME_RECORD won't overflow.

Also factorize other existing error return paths.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0ef1660a63)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 23:31:34 +02:00
Martin Storsjö
9eba02d5dd omadec: Properly check lengths before incrementing the position
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 342c43d154)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 23:31:22 +02:00
Martin Storsjö
557df77eab mpc8: Make sure the first stream exists before parsing the seek table
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 17d57848fc)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:36 +02:00
Martin Storsjö
f8a72f041c mpc8: Check the seek table size parsed from the bitstream
Limit the size to INT_MAX/2 (for simplicity) to be sure that
size + FF_INPUT_BUFFER_PADDING_SIZE won't overflow.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 459f2b393a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:34 +02:00
Michael Niedermayer
9e505065b5 zmbvdec: Check the buffer size for uncompressed data
Also don't pointlessly set the buffer size to 1 after copying
one packet.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0d61f26001)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:33 +02:00
Martin Storsjö
eba112b4e3 ape: Don't allow the seektable to be omitted
The seektable is required for filling in ape->frames[i].pos
further down.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 183b9d843a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:31 +02:00
Martin Storsjö
d411f07751 shorten: Break out of loop looking for fmt chunk if none is found
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit b26742cc30)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:29 +02:00
Martin Storsjö
8484351749 shorten: Use a checked bytestream reader for the wave header
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 49568851bf)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:27 +02:00
Martin Storsjö
01a58b439d smacker: Make sure we don't fill in huffman codes out of range
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0679cec6e8)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:25 +02:00
Martin Storsjö
47bb4d888e smacker: Avoid integer overflow when allocating packets
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 710b0e2702)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:24 +02:00
Martin Storsjö
057f655dc6 smacker: Don't return packets in unallocated streams
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8d928023f9)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:21 +02:00
Martin Storsjö
3bd0cd2677 dsicin: Add some basic sanity checks for fields read from the file
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 48d6556dd4)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:15 +02:00
Sean McGovern
4d073ddac9 Update Changelog
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-08 08:15:21 +02:00
Sean McGovern
007f3f4165 Prepare for 9.9 RELEASE
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-08 08:12:07 +02:00
Anton Khirnov
777bc81a91 lavf: fix the comparison in an overflow check
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 26f027fba1)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 12:09:58 +02:00
Luca Barbato
1e9e311e21 dv: Add a guard to not overread the ppcm array
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7ee191cab0)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/dv.c
2013-09-07 12:09:56 +02:00
Luca Barbato
0eb465f981 nuv: check ff_rtjpeg_decode_frame_yuv420 return value
CC: libav-stable@libav.org
(cherry picked from commit 85ac12587b)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/nuv.c
2013-09-07 12:09:06 +02:00
Martin Storsjö
b01e4d80c6 mpegvideo: Avoid 32-bit wrapping of linesize multiplications
This makes sure that linesize * start_y doesn't overflow, so that
emulated_edge_mc can get back the original value if needed.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a711a2cb47)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:26:28 +02:00
Michael Niedermayer
68c9904669 mjpegb: Detect changing number of planes in interlaced video
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit af11fa5409)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:26:14 +02:00
Martin Storsjö
790606cfe9 alac: Check that the channels fit at the given offset
The code tries to decode a number of channels at the
offset given by the ff_alac_channel_layout_offsets table.
Even if the number of channels decoded so far doesn't
exceed the total number of channels, we need to check that
we actually can decode that number of channels at this offset
as well.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 35cbc98b72)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:26:04 +02:00
Martin Storsjö
7b9bcd993c 4xm: Check that the read track value is non-negative
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d719981273)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/4xm.c
2013-09-07 10:25:48 +02:00
Martin Storsjö
aade60ab16 matroskadec: Check that .lang was allocated and set before reading it
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5bcd3ae5b1)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:18:59 +02:00
Martin Storsjö
3d91117df0 alac: Limit max_samples_per_frame
Otherwise buffer size calculations in allocate_buffers could
overflow later, making the code think a large enough buffer
actually was allocated.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f7c5883126)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:18:41 +02:00
Anton Khirnov
9486e98712 ape demuxer: check for EOF in potentially long loops
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry-picked from commit 488b2984fe)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:18:18 +02:00
Anton Khirnov
f3c7e604fa 4xm: check that bits per sample is strictly positive
Avoids a divide by zero.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit a7c1689ded)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:15:13 +02:00
Anton Khirnov
4cb3efc206 lavf: avoid integer overflow when estimating bitrate
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit df33a58e53)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:15:00 +02:00
Anton Khirnov
1e9d234c0c pictordec: pass correct context to avpriv_request_sample
Fixes invalid reads.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry-picked from commit fe9bb61f9a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:14:30 +02:00
Anton Khirnov
8dc4b2c92e pictordec: break out of both decoding loops when y drops below 0
Otherwise picmemset can get called with negative y, resulting in an
invalid write.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5f7aecde02)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:13:48 +02:00
Anton Khirnov
251b4655be vcr1: add sanity checks
Fixes invalid reads with corrupted files.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 8aba7968dd)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:10:09 +02:00
Luca Barbato
26605efed7 ac3: Return proper error codes
(cherry picked from commit b1f9cdc37f)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-27 17:28:33 +02:00
Luca Barbato
a32bbe54e4 ac3: Clean up the error paths
(cherry picked from commit 818d1f1a3e)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-27 17:28:29 +02:00
Luca Barbato
07bfb254c6 ac3: Do not clash with normal AVERROR
The parsing function return AVERROR and AAC_AC3_PARSE_ERROR values,
make sure they are not misunderstood.

(cherry picked from commit 6258d362b8)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-27 17:28:23 +02:00
Reimar Döffinger
cbc6ded5b7 ogg: Fix potential infinite discard loop
Seeking in certain broken files would cause ogg_read_timestamp
to fail because ogg_packet would go into a state where all packets
of stream 1 would be discarded until the end of the stream.

Bug-Id: 553
CC: libav-stable@libav.org

Signed-off-by: Jan Gerber <j@v2v.cc>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 9a27acae9e)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:58:13 +02:00
Luca Barbato
93fbabb60f dxa: Make sure the reference frame exists
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5ef7c84a93)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/dxa.c
2013-08-24 16:57:57 +02:00
Luca Barbato
a14ff5b256 h261: check the mtype index
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c59967fa7c)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/h261dec.c
2013-08-24 16:50:12 +02:00
Luca Barbato
7c30ea5006 segafilm: Error out on impossible packet size
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5268bd2900)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:47:57 +02:00
Luca Barbato
e2d32ad18e ogg: Always alloc the private context in vorbis_header
It is possible to have an initial broken header and then valid packets.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3562684db7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:47:48 +02:00
Luca Barbato
cea1769fb6 rtjpeg: Use init_get_bits8
CC:libav-stable@libav.org
(cherry picked from commit f13fe6020e)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:47:34 +02:00
Luca Barbato
082e3fd469 nuv: Reset the frame on resize
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:46:50 +02:00
Luca Barbato
747c320a19 nuv: Use av_fast_realloc
The decompressed buffer can be used after codec_reinit, so it must be
preserved.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2df0776c22)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:41:16 +02:00
Anton Khirnov
cf6a34b2a5 nuv: return meaningful error codes.
(cherry picked from commit 3344f5cb74)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:41:16 +02:00
Luca Barbato
6537f57782 nuv: Pad the lzo outbuf
And properly update the buf_size with the correct size.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 075dbc1855)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:37:10 +02:00
Luca Barbato
c92e37c207 nuv: Do not ignore lzo decompression failures
Update the fate reference since the last broken frame is not decoded
anymore.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit aae159a7cc)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:37:01 +02:00
Luca Barbato
dd923878e8 rtmp: Do not misuse memcmp
CC: libav-stable@libav.org
(cherry picked from commit 5718e3487b)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/rtmpproto.c
2013-08-24 16:21:24 +02:00
Luca Barbato
e897e0631a rtmp: rename data_size to size
(cherry picked from commit ba5393a609)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:20:33 +02:00
Luca Barbato
b26c9f4e52 vc1: check mb_height validity.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 43bacd5b7d)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:18:19 +02:00
Luca Barbato
937cedd7c0 vc1: check the source buffer in vc1_mc functions
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 090cd06311)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/vc1dec.c
2013-08-24 16:17:41 +02:00