When JPEG-LS support is disabled the decoder would feed the
data to the JPEG Lossless decode_*_scan function resulting in
faulty decoding.
CC: libav-stable@libav.org
(cherry picked from commit b25e49b187)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
MPV_decode_mb_internal needs 3 * 16 * linesize bytes of scratch buffer
For interlaced content, linesize is multiplied by two after the allocation
of the scratch buffer, and the dest_cr pointer ends past the buffer.
This patch makes ff_mpv_frame_size_alloc allocate a total of
(aligned line_size) * 2 * 16 * 3 bytes, which suffices even for the
interlaced case.
CC:libav-stable@libav.org
Signed-off-by: Jindrich Makovicka <makovick@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 259af1b923)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Fixes out of array read
Fixes ticket #2609.
Found-by: durandal_1707
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 695a766bff)
Prevents inconsistent state and null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 46cb61819d)
Conflicts:
libavcodec/gifdec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d23b8462b5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ee5e97c46)
Conflicts:
libavcodec/gifdec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad002e1a13)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes integer overflow and out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9dd04f6d8c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Solution based on rational.c, which uses isinf() too
This should fix compilation with msvc
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c25224737c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Should fix pgc warning
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc6f848dba)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes calling a random pointer
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7edb984dd0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes out of array accesses
The code prior to this commit could not have worked, thus obviously
was untested. I was also not able to find a valid sample that uses this
code.
This fix is thus only based on the description of the format
If someone has a sample that uses unpack_rle(), please mail me.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c1f2c4c3b4)
Conflicts:
libavcodec/vmdav.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0baa0a5a02)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8d3c99e825)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b39fd7d63648442c20671c3e4b357268ec5c49f2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes a few green artifacts at the top
Fixes rest of Ticket 2535
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c67bca2b5a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes green trash
Fixes part of Ticket2535
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bca50e5cd5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit adaa7743f5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '1ab4578c88dc3e1407da15471bd323ba40c3ebbb':
lavc: Fix assignments in if() when calling ff_af_queue_add
wav: Always seek to an even offset
swscale: Use alpha from the right row in yuva2rgba_c
Prepare for 9.6 Release
Conflicts:
RELEASE
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '0662967d2bbdbe90540eaa8c847f521fa4b75aab':
hls, segment: fix splitting for audio-only streams.
afifo: fix request_samples on the last frame in certain cases
id3v2: check for end of file while unescaping tags
indeo3: fix off by one in MV validity check
Conflicts:
libavformat/id3v2.c
libavformat/segment.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '46fd6e4f2ebbcd5a00847cdb05fe416466d06d37':
aac: check the maximum number of channels
update Changelog
riff: check for eof if chunk size and code are 0
oggdec: fix faulty cleanup prototype
Conflicts:
Changelog
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c8462bd17f35f435192281a2ea4ce8008a7398d3':
mp3dec: fallback to generic seeking when a TOC is not present
svq1dec: clip motion vectors to the frame size.
svq1dec: check that the reference frame has the same dimensions as the current one
qdm2: check that the FFT size is a power of 2
Conflicts:
libavcodec/svq1dec.c
libavformat/mp3dec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '95db1624ef98ccc4ba7ff70d50c4b4d0f8ffed54':
indeo3: switch parsing the header to bytestream2
indeo3: check motion vectors.
rv10: check that extradata is large enough
indeo3: fix data size check
Conflicts:
libavcodec/indeo3.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '8f558c3e101859aec9adcb4b4b270ae1ef8f88b5':
af_channelmap: sanity check input channel indices in all cases.
id3v2: pad the APIC packets as required by lavc.
lavf: make sure stream probe data gets freed.
dfa: check for invalid access in decode_wdlt().
Conflicts:
libavformat/id3v2.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '858864d350320dd807e349bda017026e61a47fe0':
xmv: check audio track parameters validity.
bmv: check for len being valid in bmv_decode_frame().
xmv: do not leak memory in the error paths in xmv_read_header()
matroska: pass the lace size to the matroska_parse_rm_audio
Conflicts:
libavformat/matroskadec.c
libavformat/xmv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'b90816d94b0b5c01f451ff98cfbf1d5ddec9c3c1':
matroska: Update the available size after lace parsing
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '05015d03da1d745bb92915b5cea92dec16af719f':
matroska: fix a corner case in ebml-lace parsing
avfiltergraph: check for sws opts being non-NULL before using them.
configure: Enable hwaccels without external dependencies by default.
oma: Validate sample rates
Conflicts:
libavfilter/avfiltergraph.c
libavfilter/graphparser.c
libavformat/oma.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '2e06758479650f6e2a8820c7105f2d193a701175':
Prepare for 9.5 Release
update Changelog
add missed CVE reference in 9.2 release
fate: fetch samples that match the release series
Conflicts:
Changelog
RELEASE
tests/Makefile
The rsync change is not merged
We need to maintain the ability to checkout and test old revissions
from master. This implies that the default sample repository has the
needed samples for both older and newer revissions. Thus there is no
need for a seperate one for each release.
Comments & Suggestions of course welcome
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Set interlaced to false if we don't have an interlaced frame
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0881cbf314)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
delta is in samples, not bytes. Also the sample format is not guaranteed
to be planar.
CC:libav-stable@libav.org
(cherry picked from commit 16a4a18db0)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
