Make sure the buffer size does not exceed the expected
RLE size.
Prevent an out of array bound write.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Bug-Id: CVE-2013-0852
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit a1f7844a11)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
This avoids a segfault in avconv_opt.c:opt_target when trying to
determine the norm.
(cherry picked from commit dc71f19588)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
This is safer and possibly fixes invalid reads on truncated data.
(cherry-picked from commit 541427ab4d)
CC:libav-stable@libav.org
Conflicts:
libavcodec/eamad.c
(cherry picked from commit f9204ec56a)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
The actual predictor value, set by the trellis code, never
was written back into the variable that was written into
the block header. This was accidentally removed in b304244b.
This significantly improves the audio quality of the trellis
case, which was plain broken since b304244b.
Encoding IMA QT with trellis still actually gives a slightly
worse quality than without trellis, since the trellis encoder
doesn't use the exact same way of rounding as in
adpcm_ima_qt_compress_sample and adpcm_ima_qt_expand_nibble.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0776e0ef6b)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This was broken in 095be4fb - samples+ch (for the previous
non-planar case) equals &samples_p[ch][0]. The confusion
probably stemmed from the IMA WAV case where it originally
was &samples[avctx->channels + ch], which was correctly
changed into &samples_p[ch][1].
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 3d79d0c93e)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
As indicated in the function documentation, the header MUST be
checked prior to calling it because no consistency check is done
there.
CC:libav-stable@libav.org
(cherry picked from commit f2f2e7627f)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Fixes an invalid read past the end of avpriv_mpa_freq_tab.
Fixes divide-by-zero due to sample_rate being set to 0.
Bug-Id: 705
CC:libav-stable@libav.org
Conflicts:
libavcodec/mpegaudiodecheader.c
Fixes various runtime failures with manually set flags that represent no
existing CPU
Fixes Ticket3653
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6310eb8010)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses for non default buffers with large strides
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4a30f08505)
(cherry picked from commit 9c9fc79d9237d28e33161cb2e75082d8ad232b2e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Embargoed-till: 2014-06-27 requested by researcher, but embargo broken by libav today (git and mailing list)
Fixes: LMS-2014-06-16-4
Found-by: "Don A. Bailey" <donb@securitymouse.com>
See: ccda51b14c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d6af26c55c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'ba8ab4e7ae016cf970b0f335a7933f2db53784bc':
avconv: do not send non-monotonous DTS to the muxers.
Conflicts:
ffmpeg_opt.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'e0fcad77618a0455ca9c2451ea0aa538597a08c0':
avconv: make -shortest work with streamcopy
Conflicts:
ffmpeg.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '9455a023be9f3915ccf5511a0b8fdb5b8897b2b6':
matroskaenc: do not write negative timestamps
Conflicts:
tests/ref/lavf/mkv
tests/ref/seek/lavf-mkv
No change to fate as ffmpeg was not affected by these bugs
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Hack partially based on a commit by Michael Niedermayer <michaelni@gmx.at>
Should fix (or work around) bug 458.
(cherry picked from commit 76d23f4031)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The code was missing 1 bit in the src format
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc145e576a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '696a74e81560889ef2fde76b045c5158a325a7a5':
matroska: add the Opus mapping
Conflicts:
libavformat/matroska.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'eb89e1b98d3676aac1287d97c633b527c1ff4ea4':
oggdec: add support for Opus in Ogg demuxing
Conflicts:
libavformat/oggparseopus.c
libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '05de372350f8720461d3cadba40836546f1bb95c':
apedec: do not buffer decoded samples over AVPackets
Conflicts:
libavcodec/apedec.c
See: 77d89a5b16
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '42a8d326978f6cf64fdc6deec8a3d91e5e1eaf07':
movdec: handle 0x7fff langcode as macintosh per the specs
See: e636aa1a56
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'cf7bb6ceb1da7682aa54989f83d81c67a5e6790d':
Revert "pthread: flush all threads on flush, not just the first one"
Merged-by: Michael Niedermayer <michaelni@gmx.at>
