Commit Graph

57728 Commits

Author SHA1 Message Date
Michael Niedermayer
c7a854af19 mvformat/movenc: fix IMX
fixes Ticket3351

Tested-by: carl
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 72d44f1583)
2014-03-13 07:41:32 +01:00
Michael Niedermayer
3e73bea05f avformat/avidec: Check required demuxing buffer sizes in guess_ni_flag()
Fixes Ticket3421

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5d75730c58)
2014-03-13 07:31:59 +01:00
Michael Niedermayer
3712b398e9 avidec: calculate missing bitrates from index
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 01000064c9)
2014-03-13 07:31:56 +01:00
Michael Niedermayer
4362a222e2 avformat/flvdec: discard inconsistent timestamps
Fixes Ticket3425

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dbc3e1109c)
2014-03-12 23:54:56 +01:00
Michael Niedermayer
a9753049b5 avcodec/vorbisdec: use the stored previous window type only when the actual previous is not known
Fixes Ticket3432

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5171ae781a)
2014-03-12 23:53:51 +01:00
Nicolas George
910fd77967 lavfi/af_atempo: clear references before returning error.
Once the frame has been given to ff_filter_frame(), it can
no longer be used, even on error.

Fix trac ticket #3430.
(cherry picked from commit bc6901c949)
2014-03-08 15:19:11 +01:00
Michael Niedermayer
d87ac93bca avformat/oggparsevorbis: dont use invalid granules
Fixes Ticket3437

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 12b97dd375)
2014-03-06 09:34:09 +01:00
Anton Khirnov
96603d5753 pthread_frame: flush all threads on flush, not just the first one
avcodec_flush_buffers() must release all internally held references
according to its documentation, for which all the threads need to be
flushed.

Bug-Id: vlc/9665
(cherry picked from commit d1f9563d50)

Conflicts:
	libavcodec/pthread_frame.c
2014-03-04 01:28:29 +01:00
Michael Niedermayer
c7c724056e avcodec/h264: clear chroma planes when flags gray is used
Fixes Ticket3397
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 72e6913140)
2014-02-24 09:45:48 +01:00
Michael Niedermayer
d3139c9733 update for 2.1.4
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
n2.1.4
2014-02-23 17:48:16 +01:00
Michael Niedermayer
0909b8acf8 avcodec/hevc: Simplify get_qPy_pred()
Fixes use of uninitialized memory
Fixes: 93728afd9aa074ba14a09bfd93a632fd-asan_static-oob_124a17d_1445_cov_1021181966_DBLK_D_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 64278039e5)

Conflicts:

	libavcodec/hevc_filter.c
2014-02-23 16:44:37 +01:00
Michael Niedermayer
2368d08e70 Merge commit 'e22ebd04bcab7f86548794556c28ecca46d9c2ac'
* commit 'e22ebd04bcab7f86548794556c28ecca46d9c2ac':
  hevc: Bound check cu_qp_delta

Conflicts:
	libavcodec/hevc.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a69dd1163b)

Conflicts:

	libavcodec/hevc.c
2014-02-23 16:42:21 +01:00
Michael Niedermayer
ea7ccf3748 avcodec/mpeg4videodec: Check for bitstream overread in decode_vol_header()
Fixes out of array read
Fixes: 08e48e9daae7d8f8ab6dbe3919e797e5-asan_heap-oob_157461c_5295_cov_1266798650_firefing.mpg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3edc3b1595)

Conflicts:

	libavcodec/mpeg4videodec.c
2014-02-23 16:36:01 +01:00
Michael Niedermayer
846a9c67ff avcodec/h264: use subsample factors of the used pixel format
Fixes out of array read
Fixes: 1cb91c36c4e55463f14aacb9bdf55b38-asan_heap-oob_106cbce_5617_cov_11212800_h264_mmx_chroma_intra_lf.mp4
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8c55ff3933)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 15:04:07 +01:00
Michael Niedermayer
c8d363a359 avformat/bink: Check return value of av_add_index_entry()
Fixes null pointer dereference
Fixes: cdbf15cbd0a27cee958dd0b8800e452e-signal_sigsegv_737991_2083_cov_317652874_LBSTART.BIK
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c57fc97e95)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 15:03:03 +01:00
Michael Niedermayer
d0d441b350 avcodec/h264: more completely check the loop filter parameters
Fixes out of array read
Fixes: caa65cc01655505705129b677189f036-signal_sigsegv_fdcc43_2681_cov_3043376737_PPH422I5_Panasonic_A.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 91253839e1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 15:02:14 +01:00
Michael Niedermayer
6341a7006d avcodec/alsdec: check predictor order against block length
Fixes out of array access
Fixes: abd3c041acbcb816be113455d138166b-asan_heap-oob_b11634_3707_cov_1707137151_als_05_2ch48k16b.mp4
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 18f94df8af)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 15:00:02 +01:00
Michael Niedermayer
7034e808f6 avcodec/hevc_ps: Use get_bits_long() in decode_vui()
Fix assertion failure
Fixes: a225222ef88a0f5b1e93e1d0432debc3-asan_static-oob_124a17d_1448_cov_77608227_DBLK_E_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b818637b84)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:58:13 +01:00
Michael Niedermayer
ce5d9a2b4b avcodec/hevc: make check for previous slice segment tighter
This ensures the previous one is matching the curent and not just any

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1a3ed056c5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:53:59 +01:00
Michael Niedermayer
aa672f5e6a avcodec/hevc: clear tab_slice_address of ctb on error.
This allows us to detect which areas have failed to decode

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a18f111582)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:53:23 +01:00
Michael Niedermayer
b959e6393e avcodec/hevc: hls_decode_entry: check that the previous slice segment is available before decoding the next
Fixes use of uninitialized memory
Fixes out of array read
Fixes assertion failure
Fixes part of cb307d24befbd109c6f054008d6777b5/asan_static-oob_124a175_1445_cov_2355279992_DBLK_D_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6ef57f4d9a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:51:46 +01:00
Michael Niedermayer
69f99f80d1 avcodec/hevc: clear tab_slice_address in hevc_frame_start()
Fixes inconsistencies
Fixes use of uninitilaized memory
Fixes part of  cb307d24befbd109c6f054008d6777b5/asan_static-oob_124a175_1445_cov_2355279992_DBLK_D_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56985d26d7)

Conflicts:

	libavcodec/hevc.c
2014-02-23 14:51:22 +01:00
Michael Niedermayer
e7b7e69416 avcodec/h264: update current_sps & sps->new only after the whole slice header decoder and init code finished
This avoids them being cleared before the full initialization finished

Fixes out of array read
Fixes: asan_heap-oob_f0c5e6_7071_cov_1605985132_mov_h264_aac__Demo_FlagOfOurFathers.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8a3b85f3a7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:49:47 +01:00
Michael Niedermayer
9330bcff9b avcodec/h264: Disallow pps_id changing between slices
Such changes are forbidden in H.264 and lead to race conditions

Fixes out of array read
Fixes: signal_sigsegv_f9796a_1613_cov_3114610371_FM1_BT_B.h264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e708424b70)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:49:37 +01:00
Michael Niedermayer
9fb364babd avcodec/aacdec: Fix pulse position checks in decode_pulses()
Fixes out of array read
Fixes: asan_static-oob_1efed25_1887_cov_2013541199_HeyYa_RA10_AAC_192K_30s.rm
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6e42ccb9db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:49:29 +01:00
Michael Niedermayer
d79419d0f9 avcodec/hevc: propagate error code from hls_coding_quadtree()
Fixes use of uninitialized memory
Fixes out of array read
Fixes: asan_static-oob_123cee5_2630_cov_1869071233_PICSIZE_A_Bossen_1.bin
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 96c4ba2392)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:48:30 +01:00
Michael Niedermayer
ebc490e744 avcodec/tiff: reset geotag_count in free_geotags()
Fixes null pointer dereference
Fixes: signal_sigsegv_19d922e_3688_cov_1577641655_aletrek_tiff.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a744064c41)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:48:07 +01:00
Michael Niedermayer
ab1c7113f9 avcodec/vc1: Check bfraction_lut_index
Fixes: out of array read
Fixes: asan_static-oob_1b40507_2849_SA10143.vc1
Fixes: asan_static-oob_1b40a15_2849_cov_1182297305_SA10143.vc1
Fixes: asan_static-oob_1b40f15_2849_cov_2159513432_SA10143.vc1
Fixes: asan_static-oob_1b40f15_2849_cov_3230311510_SA10143.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dcf5bfbdb6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:47:46 +01:00
Michael Niedermayer
10a30e4de5 avcodec/vc1: factor read_bfraction() out
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 388b4cf86e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:47:41 +01:00
Michael Niedermayer
9368b91834 avcodec/vc1dec: field pictures with direct mode MBs, followed by frame pictures are not supported
This case could occur when cuting and concatenating bitstreams

Fixes out of array read
Fixes: asan_heap-oob_1b33fdd_2849_cov_478905890_SA10143.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 85d51d8e32)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:43:52 +01:00
Michael Niedermayer
f22e88c177 avcodec/mjpegdec: pass into ff_mjpeg_decode_sos() and check bitmask size
Fixes: heap array overread
Fixes: asan_heap-oob_149b2bc_6577_m1.mxg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2884688bd5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:43:28 +01:00
Michael Niedermayer
e266fcf083 avformat/flac_picture: clear padding area
aviod use of uninitialized memory

Fixes: asan_heap-oob_1487fa4_4706_cov_364534849_cover_art.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 13aa82bbbb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:43:18 +01:00
Michael Niedermayer
c9b961748f avformat/flac_picture: allocate buffer padding for picture
Fixes: heap array overread
Fixes: asan_heap-oob_14876d9_4706_cov_815472558_cover_art.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fff2953163)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:43:07 +01:00
Michael Niedermayer
a94f367424 avcodec/snow: split block clipping checks
Fixes out of array read
Fixes: d4476f68ca1c1c57afbc45806f581963-asan_heap-oob_2266b27_8607_cov_4044577381_snow_chroma_bug.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 61d59703c9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer
18eac12c6d avcodec/ansi: fix integer overflow
Fixes out of array read
Fixes: 5f9698e86d92f19bb08d54ff0d57027f-signal_sigsegv_b30756_3795_cov_2693691257_ansi256.ans
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d42ec8433c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer
4cc18ee5da avcodec/msrle: use av_image_get_linesize() to calculate the linesize
Fixes out of array access
Fixes: 14a74a0a2dc67ede543f0e35d834fbbe-asan_heap-oob_49572c_556_cov_215466444_44_001_engine_room.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c919e1ca2e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer
f8985cb9d9 avcodec/utils: set AVFrame format unconditional
Fixes inconsistency and out of array accesses
Fixes: 10cdd7e63e7f66e3e66273939e0863dd-asan_heap-oob_1a4ff32_7078_cov_4056274555_mov_h264_aac__mp4box_frag.mp4
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e5c7229999)

Conflicts:

	libavcodec/utils.c
2014-02-23 14:28:10 +01:00
Michael Niedermayer
656770e2aa avcodec/hevc: make *ps_id unsigned
Fixes integer overflow
Fixes out of array accesses
Fixes 2f65e7dbd02a12f426a423bd7bf880b4-signal_sigsegv_127c952_2793_cov_2517424539_RPLM_A_qualcomm_4.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d1e6602665)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer
4a28a3ddc4 avformat/mpegtsenc: Check data array size in mpegts_write_pmt()
Prevents out of array writes

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 842b6c14bc)

Conflicts:

	libavformat/mpegtsenc.c
2014-02-23 14:28:10 +01:00
Michael Niedermayer
f91ef98c9d avcodec/wmalosslessdec: fix mclms_coeffs* array size
Fixes corruption of context
Fixes: 8835659dde6a4f7dcdf341de6a45c6c8-signal_sigsegv_1dce67b_4564_cov_2504444599_classical_22_16_1_14000_v3c_0_extend_0_29.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ec9578d54d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Justin Ruggles
a644272a4a samplefmt: avoid integer overflow in av_samples_get_buffer_size()
CC:libav-stable@libav.org
(cherry picked from commit 0e830094ad)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer
325feb8e0d avcodec/vc1: reset fcm/field_mode in non advanced header parsing
Fixes NULL pointer dereference
Fixes: signal_sigsegv_1ab8bf4_2847_cov_4254117347_SA10091.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b51e935477)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer
8c6a976fee avcodec/takdec: always check bits_per_raw_sample
Fixes out of array access
Fixes: asan_heap-oob_19c7a94_6470_cov_1453611734_luckynight-partial.tak
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f58eab1512)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Carl Eugen Hoyos
ac38860ec9 Add decoder dependency to the HEVC parser.
Fixes compilation with --disable-everything --enable-parser=hevc
(cherry picked from commit d4a6133ab8)
2014-02-19 16:59:21 +01:00
Martin Storsjö
d0e0329e9d rtpdec_asf: Copy the need_parsing field from the chained demuxer
This fixes playback of mp3 streams in rtp/asf. This used to work
until 950482bf, but mostly by coincidence.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 2aec9e228c)

Fixes ticket #3223
2014-01-27 15:45:10 +01:00
Alex Sukhanov
9ca79d2849 avformat/matroskadec: Fix start_time
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 251c96a70b)

Fixes ticket #3337.
2014-01-26 16:22:47 +01:00
Lukasz Marek
c5a2a65e1e lavf/libssh: fix seek with whence==SEEK_CUR
Signed-off-by: Lukasz Marek <lukasz.m.luki@gmail.com>
(cherry picked from commit e0d124a920)

Conflicts:

	libavformat/libssh.c
2014-01-22 01:36:31 +01:00
Michael Niedermayer
a8ed3685e1 avcodec/jpeg2000dec: fix error detection in pix_fmt_match()
Fixes out of array accesses with CODEC_FLAG_EMU_EDGE

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8001e9f7d1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:59:12 +01:00
Michael Niedermayer
32262ca7d7 avcodec/vmnc: Check that rectangles are within the picture
Prevents out of array accesses with CODEC_FLAG_EMU_EDGE

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6ba02602aa)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:59:06 +01:00
Michael Niedermayer
5f56e495ae avcodec/apedec: more checks for k
Fixes assertion failure
Fixes part of msan_uninit-mem_7fa0d8c8bd58_8417_sh3.ape
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d5128fce38)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:42:32 +01:00