Commit Graph

36254 Commits

Author SHA1 Message Date
Reinhard Tartler
d2d38531d6 update Changelog 2013-05-11 12:00:54 +02:00
Anton Khirnov
600bc1deba af_asyncts: fix offset calculation
delta is in samples, not bytes. Also the sample format is not guaranteed
to be planar.

CC:libav-stable@libav.org
(cherry picked from commit 16a4a18db0)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-11 12:00:54 +02:00
Luca Barbato
77a2f4cbcf oma: properly forward errors in oma_read_packet
Prevent spurios EIO on EOF.

CC:libav-stable@libav.org
(cherry picked from commit db9aee6ccf)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-11 12:00:54 +02:00
Anton Khirnov
7f8b55b560 indeo3: use unaligned reads on reference blocks.
They are not guaranteed to be aligned.
Fixes Bug 503.

CC:libav-stable@libav.org
(cherry picked from commit a97d8cc16e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-11 12:00:54 +02:00
Michael Niedermayer
1ab4578c88 lavc: Fix assignments in if() when calling ff_af_queue_add
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 1d7ffd06e4)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-05-08 19:05:21 +02:00
Luca Barbato
52ab9e8984 wav: Always seek to an even offset
RIFF chunks are aligned to 16bit according to the specification.

Bug-Id:500
CC:libav-stable@libav.org
(cherry picked from commit ac87eaf856)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-07 21:32:09 +02:00
Martin Storsjö
5772cbb343 swscale: Use alpha from the right row in yuva2rgba_c
Every other pixel had the alpha channel taken from the wrong
row.

This fixes bug 504.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 6e293d111f)

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-05-06 17:44:24 +03:00
Reinhard Tartler
a6f7fc8f3b Prepare for 9.6 Release 2013-05-04 10:54:29 +02:00
Anton Khirnov
0662967d2b hls, segment: fix splitting for audio-only streams.
CC:libav-stable@libav.org
(cherry picked from commit cf679b9476)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-04 10:53:18 +02:00
Anton Khirnov
ddeb6eeeb1 afifo: fix request_samples on the last frame in certain cases
The current code can fail to return the last frame if it contains
exactly the requested number of samples.

Fixes the join filter test, which previously did not include the last
408 samples in most cases.

CC:libav-stable@libav.org

Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 9bfc6e02ba)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Conflicts:
	libavfilter/fifo.c
	tests/fate/filter-audio.mak
2013-05-04 10:44:51 +02:00
Luca Barbato
5aac081110 id3v2: check for end of file while unescaping tags
Prevent an out of buffer bound write.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit af4cc2605c)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-05-03 19:22:07 +02:00
Anton Khirnov
d8745de6ae indeo3: fix off by one in MV validity check
CC:libav-stable@libav.org
(cherry picked from commit 95220be1fa)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-05-03 19:21:45 +02:00
Luca Barbato
46fd6e4f2e aac: check the maximum number of channels
Broken bitstreams could report a larger than specified number of
channels and cause outbound writes.

CC:libav-stable@libav.org
(cherry picked from commit a943a132f3)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-04-28 00:43:43 +02:00
Reinhard Tartler
6cad940989 update Changelog 2013-04-21 22:46:41 +02:00
Luca Barbato
c046890191 riff: check for eof if chunk size and code are 0
Prevent an infinite loop.

Inspired by a patch from Michael Niedermayer

CC: libav-stable@libav.org

Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 8e329dba37)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-21 22:46:41 +02:00
Luca Barbato
d70bad04de oggdec: fix faulty cleanup prototype
(cherry picked from commit fba8e5b608)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-21 18:51:25 +02:00
Michael Niedermayer
c8462bd17f mp3dec: fallback to generic seeking when a TOC is not present
Fixes seeking without a Xing/Info header.

CC: libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 505642f182)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-19 20:26:56 +02:00
Anton Khirnov
a3410b5a1f svq1dec: clip motion vectors to the frame size.
Fixes invalid reads for corrupted files.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit ecff5acb5a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:06:09 +02:00
Anton Khirnov
43039f9386 svq1dec: check that the reference frame has the same dimensions as the current one
They can be different if the last keyframe failed to decode correctly.
Fixes possible invalid reads in such a case.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit b1bb8fb860)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:05:55 +02:00
Anton Khirnov
d0c4d61c8b qdm2: check that the FFT size is a power of 2
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 34f87a5853)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:05:20 +02:00
Anton Khirnov
95db1624ef indeo3: switch parsing the header to bytestream2
Also add an additional sanity check to the alt_quant table.
Fixes invalid reads with corrupted files.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 66531d634e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:05:09 +02:00
Anton Khirnov
b0b33ce148 indeo3: check motion vectors.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit a0a872d073)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:04:53 +02:00
Anton Khirnov
fa4192e31f rv10: check that extradata is large enough
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org

(cherry picked from commit 01d376f598)

Conflicts:

	libavcodec/rv10.c
2013-04-18 22:03:32 +02:00
Anton Khirnov
4c412580fd indeo3: fix data size check
The data offsets are relative to the bistream header, which is 16 bytes
after the start of the data.
Fixes invalid reads with corrupted files.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 34e6af9e20)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 22:01:24 +02:00
Anton Khirnov
8f558c3e10 af_channelmap: sanity check input channel indices in all cases.
Fixes invalid reads from non-existing channels.

CC:libav-stable@libav.org
(cherry picked from commit aafed1175d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-18 21:59:28 +02:00
Anton Khirnov
5ebdfbe893 id3v2: pad the APIC packets as required by lavc.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
2013-04-08 22:25:27 +02:00
Anton Khirnov
094a35aeef lavf: make sure stream probe data gets freed.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit dbb1425811)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:48:10 +02:00
Anton Khirnov
62f9253781 dfa: check for invalid access in decode_wdlt().
This can happen when the number of skipped lines is not consistent with
the number of coded lines.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3623589edc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:47:56 +02:00
Anton Khirnov
858864d350 xmv: check audio track parameters validity.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d1016dccdc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:47:41 +02:00
Anton Khirnov
ba31b72f46 bmv: check for len being valid in bmv_decode_frame().
It can be 0 or -1 for invalid files, which may result in invalid memory
access.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b88f902125)

Conflicts:

	libavcodec/bmv.c
2013-04-06 11:47:01 +02:00
Anton Khirnov
7594868296 xmv: do not leak memory in the error paths in xmv_read_header()
CC: libav-stable@libav.org
(cherry picked from commit f8080bd13b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:40:20 +02:00
Luca Barbato
09e391abd8 matroska: pass the lace size to the matroska_parse_rm_audio
Each lace must be independent according to the specification.

Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.

Stricter check than fc43c19a56

CC: libav-stable@libav.org
(cherry picked from commit 25a80a931a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:40:05 +02:00
Dale Curtis
b90816d94b matroska: Update the available size after lace parsing
Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.

CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit fc43c19a56)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:39:39 +02:00
Luca Barbato
05015d03da matroska: fix a corner case in ebml-lace parsing
Make sure we notice when the lace_size[n] is a negative value.

CC: libav-stable@libav.org
(cherry picked from commit 8a96df7b70)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:39:28 +02:00
Anton Khirnov
34ecaf6e88 avfiltergraph: check for sws opts being non-NULL before using them.
Avoid snprintfing a NULL pointer.

CC: libav-stable@libav.org
(cherry picked from commit 6e3c13a559)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:39:11 +02:00
Diego Biurrun
8355383802 configure: Enable hwaccels without external dependencies by default.
(cherry picked from commit 2e2ec66741)

This is a fixup for f074618 to reenable auto-detection of dxva in the
build environment.

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-31 18:08:19 +02:00
Luca Barbato
c0f7df9662 oma: Validate sample rates
The sample rate index is 3 bits even if currently index 5, 6 and 7 are
not supported.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 0933fd1533)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-31 18:07:31 +02:00
Matt Wolenetz
fc6825ebb6 vp8: Fix pthread_cond and pthread_mutex leaks
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 1d6e618939)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-31 10:38:22 +02:00
Diego Biurrun
f074618a9f configure: Refactor dxva2api.h dependency declarations
(cherry picked from commit 215cdd35ef)

Fixes Bug: #482
2013-03-31 10:38:22 +02:00
Justin Ruggles
c6dce25967 flvdec: read audio sample size and channels metadata
This is needed in order for the FLV demuxer not to detect a codec change when
using the "flv_metadata" option.
(cherry picked from commit e46a2a7309)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-31 10:38:22 +02:00
Justin Ruggles
aba56c03b9 flvdec: use the correct audio codec id when parsing metadata
(cherry picked from commit c3d0157753)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-31 10:38:20 +02:00
Reinhard Tartler
2e06758479 Prepare for 9.5 Release 2013-03-31 10:38:19 +02:00
Reinhard Tartler
2dfe3a7b4d update Changelog 2013-03-23 14:45:10 +01:00
Reinhard Tartler
9d5f16f6fe add missed CVE reference in 9.2 release 2013-03-23 14:45:10 +01:00
Reinhard Tartler
dc794d7096 fate: fetch samples that match the release series
The idea is to ensure that 'make fate-rsync' always fetches the fate
samples that work with this release.
2013-03-23 14:45:01 +01:00
Kostya Shishkov
31a77177ff iff: validate CMAP palette size
Fixes CVE-2013-2495

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org
(cherry picked from commit 50c449ac24)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-18 20:23:37 +01:00
Loren Merritt
1e7f825a9b hqdn3d: Fix out of array read in LOWPASS
CC:libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 5b3c1aecb2)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-16 07:58:07 +01:00
Anton Khirnov
a0361a6c30 vf_gradfun: fix uninitialized variable use
CC:libav-stable@libav.org
(cherry picked from commit 887d31d455)

Conflicts:

	libavfilter/vf_gradfun.c
2013-03-16 07:58:07 +01:00
Anton Khirnov
c50241080d vf_hqdn3d: fix uninitialized variable use
CC:libav-stable@libav.org
(cherry picked from commit d0a863ac89)

Conflicts:

	libavfilter/vf_hqdn3d.c
2013-03-16 07:58:07 +01:00
Xi Wang
22c27e1f4a lzo: fix overflow checking in copy_backptr()
The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.

Remove the check.  Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.

CC: libav-stable@libav.org

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

(cherry picked from commit ca6c3f2c53)
2013-03-15 13:21:15 +01:00