This prevents future frames from using half initialized/inconsistent
structures
Fixes assertion failure
Fixes Ticket2897
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
lavc: mark deprecated AVCodec.max_lowres for removal on next bump
Conflicts:
libavcodec/avcodec.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Currently the code passes some nonsense values as
references instead, causing corruption with NVidia's
and assertion failures with Mesa's implementation.
For non-corrupted input this mostly happens in
interlaced bitstreams, e.g.
http://samples.mplayerhq.hu/V-codecs/WMV9/interlaced/480i30__codec_WVC1__mode_2__framerate_29.970__type_2__preproc_17.wmv.
The != VDP_INVALID handle assert does not trigger
(and probably is quite nonsense) because the frames
are initialized to 0.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
* commit 'ff07ec143ebd3833fd5a3f4b6c00474ac523a31f':
pcx: Return an error on broken palette if err_detect is set to 'explode'
Conflicts:
libavcodec/pcx.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'd1d99e3befea5d411ac3aae72dbdecce94f8b547':
pcx: Check the packet size before assuming it fits a palette
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'fc739b3eefa0b58d64e7661621da94a94dbc8a82':
xan: Only read within the data that actually was initialized
Conflicts:
libavcodec/xan.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '30db94dc399f6e4ef8905049d9b740556f0fce47':
xan: Use bytestream2 to limit reading to within the buffer
Conflicts:
libavcodec/xan.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '9fb0de86b49e9fb0709a8ad1e1875e35da841887':
pcx: Consume the whole packet if giving up due to missing palette
Conflicts:
libavcodec/pcx.c
See: b4e516e30e7004a0454a9009080c4de38987189a
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '59480abce7e4238e22b3a4a904a9fe6abf4e4188':
alac: Do bounds checking of lpc_order read from the bitstream
See: fd4f4923cce6a2cbf4f48640b4ac706e614a1594
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This fixes reads out of bounds.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
We read 2 bytes for 15 out of 16 pixels, therefore we need to
have at least 30 bytes, not 16.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
Decoded data is always written in pairs within this decoder.
This fixes writes out of bounds.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
Previously, we returned 0, meaning successful decoding but 0
bytes consumed, leading to an infinite loop.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
If the input buffer contains more data after the deflate stream,
the loop previously left running infinitely, with inflate returning
Z_STREAM_END.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
In lpc_prediction(), we write up to array element 'lpc_order' in
an array allocated to hold 'max_samples_per_frame' elements.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
The le argument is passed so the function has the same prototype as the
other similar functions. It is otherwise unused
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This allows supporting files for which the image stride is smaller than
the max. block size + number of subpel mc taps, e.g. a 64x64 VP9 file
or a 16x16 VP8 file with -fflags +emu_edge.
