* qatar/master: (34 commits)
h264: reset h->ref_count in case of errors in ff_h264_decode_ref_pic_list_reordering()
error_resilience: fix the check for missing references in ff_er_frame_end() for H264
4xm: prevent NULL dereference with invalid huffman table
4xmdemux: prevent use of uninitialized memory
4xm: clear FF_INPUT_BUFFER_PADDING_SIZE bytes in temporary buffers
ptx: check for out of bound reads
tiffdec: fix out of bound reads/writes
eacmv: check for out of bound reads
eacmv: fix potential pointer arithmetic overflows
adpcm: fix out of bound reads due to integer overflow
anm: prevent infinite loop
avsdemux: check for out of bound writes
avs: check for out of bound reads
avsdemux: check for corrupted data
AVOptions: refactor set_number/write_number
AVOptions: cosmetics, rename static av_set_number2() to write_number().
AVOptions: cosmetics, move and rename static av_set_number().
AVOptions: split av_set_string3 into opt type-specific functions
avidec: fix signed overflow in avi_sync()
mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions.
...
Conflicts:
Changelog
configure
libavcodec/ptx.c
libavcodec/ra144.c
libavcodec/vaapi_vc1.c
libavcodec/vc1.c
libavcodec/version.h
libavformat/4xm.c
libavformat/avidec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Keeping byte values read from the file as unsigned is consistent
with how they are subsequently used and avoids an undefined left
shift by 24 when bit 7 is set.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Audio and video are interleaved via stream cur_dts - no idea how
reliable this is.
It also cannot display the video properly - it is stored with
about 15 in a single JPEG frame, I cannot think of a reasonable
way to implement this.
Samples: http://samples.mplayerhq.hu/smv/
Format description: http://wiki.multimedia.cx/index.php?title=SMV
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
* qatar/master:
lavf: fix signed overflow in avformat_find_stream_info()
vp8: fix signed overflows
motion_est: fix some signed overflows
dca: fix signed overflow in shift
aacdec: fix undefined shifts
bink: Check for various out of bound writes
bink: Check for out of bound writes when building tree
put_bits: fix invalid shift by 32 in flush_put_bits()
Conflicts:
libavcodec/bink.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
On the first iteration through this code, last_dts is always
INT64_MIN (AV_NOPTS_VALUE) and the subtraction overflows in
an invalid manner. Although the result is only used if the
input values are valid, performing the subtraction is still
not allowed in a strict environment.
Signed-off-by: Mans Rullgard <mans@mansr.com>
* qatar/master: (24 commits)
mpegps: Use av_get_packet() instead of poorly emulating it.
motionpixels: decode only the 111 complete frames for fate
mpc8: Check out of bound bands limit
xan: Prevent NULL dereference with missing palette
xan: Check for out of bound reads in xan_huffman_decode()
xan: Fixed out of bound accesses in xan_unpack()
motionpixels: Prevent calling init_vlc() with invalid parameters
shorten: Fix out of bound writes in fix_bitshift()
dsicinav: Check for out of bounds writes
tiertexseqv: Check for out of bound reads
quickdraw: Check for out of bound reads
dsicinav: Check for out of bounds reads
motionpixels: Fix the size of workspace buffers
motionpixels: Clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffer
wmavoice: Check for corrupted extra data
wmavoice: Check for out of bound writes
xan: Prevent NULL dereferences with missing reference frame
bink: Prevent NULL dereferences with missing reference frame
wavpack: Reset internal state on corrupted blocks
wmapro: Validate the number of audio channels before using it
...
Conflicts:
libavcodec/h264.c
libavcodec/xan.c
tests/ref/fate/motionpixels
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
Fix 'heigth' vs. 'height' typos.
lavc/lavf: use unique private classes.
lavc: use designated initializers for av_codec_context_class
Conflicts:
libavdevice/fbdev.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
In case of av_new_packet() error, a correct return error code is raised,
the data memcpy is avoided, and pkt dts/pts are not assigned anymore
(since the defaults are good).
* qatar/master:
qcelpdec: cosmetics: do not add line break before opening bracket in 'for', 'while', 'if/else', and 'switch' statements.
qcelp: check output buffer size before decoding
qcelpdec: fix the return value of qcelp_decode_frame().
sipr: fix the output data size check and only calculate it once.
Synchronize various 4CCs and codec tags from FFmpeg.
qdm2: check output buffer size before decoding
Fix out of bound reads in the QDM2 decoder.
Check for out of bound writes in the QDM2 decoder.
ogg/celt: do not set sample_fmt in the demuxer
Conflicts:
libavcodec/avcodec.h
libavcodec/qdm2.c
libavformat/oggparsecelt.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>