20 Commits

Author SHA1 Message Date
Michael Niedermayer
be90f0279d Merge commit '43c0a87279e717c1384314c6da7155c306ee7c60' into release/0.10
* commit '43c0a87279e717c1384314c6da7155c306ee7c60':
  qdm2: check that the FFT size is a power of 2
  indeo3: switch parsing the header to bytestream2
  indeo3: check motion vectors.
  rv10: check that extradata is large enough
  indeo3: fix data size check
  lavf: make sure stream probe data gets freed.
  dfa: check for invalid access in decode_wdlt().
  xmv: check audio track parameters validity.
  bmv: check for len being valid in bmv_decode_frame().
  xmv: do not leak memory in the error paths in xmv_read_header()
  avfiltergraph: check for sws opts being non-NULL before using them.
  oma: Validate sample rates
  Prepare for 0.8.7 Release

Conflicts:
	RELEASE
	libavcodec/indeo3.c
	libavfilter/avfiltergraph.c
	libavformat/utils.c
	libavformat/xmv.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2013-07-29 02:35:24 +02:00
Anton Khirnov
4c7f40c6df dfa: check for invalid access in decode_wdlt().
This can happen when the number of skipped lines is not consistent with
the number of coded lines.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3623589edc7b1257bb45aa9e52c9631e133f22b6)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-24 21:01:14 +02:00
Michael Niedermayer
fe8243d7a9 Merge commit 'c5ec1908597824e93bbe20137ac9662f84f3cb07' into release/0.10
* commit 'c5ec1908597824e93bbe20137ac9662f84f3cb07':
  indeo: check for invalid motion vectors
  indeo: clear allocated band buffers
  indeo: track tile macroblock size
  factor out common decoding code for Indeo 4 and Indeo 5
  indeo: check custom Huffman tables for errors
  dfa: improve boundary checks in decode_dds1()
  dfa: use more meaningful return codes
  dfa: add some checks to ensure that decoder won't write past frame end
  dfa: convert to bytestream2 API
  dfa: check that the caller set width/height properly.
  avsdec: Set dimensions instead of relying on the demuxer.
  ac3dec: ensure get_buffer() gets a buffer for the correct number of channels

Conflicts:
	libavcodec/avs.c
	libavcodec/dfa.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2012-10-25 16:17:41 +02:00
Anton Khirnov
0c19855539 dfa: improve boundary checks in decode_dds1()
Fixes CVE-2012-2798

CC:libav-stable@libav.org
(cherry picked from commit d05f72c75445969cd7bdb1d860635c9880c67fb6)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-10-14 16:03:23 -04:00
Kostya Shishkov
d0267ecf76 dfa: use more meaningful return codes
(cherry picked from commit fb5c1aaea60a714dab3d4e6e71228855fd816222)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-10-14 16:03:20 -04:00
Kostya Shishkov
2281ac9ffd dfa: add some checks to ensure that decoder won't write past frame end
(cherry picked from commit 8099187e897ddc90cb3902332c76fb2542dac308)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-10-14 16:03:18 -04:00
Paul B Mahol
12941dbe2c dfa: convert to bytestream2 API
Protects from overreads.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 29b0d94b43ac960cb442049a5d737a3386ff0337)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-10-14 15:33:38 -04:00
Anton Khirnov
9e575e54a0 dfa: check that the caller set width/height properly.
Fixes CVE-2012-2786.
(cherry picked from commit ee715f49a06bf3898246d01b056284a9bb1bcbb9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-10-14 15:31:46 -04:00
Carl Eugen Hoyos
e18f70c2d1 Set Chronomaster DFA palette opaque. 2011-11-12 20:05:35 +01:00
Carl Eugen Hoyos
320f0f04a1 Fix Chronomaster DFA palette.
The palette had a blue cast.
2011-11-12 20:03:44 +01:00
Michael Niedermayer
faba79e080 Merge remote-tracking branch 'qatar/master'
* qatar/master:
  mxfdec: Include FF_INPUT_BUFFER_PADDING_SIZE when allocating extradata.
  H.264: tweak some other x86 asm for Atom
  probe: Fix insane flow control.
  mpegts: remove invalid error check
  s302m: use nondeprecated audio sample format API
  lavc: use designated initialisers for all codecs.
  x86: cabac: add operand size suffixes missing from 6c32576

Conflicts:
	libavcodec/ac3enc_float.c
	libavcodec/flacenc.c
	libavcodec/frwu.c
	libavcodec/pictordec.c
	libavcodec/qtrleenc.c
	libavcodec/v210enc.c
	libavcodec/wmv2dec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2011-07-30 06:46:08 +02:00
Anton Khirnov
ec6402b7c5 lavc: use designated initialisers for all codecs.
It's more readable and less prone to breakage.
2011-07-29 08:42:34 +02:00
Diego Biurrun
b1bb3b8d87 dfa: Remove unused variable.
This fixes the warning:
libavcodec/dfa.c:189: warning: unused variable ‘frame_end’
2011-05-15 13:12:47 +02:00
Reimar Döffinger
2c9a5172d3 dfa: fix buffer overflow checks to avoid integer overflows.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-05-13 07:38:54 +02:00
Michael Niedermayer
334187ade7 Fix "libavcodec/dfa.c:189: warning: unused variable ‘frame_end’"
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-05-04 23:33:59 +02:00
Reimar Döffinger
65daa942eb Fix buffer overflow checks to avoid integer overflows. 2011-03-30 09:15:52 +02:00
Michael Niedermayer
445fdc0140 Merge remote-tracking branch 'newdev/master'
* newdev/master:
  ac3enc: move compute_mantissa_size() to ac3dsp
  ac3enc: move mant*_cnt and qmant*_ptr out of AC3EncodeContext
  Remove support for stripping executables
  ac3enc: NEON optimised float_to_fixed24
  ac3: move ff_ac3_bit_alloc_calc_bap to ac3dsp
  dfa: protect pointer range checks against overflows.
Duplicate:  mimic: implement multithreading.

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2011-03-30 03:09:08 +02:00
Ronald S. Bultje
d38345878c dfa: protect pointer range checks against overflows. 2011-03-29 07:14:44 -07:00
Michael Niedermayer
59bf303d68 Merge remote-tracking branch 'newdev/master'
* newdev/master:
  ac3enc: avoid memcpy() of exponents and baps in EXP_REUSE case by using exponent reference blocks.
  Chronomaster DFA decoder
DUPLICATE:  framebuffer device demuxer
NOT MERGED: cosmetics: fix dashed line length after 070c5d0
  http: header field names are case insensitive

Conflicts:
	LICENSE
	README
	doc/indevs.texi
	libavdevice/fbdev.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2011-03-29 02:46:11 +02:00
Kostya Shishkov
42315dabce Chronomaster DFA decoder
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-03-28 16:55:03 +02:00