15 Commits

Author SHA1 Message Date
Michael Niedermayer
9b0736c08a Merge remote-tracking branch 'qatar/release/0.7' into release/0.8
* qatar/release/0.7:
  Update changelog for 0.7.8 release
  aac: check the maximum number of channels
  oggdec: fix faulty cleanup prototype
  qdm2: check that the FFT size is a power of 2
  rv10: check that extradata is large enough
  lavf: make sure stream probe data gets freed.
  dfa: check for invalid access in decode_wdlt().
  avfiltergraph: check for sws opts being non-NULL before using them.

Conflicts:
	Changelog
	libavformat/utils.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2013-09-22 17:43:33 +02:00
Anton Khirnov
96cf80609a dfa: check for invalid access in decode_wdlt().
This can happen when the number of skipped lines is not consistent with
the number of coded lines.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3623589edc7b1257bb45aa9e52c9631e133f22b6)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-09 20:05:52 +02:00
Michael Niedermayer
acada70ffb Merge remote-tracking branch 'qatar/release/0.7' into release/0.8
* qatar/release/0.7:
  Update changelog for 0.7.7 release
  mpeg12: do not decode extradata more than once.
  indeo4/5: check empty tile size in decode_mb_info().
  dfa: improve boundary checks in decode_dds1()
  indeo5dec: Make sure we have had a valid gop header.
  rv34: error out on size changes with frame threading

Conflicts:
	Changelog

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2013-02-14 14:12:14 +01:00
Anton Khirnov
604d72aa0d dfa: improve boundary checks in decode_dds1()
Fixes CVE-2012-2798

CC:libav-stable@libav.org
(cherry picked from commit d05f72c75445969cd7bdb1d860635c9880c67fb6)

Conflicts:

	libavcodec/dfa.c
2013-02-02 09:54:16 +01:00
Michael Niedermayer
597d709eb4 Merge commit 'aa45b90804ab21175b8c116bd8e5eb4b4e85fbcb' into release/0.8
* commit 'aa45b90804ab21175b8c116bd8e5eb4b4e85fbcb': (22 commits)
  alsdec: Check k used for rice decoder.
  cavsdec: check for changing w/h.
  avidec: use actually read size instead of requested size
  wmaprodec: check num_vec_coeffs for validity
  lagarith: check count before writing zeros.
  indeo5: check tile size in decode_mb_info().
  indeo5: prevent null pointer dereference on broken files
  indeo: check for invalid motion vectors
  indeo: clear allocated band buffers
  indeo: check custom Huffman tables for errors
  dfa: add some checks to ensure that decoder won't write past frame end
  dfa: check that the caller set width/height properly.
  bytestream: add a new set of bytestream functions with overread checking
  avsdec: Set dimensions instead of relying on the demuxer.
  lavfi: avfilter_merge_formats: handle case where inputs are same
  rv34: use AVERROR return values in ff_rv34_decode_frame()
  h263: Add ff_ prefix to nonstatic symbols
  eval: fix swapping of lt() and lte()
  bmpdec: only initialize palette for pal8.
  vc1dec: add flush function for WMV9 and VC-1 decoders
  ...

Conflicts:
	libavcodec/avs.c
	libavcodec/mpegvideo_enc.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2013-01-17 02:56:12 +01:00
Kostya Shishkov
2d63f9b4ef dfa: add some checks to ensure that decoder won't write past frame end
(cherry picked from commit 8099187e897ddc90cb3902332c76fb2542dac308)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-01-04 07:43:37 +01:00
Anton Khirnov
4c849c6991 dfa: check that the caller set width/height properly.
Fixes CVE-2012-2786.
(cherry picked from commit ee715f49a06bf3898246d01b056284a9bb1bcbb9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-01-04 07:43:37 +01:00
Diego Biurrun
b1bb3b8d87 dfa: Remove unused variable.
This fixes the warning:
libavcodec/dfa.c:189: warning: unused variable ‘frame_end’
2011-05-15 13:12:47 +02:00
Reimar Döffinger
2c9a5172d3 dfa: fix buffer overflow checks to avoid integer overflows.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-05-13 07:38:54 +02:00
Michael Niedermayer
334187ade7 Fix "libavcodec/dfa.c:189: warning: unused variable ‘frame_end’"
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-05-04 23:33:59 +02:00
Reimar Döffinger
65daa942eb Fix buffer overflow checks to avoid integer overflows. 2011-03-30 09:15:52 +02:00
Michael Niedermayer
445fdc0140 Merge remote-tracking branch 'newdev/master'
* newdev/master:
  ac3enc: move compute_mantissa_size() to ac3dsp
  ac3enc: move mant*_cnt and qmant*_ptr out of AC3EncodeContext
  Remove support for stripping executables
  ac3enc: NEON optimised float_to_fixed24
  ac3: move ff_ac3_bit_alloc_calc_bap to ac3dsp
  dfa: protect pointer range checks against overflows.
Duplicate:  mimic: implement multithreading.

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2011-03-30 03:09:08 +02:00
Ronald S. Bultje
d38345878c dfa: protect pointer range checks against overflows. 2011-03-29 07:14:44 -07:00
Michael Niedermayer
59bf303d68 Merge remote-tracking branch 'newdev/master'
* newdev/master:
  ac3enc: avoid memcpy() of exponents and baps in EXP_REUSE case by using exponent reference blocks.
  Chronomaster DFA decoder
DUPLICATE:  framebuffer device demuxer
NOT MERGED: cosmetics: fix dashed line length after 070c5d0
  http: header field names are case insensitive

Conflicts:
	LICENSE
	README
	doc/indevs.texi
	libavdevice/fbdev.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2011-03-29 02:46:11 +02:00
Kostya Shishkov
42315dabce Chronomaster DFA decoder
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-03-28 16:55:03 +02:00