Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d3db8988d5befd8702a748cf1957415677bfe75c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes Ticket1068
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 73089eccd3e48539555349b36d8aabbf1cea416e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes an AAC decoding issue with the sample from ticket #213 on machines
with SSE but without SSE2.
Based on 89411a by Reimar.
(cherry picked from commit f6b78638086beae9bcab672d4c9de1790be5a928)
For small video dimensions, these calculations of the upper bound
for pixel access may have a negative result. Using an unsigned
comparison to bound a potentially negative value only works if
the greater operand is non-negative. Fixed by doing edge emulation
when the upper bound is probably negative, everywhere that this
pattern appears.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
(cherry picked from commit d209c27b09234cc40bbdbd680aa502b493edf595)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
For small video dimensions calculations of the upper bound for pixel
access may result in negative value. Using an unsigned comparison
works only if the greater operand is non-negative. This is fixed by
doing edge emulation explicitly for such conditions.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
(cherry picked from commit aacf6b3a2fd8bc8603e3deaa6e612ea03cf08707)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This possibly makes part of the CVE-2011-3895 fix unneeded.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ff7f198d7f9504f71676327be0be47661cfe39d6)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
BUG=101458
Review URL: http://codereview.chromium.org/8414025
Fixes second part of CVE-2011-3895
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f74ce3a60d6ef49080df85c44b54280357109f56)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
BUG=101458
Review URL: http://codereview.chromium.org/8413019
This fixes part of 2011-3895
bigned-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 68226ed9ecef675895dc55a0c58d587014639a0e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 405e99bdfdb363e8dfda275faad9d4fdc9646434)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6fcf2bb8af0e7d6bb179e71e67e5fab8ef0d2ec2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
decoding.
BUG=100543
Review URL: http://codereview.chromium.org/8365014
This fixes 25% of CVE-2011-3893
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7149fce2cac0474a5fbc5b47add1158cd8bb283e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes Ticket834
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 15b219fae9da1691dfb264f51637805e1ca63d1a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This reverts commit 8d055e9079f151f13d34e8e04f4aa7ca0273c448.
The original commit introduced ticket #871, do not import the problem
into the release branch.
Signed-off-by: Michael Bradshaw <mbradshaw@sorensonmedia.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2ba3416362345f275c63e70f44f4cfbf9b66fb35)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Reviewed-by: Jean First <jeanfirst@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3f07ef1dfff036a6b35c1605e6346bad2e17da68)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The original code wasn't taking into account the fact that linesize may not equal the frame's width. This is to correct that.
Signed-off-by: Michael Bradshaw <mbradshaw@sorensonmedia.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d1669e5fe3d61dc4181f96138eb4355aaaf231ea)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes Ticket856
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 45552371e3434fb7aa4d0bc566fd4ef954f9af14)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 465eb0eb48a14f5308d7fa52c388e7be7170cc3e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 24964f21e4976edab156dc934c3b5ec3746b16eb)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
y41p is a packed 12-bit 4:1:1 YUV format used by Brooktree.
Fixes issue 1123 / ticket #102.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dfa77dead2c97ec84092066102b14a2524d4d88b)
Conflicts:
Changelog
libavcodec/version.h
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Jean First <jeanfirst@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b1031562351d81fb56f9338df5876dc2153d9f26)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e146ad95d79b1a6e6b9e566366b832825c79679f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fix Ticket842
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b0143da80656f286b3e2363f3ddb6f81c4a0fbf5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e7c1e38ba632f7315e332dd350b38f782f428884)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 92e2b59dec8c0124a209ce24f23450df9607d9d8)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d46bc4133c104188dd6719365605e42bd1b5e2ff)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4b35ee0b7c0c4cbac3541a25a5e8c00b657c8f95)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes crash.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8e09482e4d27d65bbce2ce5c2f4392216011ed09)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes crash
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 11ca3416f92744f376c08e5f31bcbe5d9b44acb2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5e9a56a0350c518cd4b38845aff49d41a9c952ae)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 18bcfc912e48bf77a5202a0e24a3b884b9b2ff2c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 964506bb979e8c972833c7421a39f3275d3cd3c0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5257743aee0c3982f0079e6553aabc6aa39401d2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2278ecc434d390bccd32a083a12ab964a6b7b0ce)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
