Prevents inconsistent state and null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 46cb61819d867961e8f2052a8f13bcf2027d484f)
Conflicts:
libavcodec/gifdec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d23b8462b5a4a9da78ed45c4a7a3b35d538df909)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ee5e97c46e30fb3d6f9f78cc3313dbc06528b37)
Conflicts:
libavcodec/gifdec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad002e1a13a8df934bd6cb2c84175a4780ab8942)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes integer overflow and out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9dd04f6d8cdd1c10c28b2cb4252c1a41df581915)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Solution based on rational.c, which uses isinf() too
This should fix compilation with msvc
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c25224737cba4079602c447c344cb54b81430ce4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Should fix pgc warning
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc6f848dba89a6dc89b840cc2e1942cc3007c2a3)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes calling a random pointer
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7edb984dd051b6919d7d8471c70499273f31b0fa)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes out of array accesses
The code prior to this commit could not have worked, thus obviously
was untested. I was also not able to find a valid sample that uses this
code.
This fix is thus only based on the description of the format
If someone has a sample that uses unpack_rle(), please mail me.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c1f2c4c3b49277d65b71ccdd3b6b2878f1b593eb)
Conflicts:
libavcodec/vmdav.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0baa0a5a02e16ef097ed9f72bc8a7d7b585c7652)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ae2132ac90f02330b0988e6e26ee0d53e41cd196)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8d3c99e825317b7efda5fd12e69896b47c700303)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b39fd7d63648442c20671c3e4b357268ec5c49f2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes a few green artifacts at the top
Fixes rest of Ticket 2535
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c67bca2b5a94efb8fb3c2ba2c7d9b1b413468838)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes green trash
Fixes part of Ticket2535
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bca50e5cd52240d885afeb3edb0fa2c74b352add)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit adaa7743f5fdca0c0aca0b7ffdebf61c7d868571)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '1ab4578c88dc3e1407da15471bd323ba40c3ebbb':
lavc: Fix assignments in if() when calling ff_af_queue_add
wav: Always seek to an even offset
swscale: Use alpha from the right row in yuva2rgba_c
Prepare for 9.6 Release
Conflicts:
RELEASE
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '0662967d2bbdbe90540eaa8c847f521fa4b75aab':
hls, segment: fix splitting for audio-only streams.
afifo: fix request_samples on the last frame in certain cases
id3v2: check for end of file while unescaping tags
indeo3: fix off by one in MV validity check
Conflicts:
libavformat/id3v2.c
libavformat/segment.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '46fd6e4f2ebbcd5a00847cdb05fe416466d06d37':
aac: check the maximum number of channels
update Changelog
riff: check for eof if chunk size and code are 0
oggdec: fix faulty cleanup prototype
Conflicts:
Changelog
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c8462bd17f35f435192281a2ea4ce8008a7398d3':
mp3dec: fallback to generic seeking when a TOC is not present
svq1dec: clip motion vectors to the frame size.
svq1dec: check that the reference frame has the same dimensions as the current one
qdm2: check that the FFT size is a power of 2
Conflicts:
libavcodec/svq1dec.c
libavformat/mp3dec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '95db1624ef98ccc4ba7ff70d50c4b4d0f8ffed54':
indeo3: switch parsing the header to bytestream2
indeo3: check motion vectors.
rv10: check that extradata is large enough
indeo3: fix data size check
Conflicts:
libavcodec/indeo3.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '8f558c3e101859aec9adcb4b4b270ae1ef8f88b5':
af_channelmap: sanity check input channel indices in all cases.
id3v2: pad the APIC packets as required by lavc.
lavf: make sure stream probe data gets freed.
dfa: check for invalid access in decode_wdlt().
Conflicts:
libavformat/id3v2.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '858864d350320dd807e349bda017026e61a47fe0':
xmv: check audio track parameters validity.
bmv: check for len being valid in bmv_decode_frame().
xmv: do not leak memory in the error paths in xmv_read_header()
matroska: pass the lace size to the matroska_parse_rm_audio
Conflicts:
libavformat/matroskadec.c
libavformat/xmv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'b90816d94b0b5c01f451ff98cfbf1d5ddec9c3c1':
matroska: Update the available size after lace parsing
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '05015d03da1d745bb92915b5cea92dec16af719f':
matroska: fix a corner case in ebml-lace parsing
avfiltergraph: check for sws opts being non-NULL before using them.
configure: Enable hwaccels without external dependencies by default.
oma: Validate sample rates
Conflicts:
libavfilter/avfiltergraph.c
libavfilter/graphparser.c
libavformat/oma.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '2e06758479650f6e2a8820c7105f2d193a701175':
Prepare for 9.5 Release
update Changelog
add missed CVE reference in 9.2 release
fate: fetch samples that match the release series
Conflicts:
Changelog
RELEASE
tests/Makefile
The rsync change is not merged
We need to maintain the ability to checkout and test old revissions
from master. This implies that the default sample repository has the
needed samples for both older and newer revissions. Thus there is no
need for a seperate one for each release.
Comments & Suggestions of course welcome
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Set interlaced to false if we don't have an interlaced frame
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0881cbf314982cce8448bd12644ce2a6e0b8c576)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
delta is in samples, not bytes. Also the sample format is not guaranteed
to be planar.
CC:libav-stable@libav.org
(cherry picked from commit 16a4a18db089af8c432f1cdec62155000585b72c)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
They are not guaranteed to be aligned.
Fixes Bug 503.
CC:libav-stable@libav.org
(cherry picked from commit a97d8cc16e0da30c9ffefa1ede2a0adf3db5f3f8)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
RIFF chunks are aligned to 16bit according to the specification.
Bug-Id:500
CC:libav-stable@libav.org
(cherry picked from commit ac87eaf856e0fb51917266b899bb15d19b907baf)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Every other pixel had the alpha channel taken from the wrong
row.
This fixes bug 504.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 6e293d111fcad27d52a2ef5ad77b1009f1743396)
Signed-off-by: Martin Storsjö <martin@martin.st>
The current code can fail to return the last frame if it contains
exactly the requested number of samples.
Fixes the join filter test, which previously did not include the last
408 samples in most cases.
CC:libav-stable@libav.org
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 9bfc6e02bae9de354fb9ba09a8a140e83eeadf7d)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavfilter/fifo.c
tests/fate/filter-audio.mak
Prevent an out of buffer bound write.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit af4cc2605c7a56ecfd84c264aa2b325020418472)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Broken bitstreams could report a larger than specified number of
channels and cause outbound writes.
CC:libav-stable@libav.org
(cherry picked from commit a943a132f36f4df8fe2f749744677b71984abce7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
