Fixes long loop
Fixes Ticket3208
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8202c49b43621c04e26d4a3aa83a10e1e5cc1836)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This removes the initialization of 2 unused fields
The change was part of c1868e7ee7b07b40a0fe15f50df89fe499a01a50
but wasnt merged as the fields could still be used
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 05c78f345b623a3eed203ab17da6e1419d56abd0)
Conflicts:
libavformat/utils.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 05886c9d4edddb07a4cdc6afee8b30cd9c80b4db)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The check could fail if avio_read() read less than requested
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8c3b026a0eeb49464d957b61b0c01cceecc416fd)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6a2064820b52568c05a9ec8f418f18840e7c43cc)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '8575f5362f98c937758b20ff8512d6767a56208e':
lavf: make av_probe_input_buffer more robust
lavf: use a fixed width type
lavf: simplify handling of offset in av_probe_input_buffer()
Conflicts:
libavformat/utils.c
See: cdce0e8a506cafebe47736d891f5b645b57d14b2 and previous commits
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c4810fbe4f53d312ba70f251f7ee4f484cbca565)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Always use the actually read size as the offset instead of making
possibly invalid assumptions.
Addresses: CVE-2012-6618
(cherry picked from commit 2115a3597457231a6e5c0527fe0ff8550f64b733)
Conflicts:
libavformat/utils.c
Signed-off-by: Anton Khirnov <anton@khirnov.net>
It's shorter and more consistent with the rest of the code.
(cherry picked from commit 8b76362836f3c373c3aadc544522edcbef16dd5f)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Such pics behave more like headers which we also dont count.
Fixes Ticket3146
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a8dec360c5db15e8da4b44ff3c0f02a6c57e8ac0)
* commit '04d2f9ace3fb6e880f3488770fc5a39de5b63cbb':
mvi: Add sanity checking for the audio frame size
alac: Do bounds checking of lpc_order read from the bitstream
xwma: Avoid division by zero
avidec: Make sure a packet is large enough before reading its data
vqf: Make sure the bitrate is in the valid range
vqf: Make sure sample_rate is set to a valid value
electronicarts: Check packet sizes before reading
lavf: Avoid setting avg_frame_rate if delta_dts is negative
vc1dec: Undo mpegvideo initialization if unable to allocate tables
vc1dec: Fix leaks in ff_vc1_decode_init_alloc_tables on errors
wnv1: Make sure the input packet is large enough
dcadec: Validate the lfe parameter
Conflicts:
libavcodec/dcadec.c
libavcodec/wnv1.c
libavformat/avidec.c
libavformat/electronicarts.c
libavformat/utils.c
libavformat/xwma.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
Update Changelog
Prepare for 9.9 RELEASE
lavf: fix the comparison in an overflow check
dv: Add a guard to not overread the ppcm array
nuv: check ff_rtjpeg_decode_frame_yuv420 return value
Conflicts:
Changelog
RELEASE
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The check added in df33a58e5311ee9a64a573889b883a80e981af7b does not work
at all, rather it broke the summing of bitrates completely.
The comparission was wrong way around.
This commit replaces it by a simpler and hopefully clearer check
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a5d67bc796e1f9a2b99b43ea807166b655e4bdbc)
Conflicts:
libavformat/utils.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'aade60ab165716523788cd11caf03ae61b40144a':
matroskadec: Check that .lang was allocated and set before reading it
alac: Limit max_samples_per_frame
ape demuxer: check for EOF in potentially long loops
4xm: check that bits per sample is strictly positive
lavf: avoid integer overflow when estimating bitrate
pictordec: pass correct context to avpriv_request_sample
Conflicts:
libavcodec/pictordec.c
libavformat/matroskadec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '0b6adcf76bda8994902f5b6d8e694b0b916ea210':
oma: refactor seek function
xl: Make sure the width is valid
8bps: Bound-check the input buffer
4xm: Reject not a multiple of 16 dimension
alsdec: Clean up error paths
alsdec: Fix the clipping range
dsicinav: Clip the source size to the expected maximum
dsicinav: Bound-check the source buffer when needed
dsicinav: K&R formatting cosmetics
lavf: Make sure avg_frame_rate can be calculated without integer overflow
mov: Do not allow updating the time scale after it has been set
mov: Seek back if overreading an individual atom
ac3dec: Don't consume more data than the actual input packet size
indeo: Reject impossible FRAMETYPE_NULL
indeo: Do not reference mismatched tiles
Conflicts:
libavcodec/4xm.c
libavcodec/8bps.c
libavcodec/alsdec.c
libavcodec/dsicinav.c
libavcodec/ivi_common.c
libavcodec/xl.c
libavformat/mov.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
If either of the deltas is too large for the multiplications to
succeed, don't use this for setting the avg frame rate.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e740929a071ab032ffa382e89da69c6ec7cf882c)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Otherwise, during error conditions, the caller will be left with
dangling pointers to a destructed packet => boom.
BUG=242786
TEST=ffmpeg_regression_tests
Commit slightly simplified by commiter
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c54a1565f512858ccfa70392f40f11c098bc1b63)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array read
Fixes ticket #2609.
Found-by: durandal_1707
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 695a766bff4cd8414a84e58159506d72b4e44892)
* commit '8f558c3e101859aec9adcb4b4b270ae1ef8f88b5':
af_channelmap: sanity check input channel indices in all cases.
id3v2: pad the APIC packets as required by lavc.
lavf: make sure stream probe data gets freed.
dfa: check for invalid access in decode_wdlt().
Conflicts:
libavformat/id3v2.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Followup to http://thread.gmane.org/gmane.comp.video.ffmpeg.devel/151321
patch by Reimar and Thomas Mundt fixes some AVC-Intra files from
different tickets.
It does not fix http://samples.ffmpeg.org/ffmpeg-
bugs/trac/ticket524/AVCI50.mov
Authors of this commit are: Reimar and Thomas Mundt
Patch and commit message mostly taken from ffmpeg-devel, mail by Carl
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
"que" sounds like a slang word to me. This commit renames a few
variables, fix the comments and the logging messages (sometimes along
with small other typo fixes).
it causes problems (incorrectly detect TS discontinuities)
with a brokan TS file (test-audio-broken.ts)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The values compared here can be more than INT64_MAX apart. Since the
difference is always positive, converting to uint64_t before subtracting
gives the correct result without overflows.
Signed-off-by: Mans Rullgard <mans@mansr.com>
The previous code computes the offset by reversing the growth
of the allocated buffer size: it is complex and did lead to
inconsistencies when the size limit is reached.
Fix trac ticket #1991.
