* commit '0662967d2bbdbe90540eaa8c847f521fa4b75aab':
hls, segment: fix splitting for audio-only streams.
afifo: fix request_samples on the last frame in certain cases
id3v2: check for end of file while unescaping tags
indeo3: fix off by one in MV validity check
Conflicts:
libavformat/id3v2.c
libavformat/segment.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '46fd6e4f2ebbcd5a00847cdb05fe416466d06d37':
aac: check the maximum number of channels
update Changelog
riff: check for eof if chunk size and code are 0
oggdec: fix faulty cleanup prototype
Conflicts:
Changelog
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c8462bd17f35f435192281a2ea4ce8008a7398d3':
mp3dec: fallback to generic seeking when a TOC is not present
svq1dec: clip motion vectors to the frame size.
svq1dec: check that the reference frame has the same dimensions as the current one
qdm2: check that the FFT size is a power of 2
Conflicts:
libavcodec/svq1dec.c
libavformat/mp3dec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '95db1624ef98ccc4ba7ff70d50c4b4d0f8ffed54':
indeo3: switch parsing the header to bytestream2
indeo3: check motion vectors.
rv10: check that extradata is large enough
indeo3: fix data size check
Conflicts:
libavcodec/indeo3.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '8f558c3e101859aec9adcb4b4b270ae1ef8f88b5':
af_channelmap: sanity check input channel indices in all cases.
id3v2: pad the APIC packets as required by lavc.
lavf: make sure stream probe data gets freed.
dfa: check for invalid access in decode_wdlt().
Conflicts:
libavformat/id3v2.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '858864d350320dd807e349bda017026e61a47fe0':
xmv: check audio track parameters validity.
bmv: check for len being valid in bmv_decode_frame().
xmv: do not leak memory in the error paths in xmv_read_header()
matroska: pass the lace size to the matroska_parse_rm_audio
Conflicts:
libavformat/matroskadec.c
libavformat/xmv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Set interlaced to false if we don't have an interlaced frame
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0881cbf314982cce8448bd12644ce2a6e0b8c576)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
They are not guaranteed to be aligned.
Fixes Bug 503.
CC:libav-stable@libav.org
(cherry picked from commit a97d8cc16e0da30c9ffefa1ede2a0adf3db5f3f8)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Broken bitstreams could report a larger than specified number of
channels and cause outbound writes.
CC:libav-stable@libav.org
(cherry picked from commit a943a132f36f4df8fe2f749744677b71984abce7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
They can be different if the last keyframe failed to decode correctly.
Fixes possible invalid reads in such a case.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit b1bb8fb860b47e90dd67f0c5740698128fc82dcc)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Also add an additional sanity check to the alt_quant table.
Fixes invalid reads with corrupted files.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 66531d634e75b834e89e4a6a0f7470ca018712a1)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
The data offsets are relative to the bistream header, which is 16 bytes
after the start of the data.
Fixes invalid reads with corrupted files.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 34e6af9e204ca6bb18d8cf8ec68fe19b0e083e95)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This can happen when the number of skipped lines is not consistent with
the number of coded lines.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3623589edc7b1257bb45aa9e52c9631e133f22b6)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
It can be 0 or -1 for invalid files, which may result in invalid memory
access.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b88f902125ee808c8366e9dcb3f21e4c227483fc)
Conflicts:
libavcodec/bmv.c
Fixes Ticket2022
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dae38a66ebd8a71aad51a29311f1c50df3ae3a2e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361319d0f49475bc14c744194870f9bab78a8a83)
Conflicts:
tests/ref/lavf/dpx
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c50241080d7599c90fc8b4e74c5f8d62a4caae52':
vf_hqdn3d: fix uninitialized variable use
lzo: fix overflow checking in copy_backptr()
flacdec: simplify bounds checking in flac_probe()
atrac3: avoid oversized shifting in decode_bytes()
shorten: use the unsigned type where needed
shorten: report meaningful errors
shorten: K&R formatting cosmetics
shorten: set invalid channels count to 0
Conflicts:
libavcodec/shorten.c
libavformat/flacdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
When `off' is 0, `0x537F6103 << 32' in the following expression invokes
undefined behavior, the result of which is not necessarily 0.
(0x537F6103 >> (off * 8)) | (0x537F6103 << (32 - (off * 8)))
Avoid oversized shifting.
CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit eba1ff31304e407db3cefd7532108408f364367b)
Fixes Ticket2353
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3c24fbbf651d4ec28eccfd7ef05a2595a11dd55a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e398990eb87785e20e065cd3f14d1dbb69df4392)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
More speedup and fixes 'may be used uninitialized in this function' warnings
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d2e0a276d593ded94401e687f60bee266f3e725e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
speeds up code and allows more simplifications
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dbaae33c2c71862b8eaea978ed6dccc5ec03db89)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c2992b705381e082e33633e62e151887da67b285)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
See:
commit 29d8cd265a536063420afe78375b2176a9e1abc5
Author: Alexander Kojevnikov <alexander@kojevnikov.com>
Date: Tue Feb 26 21:47:11 2013 -0800
mp3dec: Fix VBR bit rate parsing
When parsing the Xing/Info tag, don't set the bit rate if it's an Info tag.
When parsing the stream, don't override the bit rate if it's already set,
otherwise calculate the mean bit rate from parsed frames. This way, the bit
rate will be set correctly both for CBR and VBR streams.
Signed-off-by: Alexander Kojevnikov <alexander@kojevnikov.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
eamad: allocate a dummy reference frame when the real one is missing
libmp3lame: use the correct remaining buffer size when flushing
png: use av_mallocz_array() for the zlib zalloc function
wmaprodec: require block_align to be set.
ffv1: fix calculating slice dimensions for version 2
xxan: fix invalid memory access in xan_decode_frame_type0()
wmadec: require block_align to be set.
ivi_common: do not call MC for intra frames when dc_transform is unset
Conflicts:
libavcodec/ffv1dec.c
libavcodec/ivi_common.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '747fbe0c212b81952bb27ec7b99fa709081e2d63':
roqvideodec: fix a potential infinite loop in roqvideo_decode_frame().
mp3dec: Fix VBR bit rate parsing
wmaprodec: return an error, not 0, when the input is too small.
vmdaudio: fix invalid reads when packet size is not a multiple of chunk size
h264: check for luma and chroma bit dept being equal
Prepare for 9.4 Release
Conflicts:
RELEASE
libavcodec/vmdav.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
get_uint returns an unsigned value, use an unsigned to store
blocksize to make sure the comparison logic is correct and report
correctly the error for the channel count not supported.
CC: libav-stable@libav.org
(cherry picked from commit 5cf7c72757779a740e897a97710aac044fe5258c)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Prevent the loop shorten_decode_close from writing and freeing out of
the array boundary.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
CC: libav-stable@libav.org
(cherry picked from commit c10da30d8426a1f681d99a780b6e311f7fb4e5c5)
Fixes invalid reads when the first frame is not an I-frame.
CC:libav-stable@libav.org
(cherry picked from commit 7b89cd20d844cbe763ca34e63e99d110043cf241)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Avoids an infinite loop in the calling programs with decoder not
consuming any input and not returning output.
CC:libav-stable@libav.org
(cherry picked from commit cacad1c058f66558ec727faac3b277d2dee264d4)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
It got broken in 0f13cd3187192ba0cc2b043430de6e279e7b97c3.
CC:libav-stable@libav.org
(cherry picked from commit d243896987b8b2062d1faba4d8d6f0c62d2dbee9)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
The loop a few lines below the xan_unpack() call accesses up to
dec_size * 2 bytes into y_buffer, so dec_size must be limited to
buffer_size / 2.
CC:libav-stable@libav.org
(cherry picked from commit 8a49d2bcbe7573bb4b765728b2578fac0d19763f)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
When there is just 1 byte remanining in the buffer, nothing will be read
and the loop will continue forever. Check that there are at least 8
bytes, which are always read at the beginning.
CC:libav-stable@libav.org
(cherry picked from commit 3e2f200237af977b9253b0aff121eee27bcedb44)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Avoids an infinite loop in the calling programs with decoder not
consuming any input and not returning output.
CC:libav-stable@libav.org
(cherry picked from commit ea1136baafb1fe271cb56c3f4d7bff0267e3c70f)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
When parsing the Xing/Info tag, don't set the bit rate if it's an Info tag.
When parsing the stream, don't override the bit rate if it's already set,
otherwise calculate the mean bit rate from parsed frames. This way, the bit
rate will be set correctly both for CBR and VBR streams.
CC:libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit eae0879d961b78717dd2a0899809ad22819ae9e3)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
