23212 Commits

Author SHA1 Message Date
Michael Niedermayer
d81ccf1fb2 avcodec/mjpegdec: only run EOI emulation code when there was a scan
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361e27a3d8096baacc45d2551a1ebfcbfdaa6a67)
2014-01-19 14:38:03 +01:00
Michael Niedermayer
67d20495f5 avcodec/mjpegdec: update cur_scan also for non-LS jpeg
This should make no difference but the variable will be used in a subsequent commit

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8893f31e206358d933abe4a5227b5ae89f5f303d)

Conflicts:
	libavcodec/mjpegdec.c
2014-01-19 14:37:32 +01:00
Michael Niedermayer
db20610c49 wmaprodec: Fix null pointer dereference in decode_frame()
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c7a7605656633e52ade8a5d32a7c2497b37faef8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 01:58:13 +01:00
Michael Niedermayer
15a736483e h264: check mb_width/height
Fixes inconsistency that leads to out of array accesses with threads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5a9e3760495e8678ae87314670e3d9d5a1792c8d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:52:56 +01:00
Michael Niedermayer
c8b90c7cd5 h264: Always decode MMCOs into temprary array
When decoding succeeded the array is copied into the permanent one.
This prevents inconsistencies
Fixes assertion failure

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c40f51e15b91898e5c69fca7c8c67e3da6624dd4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:52:56 +01:00
Michael Niedermayer
97978b7ae8 h264: move the default_ref_list_done check down after its inputs have been written
Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 11c3381ce3c353a4dadf9def6232e7604b0c5d2b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:52:56 +01:00
Michael Niedermayer
3f2efac0fe h264: Move slice_table clean out of frame_start
Fixes inconsistency ultimately leading to an out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 746016598d1885afd1fee976b6d315ed7eeefa68)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:52:56 +01:00
Michael Niedermayer
b9058f58bd h264_refs: Check for attempts to assign pictures to short & long.
Fixes null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 92002db3eb437414281ad4fb6e84e34862f7fc92)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:49:11 +01:00
Michael Niedermayer
47faf347a0 h264_cavlc: fix assertion failure due to reading too long vlc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 10ece44d0948b44b062d09319052d09d14f7bfdb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:48:58 +01:00
Michael Niedermayer
3d1e4b7ca5 avcodec/aacps: fix number of bands used with ipd/opd
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f861d16355f_1664_File1_fixed.aac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6433b393ba2b1b410ff18e386f84781a760549f5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:47:25 +01:00
Michael Niedermayer
a2bea0df0e aacps: correct opdipd code to match spec
This fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66e9716a36105f69b9f076b0fec3ec2551c7e3b7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:47:18 +01:00
Michael Niedermayer
483b2016bb avcodec/ansi: Fix right/bottom end checks
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6021615bbe393381f23b34a7cd0dcfd1a42687ba)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:45:22 +01:00
Michael Niedermayer
271f5d68b9 avcodec/ansi: Check x/y
This prevents out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e91fd754c63de7fd3cb7fdea8974166db362e387)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:45:07 +01:00
Michael Niedermayer
dee327b0e7 shorten: fix "off by padding" bug
Fixes array overread

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad22767cb61cdc75541b21154d65fd1ad6351025)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:42:23 +01:00
Michael Niedermayer
e438fd3be9 avcodec/lcldec: Check that dimensions are a multiple of the subsample factors
Other dimensions would not work correctly currently,
also ask for a sample for files that fail this check.

This fixes an integer overflow leading to out of array
accesses.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e00bbb10cbde3da03a1e744265ce6def9ae4c56)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
84b100396e dxa: check vectors of 2x2 motion blocks
Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ead590c2561980f2afda38a662364659577dca38)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
7855083443 dxa: check vectors of 4x4 motion blocks
Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f96e0eb2387f8da7b8177f8f22969853dc648ca6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
ca7f64e0ac shorten: allocate space for padding
Fixes array overread

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 89d998f1c1eddac3a1256e28ac00ccfdf4d3edd1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
2b26f8c6bf evrcdec: fix sign error
The specification wants round(abs(x))) * sign(x) which is
equivakent to round(x)

Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f18d2dff1194b34b79dc7641aafe54d1df349e40)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
6e3697b985 eamad: Check against minimum supported dimensions
Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e756635964ed3aa1ee997465f9b46143bcb5d894)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
c93501687c xan: Check for overlapping copies
No valid samples i found use such copies

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bdfe60c769f4d4e71a360fe02f06cdb9c039cf35)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
bb6f466794 avcodec/bitstream: check codes in ff_init_vlc_sparse()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6998af4a40e67b5f0bfb769b7749f38a92eb2819)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
08a319549a avcodec/bitstream: Check bits in ff_init_vlc_sparse()
Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fb3e3808aed843b21dd70a70bdbc4b9f7de6a00b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
d1da1c8384 avcodec/mpegvideo_motion: Use a field from the current frame if the last is unavailable in DMV & 16x8
Fixes null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 42bcc4082d644342171216fcf597cde75421a4d7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
8ded3738d1 avcodec/c93: Check for block overlap.
Fixes overlapping memcpy()

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6b657ac7889738b9ab38924cca4e7c418f6fbc38)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
a2186a8054 avcodec/mpegvideo_motion: Check P field references
If a reference is unavailable use a field from the current
picture
Fixes null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 23daee0dcc57b647b9d62d4c905e94acf0c6b8e0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
a92b73da99 svq3: use memmove to avoid overlap in memcpy.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c8ce750abaa783109630d41ca7dde5de34f6197)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
ab38b39059 evrcdec: use memmove() instead of memcpy() when regions can overlap.
This occurs also with valid files.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5ae484e350e4f1b20b31802dac59ca3519627c0a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
b841869477 avcodec/error_resilience: check that er is supported before attempting to read the status of the previous slice
Fixes incorrectly set error_occured and improves speed

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 90539cea336fd513c47295a03c164cb4a851166f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
3488e9e269 avcodec/error_resilience: factor er_supported() check out
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit afb18c55783362546b5e512ce01b7fe7bf5744d9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Paul B Mahol
5a8d78ab7f avcodec/libopusenc: change default frame duration to 20 ms
20 ms is used by libopus encoder.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit 74906d3727ec3bd9b7b28dfa7a98ff6e8cf8b6d7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
dea7f1c62e avcodec: move end zeroing code from av_packet_split_side_data() to avcodec_decode_subtitle2()
This code changes the input packet, which is read only and can in
rare circumstances lead to decoder errors. (i run into one of these in
the audio decoder, which corrupted the packet during av_find_stream_info()
so that actual decoding that single packet failed later)
Until a better fix is implemented, this commit limits the problem.
A better fix might be to make the subtitle decoders not depend on
data[size] = 0 or to copy their input when this is not the case.
(cherry picked from commit 01923bab98506b1e98b4cbf08419364ce6ffea6d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
c7027ae738 h264: Do not treat the initial frame special in handling of frame gaps
The not handling of frame gaps has lead to the lack of a dummy reference
frame, which has lead to the failure of decode_slice_header() which has
lead to one SEI recovery message being skiped which had introduced a
slightly suboptimal recovery point for at least 1 h264 file compared to
JM.

Found-by: Carl & BugMaster
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9e5ef1c5c37208326c59d642e2dc7afd3f10b09b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
751e684aae avcodec/jpeglsdec: check err value for ls_get_code_runterm()
Fixes infinite loop
Fixes Ticket3086

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc0e47b55096361723b364afa43b79a3f5619cdc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
252002aec1 avcodec/utils: add some saftey checks to add_metadata_from_side_data()
This fixes potential overreads with crafted files.

Found-by: wm4
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 838f461b0716393a1b5c70efd03de1e8bc197380)

Conflicts:

	libavcodec/utils.c
2014-01-16 00:35:12 +01:00
Michael Niedermayer
d805a51713 avcodec/avpacket/av_packet_split_side_data: ensure that side data padding is initialized
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 240fd8c96f59ebe9dcfc4152a1086cd3f63400c0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Paul B Mahol
b8b77aefe8 avcodec/ffv1dec: fix format detection
Fixes crash with carefuly designed files.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit a27227d401adf12534dc7a26d72e43e2f35f8944)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-16 00:35:12 +01:00
Michael Niedermayer
e24b33cd68 avcodec/msvideo1enc: fix SKIPS_MAX
Fixes Ticket3270

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fb8f5d0510619cea2204246631f1c0dcd994ee25)
2014-01-09 11:45:45 +01:00
Martin Storsjö
3e65caf5bc arm: Don't clobber callee saved registers in scalarproduct
q4-q7/d8-d15 are supposed to not be clobbered by the callee.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d307e408d4a9ada22df443cc38be77cc5e492694)
2013-12-21 09:55:05 +01:00
Michael Niedermayer
86d4d4b011 avcodec/cabac: force get_cabac to be not inlined
works around bug in gccs inline asm register assignment
Fixes Ticket3177

gcc from 4.4 to 4.6 is affected at least, no non affected gccs known
clang seems not affected

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0538b29ae8002c44f27bae8a1a6fc6e646998be5)
2013-12-09 10:36:54 +01:00
Michael Niedermayer
fd8af75109 avcodec/bink: fix seeking to frame 0
Fixes Ticket3088

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cb52d6da0a9c88c584a38a9a7a94825565854b7e)

Conflicts:
	libavcodec/bink.c
2013-10-31 01:01:52 +01:00
Michael Niedermayer
720e2d4143 h264: make flush_change() set mmco_reset
This ensures that frames do not get mixed on context reinits

Fixes Ticket2836

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3c9dd93faa9f3c250428dd0548c075583aa07cc3)
2013-10-26 02:42:40 +02:00
Michael Niedermayer
9195ef6f65 avcodec/h264: reduce noisiness of "mmco: unref short failure"
Do not consider it an error if we have no frames and should discard one.
This condition can easily happen when decoding is started from an I frame

Fixes Ticket2811

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08a89761964bdd0a023eff6d37a1131fb7e1d7a0)

Conflicts:
	libavcodec/h264_refs.c
2013-10-26 01:06:43 +02:00
Michael Niedermayer
a8b6721bed avcodec/h264: do not trust last_pic_droppable when marking pictures as done
This simplifies the code and fixes a deadlock

Fixes Ticket2927
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 29ffeef5e73b8f41ff3a3f2242d356759c66f91f)

Conflicts:
	libavcodec/h264.c
2013-10-26 01:03:53 +02:00
Michael Niedermayer
1fe734f4d3 avcodec/h264_refs: modify key frame detection heuristic to detect more cases
Fixes Ticket2968

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5ac6b6028f17b64723884c9fa72cfcbd369a1ba2)
2013-10-24 11:07:37 +02:00
Michael Niedermayer
95e26d33d7 avcodec/parser: reset indexes on realloc failure
Fixes Ticket2982

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f31011e9abfb2ae75bb32bc44e2c34194c8dc40a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2013-10-03 01:04:19 +02:00
Michael Niedermayer
f32051cd73 avcodec/ffv1enc: update buffer check for 16bps
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3728603f1854b5c79d1a64dd3b41b80640ef1e7f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2013-10-03 01:04:19 +02:00
Michael Niedermayer
c3ee5b4c36 avcodec/truemotion2: Fix av_freep arguments
Fixes null pointer dereference
Fixes Ticket2944

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c54aa2fb0f869ec025933944cbd1634fffe95d09)

Conflicts:

	libavcodec/truemotion2.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2013-10-03 01:04:19 +02:00
Michael Niedermayer
c17fd9f9ce avcodec/mjpegdec: Add some sanity checks to ljpeg_decode_rgb_scan()
These prevent the rgb ljpeg code from being run on parameters that it doesnt
support. No testcase available but it seems possible to trigger these.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 61c68000eda643dfce96dc46b488d39fd5c4e309)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2013-10-03 01:04:18 +02:00
Michael Niedermayer
a0d13f578b avcodec/dsputil: fix signedness in sizeof() comparissions
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 454a11a1c9c686c78aa97954306fb63453299760)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2013-10-03 01:04:18 +02:00