11 Commits

Author SHA1 Message Date
Andreas Cadhalpun
e32095807b on2avc: limit number of bits to 30 in get_egolomb
More don't fit into the integer output.

Also use get_bits_long, since get_bits only supports reading up to 25
bits, while get_bits_long supports the full integer range.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 4d5c3b02e9d2c9a630ca433fabca43285879e0b8)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-12-20 16:13:27 +01:00
Michael Niedermayer
bdf67f3837 avcodec/on2avc: Check run more carefully
Fixes CID1239106

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 22f15f5735389e992ec9aed43b0680e75746b3a1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 23:25:21 +02:00
Michael Niedermayer
849f55368c Merge commit '48952116352ab03565cc14805e0f1d63cf0318fe' into release/2.4
* commit '48952116352ab03565cc14805e0f1d63cf0318fe':
  on2avc: check number of channels

See: 550f3e9df3410b3dd975e590042c0d83e20a8da3
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2014-12-20 12:21:31 +01:00
Michael Niedermayer
4895211635 on2avc: check number of channels
Fixes invalid memory access.

CC: libav-stable@libav.org
Bug-ID: CVE-2014-8549
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit cee4490b521fd0d02476d46aa2598af24fb8d686)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2014-12-20 10:51:41 +01:00
Michael Niedermayer
84d26ab6eb avcodec/on2avc: Check number of channels
Fixes out of array access
Fixes: asan_heap-oob_4da4f3_7_asan_heap-oob_4da4f3_173_Xmen_avc_500.vp6

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 550f3e9df3410b3dd975e590042c0d83e20a8da3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-10-04 23:52:29 +02:00
Michael Niedermayer
ce6a1ff2a1 avcodec/on2avc: Fix out of array access
Fixes CID1206648

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-07-02 20:22:12 +02:00
Michael Niedermayer
d84286b1ea Merge commit 'f1df0a4c08b54e722e7a2c797d0d31c7f2c531d0'
* commit 'f1df0a4c08b54e722e7a2c797d0d31c7f2c531d0':
  on2avc: Remove pointless dsputil.h #include

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2014-05-27 22:29:11 +02:00
Diego Biurrun
f1df0a4c08 on2avc: Remove pointless dsputil.h #include 2014-05-27 03:12:17 -07:00
Lukasz Marek
ab57cbb7b1 lavc/on2avc: silent warnings about const params
Signed-off-by: Lukasz Marek <lukasz.m.luki2@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-05-11 06:23:25 +02:00
Michael Niedermayer
56efd98a65 Merge commit 'e2834567d73bd1e46478ba67ac133cb8ef5f50fd'
* commit 'e2834567d73bd1e46478ba67ac133cb8ef5f50fd':
  On2 AVC decoder

Conflicts:
	Changelog
	configure
	libavcodec/avcodec.h
	libavcodec/codec_desc.c
	libavcodec/version.h

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2014-04-23 20:47:13 +02:00
Kostya Shishkov
e2834567d7 On2 AVC decoder 2014-04-23 19:57:44 +02:00