32619 Commits

Author SHA1 Message Date
Michael Niedermayer
d94d786bf0 avcodec/ttaenc: Reallocate packet if its too small
Fixes assertion failure
Fixes Ticket5394

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 005c61c6b8982f977e415aa69d2d2b42e6b7f3f2)

Conflicts:

	libavcodec/ttaenc.c
2016-04-28 03:47:13 +02:00
Jan Ekström
3f69797e9b pgssubdec: fix subpicture output colorspace and range
Functionality used before didn't widen the values from limited to
full range. Additionally, now the decoder uses BT.709 where it
should be used according to the video resolution.

Default for not yet set colorimetry is BT.709 due to most observed
HDMV content being HD.

BT.709 coefficients were gathered from the first two parts of BT.709
to BT.2020 conversion guide in ARIB STD-B62 (Pt. 1, Chapter 6.2.2).
They were additionally confirmed by manually calculating values.

Fixes #4637
(cherry picked from commit 9779b6262471d553c1ed811ff7312564e39d8adf)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Michael Niedermayer
49fc747b48 avcodec/ac3dec: Reset SPX when switching from EAC3 to AC3
Fixes Ticket5319

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9ac154d1facd4756db6918f866dccf3e3ffb698c)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Paul B Mahol
cec42e6f4d avcodec/takdec: add code that got somehow lost in process of REing
Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit 38797a8033d061ade58b30b8ac86da222fe42a84)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Paul B Mahol
7e2c695169 avcodec/apedec: fix decoding of stereo files with one channel full of silence
Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit 9149e9c0baaec122bc3da925d6068dffa60b5427)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Michael Niedermayer
cff516d9e8 avcodec/avpacket: Fix off by 5 error
Fixes out of array read
Fixes: mozilla bug 1266129
Found-by: Tyson Smith
Tested-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9f36ea57ae6eefb42432220feab0350494f4144c)

Conflicts:

	libavcodec/avpacket.c
2016-04-28 03:47:13 +02:00
Ivan
0696a555b6 avcodec/h264: Fix for H.264 configuration parsing
Sometimes video fails to decode if H.264 configuration changes mid stream.
The reason is that configuration parser assumes that nal_ref_idc is equal to 11b
while actually some codecs but 01b there. The H.264 spec is somewhat
vague about this but it looks like it allows any non-zero nal_ref_idc for sps/pps.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3a727606c474d3d0b9efa3c900294a84bdb5e331)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Michael Niedermayer
62e87d065b avcodec/bmp_parser: Ensure remaining_size is not too small in startcode packet crossing corner case
Fixes Ticket 5438

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8e26bdd59bf559d00c7e60c53fff292de10139ff)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Aaron Boxer
1bccba1893 avcodec/j2kenc: Add attribution to OpenJPEG project:
http://ghostscript.com/~tor/gs-browse/gs/openjpeg/libopenjpeg/t1.c

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b6b4b0a65e02495edf9d7e5b23bef99a92921147)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Michael Niedermayer
f3da3e2aed avcodec/libutvideodec: copy frame so it has reference counters when refcounted_frames is set
Reviewed-by: maintainer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0cd9ff4e3aa23318a855c21d60b1c9035b2b99d2)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Michael Niedermayer
c6bb765972 avcodec/mjpegenc_common: Store approximate aspect if exact cannot be stored
Fixes Ticket5244

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 068026b0f7845e0f1850094d974f60d181480d64)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Michael Niedermayer
24bd4b363e avcodec/resample: Remove disabled and faulty code
Fixes Ticket5345

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 50ef7361cb5f78c94da2323f3bae86c6bbd618c8)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Luca Barbato
fbe2f77e3f indeo2: Fix banding artefacts
Rename luma table to delta table and change how it is used.

CC: libav-stable@libav.org
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit f8c34f4b8d62afad3f63cf3d9617d73735bef8c1)
(cherry picked from commit 73f3c8f73edf0a69502233b2c50fa9e7104f99ec)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Luca Barbato
51f686fa77 indeo2data: K&R formatting cosmetics
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit d4066a702407352a0648af882c34ea81a404fa2b)
(cherry picked from commit 522ab0b9a92962edda7156a91a494a1e2b8a7f64)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Przemysław Sobala
873ca28390 avcodec/imgconvert: Support non-planar colorspaces while padding
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0d097a869c38850c9ac09bccef60a229470f489b)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Michael Niedermayer
6fe1f5646e avcodec/mjpegdec: Fix decoding slightly odd progressive jpeg
Fixes: ebd58db6-dc86-11e5-91c2-59daeddf50c7.jpg

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c6f4720b8664e6e22eb5b3da6bb48ed5b113f746)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:13 +02:00
Michael Niedermayer
c6950985cb avcodec/avpacket: clear priv in av_init_packet()
This should fix leaving uninitialized pointers in priv which can confuse
user applications.
See: https://github.com/golang/go/issues/14426

Only or release branches

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:12 +02:00
Michael Niedermayer
8dce138510 avcodec/h264: Execute error concealment before marking the frame as done.
Fixes race condition causing artifacts
Fixes Ticket4122

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 98a0053d0f90e3309dc1038b1bae3a48bbd9067c)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-04-28 03:47:12 +02:00
James Almer
d2161b8a6d libwebpenc_animencoder: print library messages in verbose log levels
Reviewed-by: James Zern <jzern@google.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit f875ba48739f59691661393eed1f7cc2371c93f1)
2016-03-17 12:57:51 -03:00
James Almer
c5e12dc10d libwebpenc_animencoder: zero initialize the WebPAnimEncoderOptions struct
This zeroes the WebPAnimEncoderOptions.verbose field, silencing library info messages
printed to stderr.

Reviewed-by: James Zern <jzern@google.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 626b6b769ced6d3e55d2661985ab2a1cb89f481e)
2016-03-17 12:57:47 -03:00
Michael Niedermayer
12f256a729 avcodec/jpeg2000dec: More completely check cdef
Fixes out of array access
Fixes: j2k-poc.bin

Found-by: Lucas Leong <wmliang.tw@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0aada30510d809bccfd539a90ea37b61188f2cb4)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:46 +01:00
Paul B Mahol
d8b37664d5 avcodec/flacenc: fix calculation of bits required in case of custom sample rate
Sample rate of 11025 takes 16 bits but previous code would pick only 8.
Fixes assertion failure.

Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit 3e7d6849120d61bb354376d52786c26f20e20835)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:46 +01:00
Michael Niedermayer
965a8bda94 avcodec/mjpegdec: Check for end for both bytes in unescaping
Fixes assertion failure
Fixes: c40c779601b77dc6e19aaea0b04b9751/signal_sigabrt_7ffff6ae7cb7_5769_b94f6ec70caecb2d3d76b4771b109ac1.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 509c9e74e548139285f30ed8dcc9baf1d64359fa)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:46 +01:00
Michael Niedermayer
e229fbf5ce avcodec/mpegvideo_enc: Check for integer overflow in ff_mpv_reallocate_putbitbuffer()
Fixes assertion failure
Fixes: 6568d187979ce17878b6fe5fbbb89142/signal_sigabrt_7ffff6ae7cb7_7176_564bbc6741bdcf907f5c4e685c9a77a2.mpg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b65efbc0f4195421c15d2a6c228d331eec5b31c3)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:45 +01:00
Michael Niedermayer
974f9d255d avcodec/wmaenc: Check ff_wma_init() for failure
Fixes null pointer dereference
Fixes: c4faf8280ba366bf00a79d425f2910a8/signal_sigsegv_1f96477_5177_1448ba7e4125faceb966f44ceb69abfa.qcp
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 19e456d48c90a1e3ceeb9e6241383384cc73dfdf)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:45 +01:00
Michael Niedermayer
302f11e719 avcodec/mpeg12enc: Move high resolution thread check to before initializing threads
Cleaner solution is welcome!

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a53fbda9dc92273054a103db7539d2bb6e9632b2)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:45 +01:00
Michael Niedermayer
6fabd85865 avcodec/ass_split: Fix null pointer dereference in ff_ass_style_get()
Fixes: 55d71971da50365d542ed14b65565fe1/signal_sigsegv_4765a4_8499_f146af090a94f591d6254515c7700ef5.mkv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 158f0545d81b2aca1c936490f80d13988616910e)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:45 +01:00
Michael Niedermayer
40e846bb3f avcodec/gif: Fix lzw buffer size
Fixes out of array access
Fixes: aaa479088e6fb40b04837b3119f47b04/asan_heap-oob_e38c68_8576_9d653078b2470700e2834636f12ff557.tga

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03d83ba34b2070878909eae18dfac0f519503777)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:45 +01:00
Michael Niedermayer
f6755e5e19 avcodec/put_bits: Assert buf_ptr in flush_put_bits()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3ef5de0f19774e2c3dd9b08ba2e8ab7241a4862a)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:45 +01:00
Michael Niedermayer
eb0872335f avcodec/tiff: Check subsample & rps values more completely
Fixes out of array access
Fixes: 83aedfb29af669c4d6e10f1bfad974d2/asan_heap-oob_1ab42fe_4984_9f6ec14462f8d8a00ea24b320572a963.tif

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 89f464e9c229006e16f6bb5403c5529fdd0a9edd)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-31 00:23:45 +01:00
Michael Niedermayer
9d230f4666 avcodec/aacenc: Check both channels for finiteness
Fixes null pointer dereference
Fixes: 10412fc52ecc6eab40ed67f82ca7b372/signal_sigsegv_2618c99_2129_f808373959e46afb165593332799ffbc.aif

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 057549a9ccc9fd32df71678e6abe69e10668186a)

Conflicts:

	libavcodec/aacenc.c
2016-01-31 00:23:45 +01:00
Andreas Cadhalpun
41157f6bff dca: fix misaligned access in avpriv_dca_convert_bitstream
src and dst are only 8-bit-aligned, so accessing them as uint16_t causes
SIGBUS crashes on architectures like sparc.

This fixes ubsan runtime error: load of misaligned address for type
'const uint16_t', which requires 2 byte alignment

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 44ac13eed49593f4f8efdb72ab0d5b48e05aa305)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-01-28 01:05:05 +01:00
Andreas Cadhalpun
6fe77207ed vorbisdec: reject rangebits 0 with non-0 partitions
This causes non-unique elements in floor_setup->data.t1.list, which
makes the stream undecodable according to the specification.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit e7a7b3135a4e5ba4bd2e144444d95a7563f53e9b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-01-28 00:49:17 +01:00
Andreas Cadhalpun
00a0c0fd75 vorbisdec: reject channel mapping with less than two channels
It causes the angle channel number to equal the magnitude channel
number, which makes the stream undecodable according to the
specification.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit b4b13848dec5420fa5dd9e1a7d4dfae5de1932d5)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-01-28 00:49:12 +01:00
Paul B Mahol
0c03d860f4 avformat/ipmovie: put video decoding_map_size into packet and use it in decoder
The size of decoding map can differ from one calculated
internally, producing artifacts while decoding video.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit c293ef258cbb2c058e23651a26edf46e3bc05050)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2016-01-28 00:48:51 +01:00
James Almer
a697577a64 avcodec/wavpackenc: print channel count in av_log call
Fixes a warning with -Wformat-extra-args
(cherry picked from commit 17e7fdf61a04f52c499e2d06eab2cf2d22343aa9)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 17:53:59 +01:00
Michael Niedermayer
0e3c36518d avcodec/mpeg4video: Check time_incr
Fixes assertion failure
Fixes out of memory access

Fixes: test_casex.ivf

Found-by: Tyson Smith <twsmith@mozilla.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c97946d6131b31340954a3f603b6bf92590a9a5)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Michael Niedermayer
858f43043f avcodec/wavpackenc: Check the number of channels
They are stored in a byte, thus more than 255 is not possible

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 59c915a403af32c4ff5126625b0cc7e38f4beff9)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Michael Niedermayer
d0fd9bec1f avcodec/wavpackenc: Headers are per channel
Fixes: 1b8b83a53bfa751f01b1daa65a4758db/signal_sigabrt_7ffff6ae7cb7_7488_403f71d1a2565b598d01b6cb110fac8f.aiff
Fixes: assertion failure

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 26757b0279b4b93c6066c2151d4d3dbd2ec266bf)

Conflicts:

	libavcodec/wavpackenc.c

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Michael Niedermayer
d755045e78 avcodec/aacdec_template: Check id_map
Fixes index out of bounds error
Fixes: aac_index_out_of_bounds.wmv

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 590863876d1478547640304a31c15809c3618090)

Conflicts:

	libavcodec/aacdec_template.c
2016-01-15 16:00:31 +01:00
Michael Niedermayer
3820c6a979 avcodec/dvdec: Fix "left shift of negative value -254"
Fixes: dvdec_left_shift.avi

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 93ac72a98dff592ffc174cfb36a8975dfbf145ae)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Michael Niedermayer
7cfea0d41c avcodec/mjpegdec: Fix negative shift
Fixes: mjpeg_left_shift.avi

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d86d7b2486cd5c31db8e820d8a89554abf19567e)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Michael Niedermayer
8c08247990 avcodec/mss2: Check for repeat overflow
Fixes: mss2_left_shift.wmv

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e273dade78943e22b71d0ddb67cd0d737fc26edf)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Michael Niedermayer
3dd0d43d8c avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range
Fixes out of array read
Fixes: test_case-mdc.264 (b47be15a120979f5a1a945c938cbef33)

Found-by: Tyson Smith <twsmith@mozilla.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 13f266b50cc7554028d22480b7e4383968e64a63)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Michael Niedermayer
2c58d73413 avcodec/motion_est: Fix mv_penalty table size
Fixes out of array read

Found-by: Tyson Smith <twsmith@mozilla.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b4da8a38a5ed211df9504c85ce401c30af86b97)

Conflicts:

	libavcodec/motion_est.h
2016-01-15 16:00:31 +01:00
Michael Niedermayer
5b14f436c6 avcodec/h264_slice: Fix integer overflow in implicit weight computation
Fixes mozilla bug 1230423

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7cc01c25727a96eaaa0c177234b626e47c8ea491)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Michael Niedermayer
b65c06ee5e avcodec/put_bits: Always check buffer end before writing
This causes a overall slowdown of 0.1 % (tested with mpeg4 single thread encoding of matrixbench at QP=3)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cccb0ffccc3723acc7aab3a859b24743596dd9c0)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Andreas Cadhalpun
a7a7c6e44c mjpegdec: extend check for incompatible values of s->rgb and s->ls
This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.

In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.

This fixes an out-of-bounds read in ls_decode_line.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 7ea2db6eafa0a8a9497aab20be2cfc8742a59072)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 16:00:31 +01:00
Andreas Cadhalpun
3219de21f4 rawdec: only exempt BIT0 with need_copy from buffer sanity check
Otherwise the too small buffer is directly used in the frame, causing
segmentation faults, when trying to use the frame.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 699e68371ec7e381e5cc48e3d96e29c669261af7)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-12-20 14:18:08 +01:00
Andreas Cadhalpun
f040f3e5d5 xwddec: prevent overflow of lsize * avctx->height
This is used to check if the input buffer is large enough, so if this
overflows it can cause a false negative leading to a segmentation fault
in bytestream2_get_bufferu.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 9d38f06d05efbb9d6196c27668eb943e934943ae)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-12-20 14:17:55 +01:00