* release/0.8: (31 commits)
svq1dec: call avcodec_set_dimensions() after dimensions changed. Fixes NGS00148
vp3dec: Check coefficient index in vp3_dequant() Fixes NGS00145
qdm2dec: fix buffer overflow. Fixes NGS00144
h264: Fix invalid interlaced progressive MB combinations for direct mode prediction. Fixes Ticket312
mpegvideo: dont use ff_mspel_motion() for vc1 Fixes Ticket655
imgutils: Fix illegal read.
ac3probe: Detect Sonic Foundry Soft Encode AC3 as raw AC3. Our ac3 code chain can handle it fine. More ideal would be to write a demuxer that actually extracts what can be from the additional headers and uses it for whatever it can be used for.
mjpeg: support mpo Fixes stereoscopic_photo.mpo
Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info.
lavf: fix multiplication overflow in avformat_find_stream_info()
lavf: fix invalid reads in avformat_find_stream_info()
lavf: add avformat_find_stream_info()
lavc: fix parentheses placement in avcodec_open2().
lavc: introduce avcodec_open2() as a replacement for avcodec_open().
rawdec: use a default sample rate if none is specified. Fixes "ffmpeg -f s16le -i /dev/zero"
rawdec: add check on sample_rate
qdm2dec: check remaining input bits in the mainloop of qdm2_fft_decode_tones() This is neccessary but likely not sufficient to prevent out of array reads.
cinepak: check strip_size
wma: Check channel number before init. Fixes Ticket240
Do not try to read 16bit gray png files with alpha channel.
...
Conflicts:
libavcodec/version.h
libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Fixes NGS00144
This also adds a few lines of code from master that are needed for this fix.
Thanks to Phillip for suggestions to improve the patch.
Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Our ac3 code chain can handle it fine.
More ideal would be to write a demuxer that actually extracts what can be from the additional
headers and uses it for whatever it can be used for.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 30ca700ba1)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes stereoscopic_photo.mpo
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1d23e5246c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/0.7:
Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info.
lavf: fix multiplication overflow in avformat_find_stream_info()
lavf: fix invalid reads in avformat_find_stream_info()
lavf: add avformat_find_stream_info()
lavc: fix parentheses placement in avcodec_open2().
lavc: introduce avcodec_open2() as a replacement for avcodec_open().
Conflicts:
doc/APIchanges
libavcodec/utils.c
libavcodec/version.h
libavformat/avformat.h
libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Converting to double before the multiplication rather than after
avoids an integer overflow in some cases.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 52767d891c)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
It supports passing options to codecs.
(cherry picked from commit a67c061e0f)
Conflicts:
libavformat/utils.c
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Adds support for decoder-private options and makes setting other options
simpler.
(cherry picked from commit 0b950fe240)
Conflicts:
libavcodec/avcodec.h
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Prevent error condition in case sample_rate is unset or set to a negative
value. In particular, fix divide-by-zero error occurring in ffmpeg due to
sample_rate set to 0 in output_packet(), in code:
ist->next_pts += ((int64_t)AV_TIME_BASE * ist->st->codec->frame_size) /
ist->st->codec->sample_rate;
Fix trac ticket #324.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This is neccessary but likely not sufficient to prevent out of array reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 14db3af4f2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes Ticket240
Based on patch by ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 20431a9982)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
FFmpeg does not support gray16a.
Fixes the crash in ticket #644.
(cherry picked from commit 0c5fd6372e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avfilter_draw_slice() is already called in the end_frame() callback,
this avoids multiple calls. This is done by adding a null draw_slice()
callback.
In particular fix crash occurring with -vf transpose=3,hflip, fix trac
issue #371.
(cherry picked from commit d9c23a0d5a)
avfilter_draw_slice() is already called in the end_frame() callback,
this avoids multiple calls. This is done by adding a null draw_slice()
callback.
In particular fix crash occurring with -vf transpose=3,hflip, fix trac
issue #371.
(cherry picked from commit d9c23a0d5a)
There were multiple issues, for example might we have to re-run
the decompression when the size of the buffer increased,
we should always use a decompression buffer large enough for
the header (so we do not get stuck when the size is too small).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Treating them like 0 is safest, current code would invoke
undefined pointer arithmetic behaviour in this case.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit b9242fd12f)
(cherry picked from commit 0411b19289)
There were multiple issues, for example might we have to re-run
the decompression when the size of the buffer increased,
we should always use a decompression buffer large enough for
the header (so we do not get stuck when the size is too small).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Treating them like 0 is safest, current code would invoke
undefined pointer arithmetic behaviour in this case.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit b9242fd12f)
Seems to fix trac issue #569.
Sample is unfortunately not available, but it might be caused by
an index existing for non-existing audio stream (?).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit 6ea6ff053a)
Seems to fix trac issue #569.
Sample is unfortunately not available, but it might be caused by
an index existing for non-existing audio stream (?).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit 6ea6ff053a)
* release/0.8: (96 commits)
Version numbers for 0.8.6
snow: emu edge support Fixes Ticket592
imc: validate channel count
imc: check for ff_fft_init() failure (cherry picked from commit 95fee70d67)
libgsmdec: check output buffer size before decoding (cherry picked from commit b03761b130)
configure: fix arch x86_32
mp3enc: avoid truncating id3v1 tags by one byte
asfdec: Check packet_replic_size earlier
cin audio: validate the channel count
binkaudio: add some buffer overread checks.
atrac1: validate number of channels (cherry picked from commit bff5b2c1ca)
atrac1: check output buffer size before decoding (cherry picked from commit 33684b9c12)
vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426e4)
apedec: set s->currentframeblocks after validating nblocks
apedec: use unsigned int for 'nblocks' and make sure that it's within int range
apedec: check for data buffer realloc failure (cherry picked from commit 11ca8b2d74)
apedec: check for filter buffer allocation failure (cherry picked from commit 7500781313)
mpegaudiodec: check output data size based on avctx->frame_size
resample: Fix array size
resample2: fix potential overflow
...
Conflicts:
Doxyfile
RELEASE
VERSION
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Avoid writing the trailing null-byte for id3v1 tags if length reaches max length.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0f39fa0279)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e7db0a9ee)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
It prevents leaving the AVPacket uninitialized.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bc38e83793)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
avpicture_get_size() returns the size of buffer required for avpicture_layout.
For pseudo-paletted formats (gray8...) this size does not include the palette.
However, avpicture_layout doesn't know this and still writes the palette. Consequently,
avpicture_layout writes passed the length of the buffer. This fixes it
by fixing avpicture_layout so that it doesn't write the palette for these formats.
Signed-off-by: Matthew Einhorn <moiein2000@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e662b263d9)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This allows skipping past unsupported RTCP packet types, as
RFC 3550 section 6.1 mandates.
Currently this only has any practical effect if a sender puts
an unrecognized type before RTCP_BYE in a compounded packet, or
(incorrectly) does not put RTCP_SR first.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 07b77fe387)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
We actually read 20 bytes of these packets.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d6ecf5345)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Note, the other arm asm code is likely affected too and should be changed as well.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 96bc6485bc)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The bit_rate_value_minus1 and cpb_size_value_minus1 elements
allow a wider range than get_ue_golomb() supports. This
adds a get_ue_golomb_long() function supporting up to 31
leading zeros, which is the maximum for these syntax
elements, and uses it in decode_hrd_parameters().
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit fdba370f8a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Zero-length get_bits() is undefined, must check before calling.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit c79d2a20ba)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes a signed overflow from i << 24 when i == 255 by
making i unsigned. The result of the shift is already
assigned to an variable of unsigned type.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 8b19ae0761)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
On the first iteration through this code, last_dts is always
INT64_MIN (AV_NOPTS_VALUE) and the subtraction overflows in
an invalid manner. Although the result is only used if the
input values are valid, performing the subtraction is still
not allowed in a strict environment.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit a31e9f68a4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
In addition to avoiding undefined behaviour, an unsigned type
makes more sense for packing multiple 8-bit values.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit bb59156606)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Since nnz can be zero, this is needed to avoid a shift by 32.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit d12294304a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
If flush_put_bits() is called when the 32-bit buffer is empty,
e.g. after writing a multiple of 32 bits, and invalid shift by
32 is performed. Since flush_put_bits() is called infrequently,
this additional check should have negligible performance impact.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit ac6eab1496)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
It was wrong in colorspaces where horizontal and vertical chroma
subsampling are not the same, e.g. 422.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Based on code by DivX, Inc. / drffmpeg
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 51b0694bc0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fix is not ideal as it still limits the multithreading on field pictures
to the 2nd field only.
Ill try to fix it properly to allow both fields to decode concurrently but this
needs more work.
This bug exists since and was caused by:
commit ea6331f8bb
Author: Ronald S. Bultje <rsbultje@gmail.com>
Date: Mon Jun 20 10:24:33 2011 -0400
h264-mt: fix deadlock in packets with multiple slices (e.g. MP4).
(cherry picked from commit eaa21b6870)
* release/0.8: (185 commits)
h264: fix intra 16x16 mode check when using mbaff and constrained_intra_pred.
h264: check for invalid bit depth value.
h264: add entries for 11 and 12 bits in ff_h264_chroma_qp[][]
h264: fix the check for invalid SPS:num_ref_frames.
h264: do not let invalid values in h->ref_count on ff_h264_decode_ref_pic_list_reordering() errors.
Reject video with non multiple of 16 width/height in the 4xm decoder.
4xm decoder: fix data size for i2 frames.
4xm decoder: print some error messages in case of errors.
Check for out of bound accesses in the 4xm decoder.
Prevent block size from inreasing in the shorten decoder.
Check for out of bound reads in PTX decoder.
Clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffers used in 4xm decoder.
Fix the check for missing references in ff_er_frame_end() for H264.
Prevent NULL dereference when the huffman table is invalid in the 4xm decoder.
Fix use of uninitialized memory in 4X Technologies demuxer.
h264: increase ref_poc size to 32 as it can be per field.
h264: set unused ref_counts to 0 as a precautionary meassure.
Remove Chnagelog it has nothing to do with reality
fate: fix motion pixels checksum change caused by backported bugfix
avienc: Add a limit on the number of skiped frames muxed in a row.
...
Conflicts:
Doxyfile
RELEASE
VERSION
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This patch set the limit to 16.
For information, thoses previous commits:
41f7e2d11d5cbb0e70a0
assumed it was either 30 or 32.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bcf881a685)
* qatar/release/0.7: (73 commits)
Update Changelog for 0.7.2 release
Update RELEASE file for 0.7.2
lavf: do not set codec_tag for rawvideo
fate: allow testing with libavfilter disabled
fate: separate lavf-mxf_d10 test from lavf-mxf
Fix memory (re)allocation in matroskadec.c, related to MSVR-11-0080.
movenc: fix NULL reference in mov_write_tkhd_tag
movenc: create an alternate group for each media type
flvdec: Check for overflow before allocating arrays
ppc: fix some pointer to integer casts
ppc: fix 32-bit PIC build
rv34: Check for invalid slice offsets
rv34: Fix potential overreads
rv34: Avoid NULL dereference on corrupted bitstream
rv10: Reject slices that does not have the same type as the first one
lavf: Fix context pointer in av_open_input_stream when avformat_open_input fails
oggdec: fix out of bound write in the ogg demuxer
Fixed size given to init_get_bits().
smacker: fix a few off by 1 errors
Check for invalid VLC value in smacker decoder.
...
Conflicts:
RELEASE
libavcodec/avs.c
libavcodec/ppc/asm.S
libavcodec/rv34.c
libavcodec/xan.c
libavdevice/alsa-audio.h
libavformat/flvdec.c
libavformat/gxf.c
libavformat/utils.c
libswscale/x86/swscale_template.c
tests/ref/lavf/mov
tests/ref/lavf/mxf
Merged-by: Michael Niedermayer <michaelni@gmx.at>
On OS X, av_malloc(0) returns pointers that cause crashes when
freed.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e81e5e8ad2)
There is no valid reason the user should ever send such packets in the
first place, but the documentation for CODEC_CAP_DELAY states that the
codec is guaranteed not to get a NULL packet unless that capability is
set. That isn't true without preventing this case.
(cherry picked from commit 6326afd5e9)
The data pointers s->decoded[*] already take into account s->nwrap.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f42b3195d3)
Extradata should only be parsed from the avss, fiel, jp2h and alac atoms for
AVS, MJPEG, Motion JPEG 2000 and ALAC respectively.
This also fixes the mov demuxer coming up with bogus extradata for some
AVC-Intra samples due to the presence of fiel atoms.
(cherry picked from commit e571305a71)
Writing zeros to the high entries in the array need only be
done once as the cutoff position is constant throughout the
loop.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit bf00a73ace)
The previous default value 0x0 was not good, since it is not even
valid.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 1ee2014190)
In apply_unsharp(), when y is >= height, prevent out-of-buffer reading
from src, read from the last buffer line in src2 instead.
The check was implemented in the original unsharp libmpcodecs code and
lost in the port.
This also fixes output discrepancy between the two filters.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 998e8519ef)
av_realloc_f helps avoiding memory-leaks in typical uses of realloc.
Signed-off-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5cd754bca2)
av_size_mult helps checking for overflow when computing the size of a memory
area.
Signed-off-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b2600509fe)
wavpack_decode_block() supposes that it is called back with the exact
same buffer unless it has returned with an error. With multi-channels
files, wavpack_decode_frame() was breaking this assumption.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c2a016ad4d)
Adds an additional check before reading the next block header and avoids a
potential integer overflow when checking the metadata size against the
remaining buffer size.
(cherry picked from commit 4c5e7b27d5)
The buffer size and pointer were not checked prior to testing the first
byte of the buffer. These were sometimes checked before calling, but it is
better to add it inside the function as it takes buf and size arguments.
Signed-off-by: Alexander Strasser <eclipse7@gmx.net>
(cherry picked from commit 715f259bf9)
Replaces a very hackish hack to fix the same issue (call instruction
overwriting stack variables).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit 424bcc46b5)
As a signed integer, 1<<31 overflows, so force it to unsigned.
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit c2d3f56107)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
occurd during debug. I dont know if this can happen normally but if so
it would be quite bad.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit abe0dbea2e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The score of 50 can probably be raised if needed
Fixes Ticket490
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3f7dc480c1)
If the demuxer did not set a codec_tag, there is none and
inventing one makes no sense. This change stops the rawvideo
"decoder" over-writing user-supplied pixfmt with one derived
from the codec_tag. The pixfmt-codec_tag-pixfmt round-trip
is lossy since several pixfmts map to the same codec_tag.
This fixes fate-lavf-pixfmt with avfilter disabled.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit bb416bd68c)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This declares dependencies to skip tests using libavfilter
when it is disabled.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 908f12f342)
Conflicts:
configure
tests/Makefile
tests/fate.mak
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 0218808d49)
required to unbreak fate with --disable-avfilter
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Whitespace of the patch cleaned up by Aurel
Some of the issues have been reported by Steve Manzuik / Microsoft Vulnerability Research (MSVR)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 956c901c68)
Further suggestions from Kostya <kostya.shishkov@gmail.com> have been
implemented by Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 77d2ef13a8)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
st may be NULL when there are more mov streams than AVStreams, e.g. when
chapters are present.
(cherry picked from commit c92a2a4eb8)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
use put_bits_count to get the buffer fill state instead of
num_saved_bits as num_saved_bits is sometimes reset when
frames are lost
(Ticket 495)
(cherry picked from commit 780d45473c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4f6187c7356111540024901932294e9807061dd0)
use put_bits_count to get the buffer fill state instead of
num_saved_bits as num_saved_bits is sometimes reset when
frames are lost
(Ticket 495)
(cherry picked from commit 780d45473c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4f6187c7356111540024901932294e9807061dd0)
On allocation, the array length is multiplied by sizeof(int64_t),
this prevents the multiplication from overflowing.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a246cefa75)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Use uintptr_t instead of plain int. Without this change, the
comparisons will come out wrong for pointers in certain ranges.
Fixes random failures on ppc64. Also fixes some compiler warnings.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit d853e571ad)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
On 32-bit ppc, the GOT pointer must be loaded manually.
This adds a "get_got" assembler macro to compute the
GOT address. The "movrel" macro is updated to take an
additional parameter containing the GOT address since
no register is reserved for this purpose on ppc32.
These changes have no effect on ppc64 builds.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 6e4a35ced9)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
rv34_decode_slice() can return without allocating any pictures.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d0f6ab0298)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents crashes with some corrupted bitstreams.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4a29b47186)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Between ogg_save() and ogg_restore() calls, the number of streams
could have been reduced.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0e7efb9d23)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit b59efc9434)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
stereo & 16bit is untested due to lack of samples
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5166376f24)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 46b004959b)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
1<<31 overflows because 1 is signed, so force it to unsigned.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 5938e02185)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
In some places 0/mb_height were used in place of start_mb_y/end_mb_y.
Fixes SA00049, SA00058, SA10091, SA10097, SA10131, SA20021, SA30030
Improves PSNR in SA00054, SA00059, SA00060, SA10096, SA10098, SA20022,
SA30031, SA30032, SA40012, SA40013
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 1cf82cab08)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Previously, we would leave the left edge uninitialized, which led to
CBP prediction errors on slice edges, e.g. in SA10098.vc1.
(cherry picked from commit d4b9974465)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Correct computation of implicit weight tables when referencing pictures
that are marked for long reference.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 87cf70eb23)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The current check on MMCO parameters prohibits a "max long term frame index
plus 1" of 16 (frame idx of 15) for the "set max long term frame index" MMCO.
Fix this off-by-one error to allow the full range of legal values.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 29a09eae9a)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Audio found is not triggered on a CCE because a CCE alone has no output.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit d8425ed4af)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Metadata currently is written only at the start of the file in normal
cases, when transcoding from a rtmp source metadata could be
written later and the offset recorded can exceed 32bit.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 7f5bf4fbaf)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
bits_per_raw_sample is used in video as well, where sample_fmt is not used.
(cherry picked from commit d271d5b215)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents out of bounds reads when extradata is being decoded.
(cherry picked from commit 1f6f58d585)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
On some platforms EINVAL could be positive, ensure we return negative values.
(cherry picked from commit e5985185d2)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
According to MPEG-TS specs, the continuity_counter shall not be
incremented when the adaptation_field_control of the packet
equals '00' or '10'.
Signed-off-by: Jindrich Makovicka <jindrich.makovicka@nangu.tv>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 8923cfa328)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
In testing, the file output plugin gave a max buffer size of about 20 million
frames, which is way more than what is really needed and causes a memory
allocation error on my system.
(cherry picked from commit e35c674d13)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
buffer_size/4 is the value used by aplay. This fixes output to null
devices, e.g. writing ALSA output to a file.
(cherry picked from commit 8bfd7f6a47)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Set DV packet durations using fields_per_frame.
This requires turning gxf_stream_info into the demuxer's context for access to the value in gxf_packet().
Since MPEG-2 seems to work fine this done only for DV.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 99fecc64b0)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This reverts commit 2cf8355f98.
AVInputStream.nb_streams tracks number of streams found at the
beginning, new streams may appear that ffmpeg doesn't know about. Fixes
crash in this case.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Parse the extension flag bit when reading the MPEG4 AudioSpecificConfig.
This has nothing to do with SBR/PS contradictory to what was noted when it was removed.
(cherry picked from commit 7f01a4192c)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Some versions of the GNU assembler do not handle 64-bit
immediate operands containing arithmetic. Writing the
value out in full works correctly.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit fce1e43410)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Set the frame size when decoding DTS audio.
This has the side effect of fixing the computation of timestamps for DTS-HD in compute_pkt_fields. Since frame_size is
not currently set, the duration of a frame is being guessed based on the streams bitrate. But for DTS-HD, the bitrate
currently used is the rate of the DTS core which is much different than the whole DTS-HD stream and leads to a wildly
inaccurate frame duration estimate.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 49c7006c7e)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
filter_mb_fast assumed that qscale_table was padded like many of the other tables.
(cherry picked from commit 5029a40633)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents a crash when converting to NV12/21 without the bitexact
flags enabled.
(cherry picked from commit 0d994b2f45)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
* release/0.8: (154 commits)
vp6: partially propagate huffman tree building errors during coeff model parsing and fix misspelling
Check for huffman tree building error in vp6 decoder.
Release old pictures after a resolution change in vp5/6 decoder
Check for missing reference in vp5/6 decoder.
Check for invalid slices offsets in RV30/40 decoder.
Check output buffer size in nellymoser decoder.
Hack around gcc 4.6 breaking asm using call.
Fix dxva2 decoding for some H264 samples.
mp3demux: pass on error code on packet read.
Check for invalid slice offsets in real decoder.
rmdec: Reject invalid deinterleaving parameters
Use deinterleavers for demangling audio packets in RealMedia.
rv10: Reject slices that does not have the same type as the first one
rmdec: use the deinterleaving mode and not the codec when creating audio packets.
MAINTAINERS: add my GPG fingerprint. (cherry picked from commit 7882dc10f8)
Support 3IVD in isom, produced by 3ivx DivX Doctor.
mpegpsdec: fix reading first mpegps packet (cherry picked from commit b2f230e23d)
Avoid NULL dereference on corrupted bitstream with real decoder.
Reject slices that does not have the same type than the first one in RV10/RV20 decoder.
check all svq3_get_ue_golomb() returns.
...
Conflicts:
Doxyfile
RELEASE
VERSION
libavcodec/rv34.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* khirnov/release/0.7: (64 commits)
rv34: Check for invalid slice offsets
rv34: Fix potential overreads
rv34: Avoid NULL dereference on corrupted bitstream
rv10: Reject slices that does not have the same type as the first one
lavf: Fix context pointer in av_open_input_stream when avformat_open_input fails
oggdec: fix out of bound write in the ogg demuxer
Fixed size given to init_get_bits().
smacker: fix a few off by 1 errors
Check for invalid VLC value in smacker decoder.
Check and propagate errors when VLC trees cannot be built in smacker decoder.
Fixed off by one packet size allocation in the smacker demuxer.
Check for invalid packet size in the smacker demuxer.
ape demuxer: fix segfault on memory allocation failure.
xan: Add some buffer checks (cherry picked from commit 0872bb23b4)
Fixed size given to init_get_bits() in xan decoder. (cherry picked from commit 393d5031c6)
smacker demuxer: handle possible av_realloc() failure.
Fixed segfault with wavpack decoder on corrupted decorrelation terms sub-blocks.
cljr: init_get_bits size in bits instead of bytes (cherry picked from commit 0c1f5b93d9)
indeo2: fail if input buffer too small (cherry picked from commit b7ce4f1d1c)
indeo2: init_get_bits size in bits instead of bytes (cherry picked from commit 68ca330cbd)
...
Conflicts:
ffmpeg.c
libavdevice/alsa-audio.h
libavformat/gxf.c
libswscale/x86/swscale_template.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
gcc 4.6 no longer decrements esp to account for local variables.
Thus using call will end up overwriting some local variable.
So add an extra one it can safely clobber.
This is a huge hack because it's basically pure chance it works,
no idea how this is supposed to be done.
Fixes trac ticket #397.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit c928e91729)
gcc 4.6 no longer decrements esp to account for local variables.
Thus using call will end up overwriting some local variable.
So add an extra one it can safely clobber.
This is a huge hack because it's basically pure chance it works,
no idea how this is supposed to be done.
Fixes trac ticket #397.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit c928e91729)
Unlike other containers RealMedia stores its audio packets in scrambled form,
with interleaver ID preceeding audio codec ID. Currently deinterleaving
decision is tied to the codec while it's possible to have non-default
deinterleaver with audio codec (like Int0 deinterleaver instead of specific
one for Sipro).
Signed-off-by: Anton Khirnov <anton@khirnov.net>
rv34_decode_slice() can return without allocating any pictures.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 140dbcff35)
The fields "Number of Bytes" and "Number of Frames" are mixed up. "Bytes"
come first, "Frames" behind.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5d305c9398)
This prevents some crashes when corrupted bitstream reports e.g. P-type
slice in I-frame. Official RealVideo decoder demands all slices to be
of the same type too.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 23a1f0c592)
The move of avio_seek in avi_read_seek is to avoiding modifying
state if the seek would fail.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f9e083a156)
This reduces problems when underlying protocol is not
seekable even if marked as such or if the file has been
cut short.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ac1d489320)
Between ogg_save() and ogg_restore() calls, the number of streams
could have been reduced.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bc851a2946)
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e5e0580b93)
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8362a0ffed)
(cherry picked from commit 180e7829428e26413916f0cbc2ad85eeb1fb877e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bcef876f16)
If there is only 1 stream in an flv avformat_find_stream_info will continually
read until probesize is reached. This should stop it reading if the metadata
also claims there to be 1 stream.
(cherry picked from commit bcc531f04a)
This function should return number of samples decoded, not number of bytes
decoded.
Spotted by Uoti Urpala.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit bcd4aa8bec)
Ignore resolution change if resolution not defined in extradata.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit 09c5f990bc)
currently libavformat only allows seeking if a request with "Range:
0-" results in a 206 reply from the HTTP server which includes a
Content-Range header. But according to RFC 2616, the server may also
reply with a normal 200 reply (which is more efficient for a request
for the whole file). In fact Apache HTTPD 2.2.20 has changed the
behaviour in this way and it looks like this change will be kept in
future versions. The fix for libavformat is easy: Also look at the
Accept-Ranges header.
(cherry picked from commit 31dfc49598)
rv34_decode_slice() can return without allocating any pictures.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d0f6ab0298)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents crashes with some corrupted bitstreams.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4a29b47186)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Between ogg_save() and ogg_restore() calls, the number of streams
could have been reduced.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0e7efb9d23)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit b59efc9434)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
stereo & 16bit is untested due to lack of samples
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5166376f24)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 46b004959b)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
1<<31 overflows because 1 is signed, so force it to unsigned.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 5938e02185)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
In some places 0/mb_height were used in place of start_mb_y/end_mb_y.
Fixes SA00049, SA00058, SA10091, SA10097, SA10131, SA20021, SA30030
Improves PSNR in SA00054, SA00059, SA00060, SA10096, SA10098, SA20022,
SA30031, SA30032, SA40012, SA40013
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 1cf82cab08)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Previously, we would leave the left edge uninitialized, which led to
CBP prediction errors on slice edges, e.g. in SA10098.vc1.
(cherry picked from commit d4b9974465)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Correct computation of implicit weight tables when referencing pictures
that are marked for long reference.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 87cf70eb23)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
The current check on MMCO parameters prohibits a "max long term frame index
plus 1" of 16 (frame idx of 15) for the "set max long term frame index" MMCO.
Fix this off-by-one error to allow the full range of legal values.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 29a09eae9a)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Audio found is not triggered on a CCE because a CCE alone has no output.
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit d8425ed4af)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Metadata currently is written only at the start of the file in normal
cases, when transcoding from a rtmp source metadata could be
written later and the offset recorded can exceed 32bit.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 7f5bf4fbaf)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
bits_per_raw_sample is used in video as well, where sample_fmt is not used.
(cherry picked from commit d271d5b215)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents out of bounds reads when extradata is being decoded.
(cherry picked from commit 1f6f58d585)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
On some platforms EINVAL could be positive, ensure we return negative values.
(cherry picked from commit e5985185d2)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
According to MPEG-TS specs, the continuity_counter shall not be
incremented when the adaptation_field_control of the packet
equals '00' or '10'.
Signed-off-by: Jindrich Makovicka <jindrich.makovicka@nangu.tv>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 8923cfa328)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
In testing, the file output plugin gave a max buffer size of about 20 million
frames, which is way more than what is really needed and causes a memory
allocation error on my system.
(cherry picked from commit e35c674d13)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
buffer_size/4 is the value used by aplay. This fixes output to null
devices, e.g. writing ALSA output to a file.
(cherry picked from commit 8bfd7f6a47)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Set DV packet durations using fields_per_frame.
This requires turning gxf_stream_info into the demuxer's context for access to the value in gxf_packet().
Since MPEG-2 seems to work fine this done only for DV.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 99fecc64b0)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This reverts commit 2cf8355f98.
AVInputStream.nb_streams tracks number of streams found at the
beginning, new streams may appear that ffmpeg doesn't know about. Fixes
crash in this case.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Parse the extension flag bit when reading the MPEG4 AudioSpecificConfig.
This has nothing to do with SBR/PS contradictory to what was noted when it was removed.
(cherry picked from commit 7f01a4192c)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Some versions of the GNU assembler do not handle 64-bit
immediate operands containing arithmetic. Writing the
value out in full works correctly.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit fce1e43410)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Set the frame size when decoding DTS audio.
This has the side effect of fixing the computation of timestamps for DTS-HD in compute_pkt_fields. Since frame_size is
not currently set, the duration of a frame is being guessed based on the streams bitrate. But for DTS-HD, the bitrate
currently used is the rate of the DTS core which is much different than the whole DTS-HD stream and leads to a wildly
inaccurate frame duration estimate.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 49c7006c7e)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
filter_mb_fast assumed that qscale_table was padded like many of the other tables.
(cherry picked from commit 5029a40633)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This prevents a crash when converting to NV12/21 without the bitexact
flags enabled.
(cherry picked from commit 0d994b2f45)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
* release/0.8: (21 commits)
rtp: Fix integer underflow that could allow remote code execution.
cavsdec: avoid possible crash with crafted input
vf_scale: apply the same transform to the aspect during init that is applied per frame
Fix memory corruption in case of memory allocation failure in av_probe_input_buffer()
Make all option parsing functions match the function pointer type through which they are called.
mjpegdec; even better RSTn skiping Fixes Ticket426
jpegdec: better rst skiping Fixes Ticket426
mpeg4: fix another packed divx issue. Fixes getting_stuck.avi
mpeg4: adjust dummy frame threashold for packed divx. Fixes Ticket427
configure: add missing CFLAGS to fix building on the HURD
cavs: fix some crashes with invalid bitstreams
jpegdec: actually search for and parse RSTn
Fix compilation with --disable-avfilter. (cherry picked from commit 67a8251690)
libavfilter: fix --enable-small
0.8.2
cavs: fix oCERT #2011-002 FFmpeg/libavcodec insufficient boundary check
Fix possible crash when decoding mpeg streams.
Bink: clip AC coefficients during dequantization.
ffmpeg: fix passlogfile regression
Fix several security issues in matroskadec.c (MSVR-11-0080).
...
Conflicts:
Doxyfile
RELEASE
VERSION
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Fixes MSVR-11-0088
Credit: Jeong Wook Oh of Microsoft and Microsoft Vulnerability Research (MSVR)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ba9a7e0d71)
All option parsing functions now match the function pointer signature through
which they are called (int f(const char *, const char *), thereby working
reliably on all platforms.
Prefix all option processing functions with opt_
All option parsing functions now match the function pointer signature through
which they are called (int f(const char *, const char *), thereby working
reliably on all platforms.
Prefix all option processing functions with opt_
* qatar/release/0.7:
cavs: fix some crashes with invalid bitstreams
jpegdec: actually search for and parse RSTn
Conflicts:
libavcodec/mjpegdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Whitespace of the patch cleaned up by Aurel
Some of the issues have been reported by Steve Manzuik / Microsoft Vulnerability Research (MSVR)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 956c901c68)
{"vbv_delay","initial buffer fill time in periods of 27Mhz clock",0,FF_OPT_TYPE_INT64,{.dbl=0},0,INT64_MAX},
{"audio_service_type","audio service type",OFFSET(audio_service_type),FF_OPT_TYPE_INT,{.dbl=AV_AUDIO_SERVICE_TYPE_MAIN},0,AV_AUDIO_SERVICE_TYPE_NB-1,A|E,"audio_service_type"},
@@ -332,6 +332,9 @@ static int update_context_from_thread(AVCodecContext *dst, AVCodecContext *src,
dst->height=src->height;
dst->pix_fmt=src->pix_fmt;
dst->coded_width=src->coded_width;
dst->coded_height=src->coded_height;
dst->has_b_frames=src->has_b_frames;
dst->idct_algo=src->idct_algo;
dst->slice_count=src->slice_count;
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
