ffmpeg.git
3 years agoupdate for 0.5.13 n0.5.13
Michael Niedermayer [Wed, 25 Sep 2013 00:51:05 +0000 (02:51 +0200)]
update for 0.5.13

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/ffv1enc: update buffer check for 16bps
Michael Niedermayer [Mon, 9 Sep 2013 15:58:18 +0000 (17:58 +0200)]
avcodec/ffv1enc: update buffer check for 16bps

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3728603f1854b5c79d1a64dd3b41b80640ef1e7f)

Conflicts:

libavcodec/ffv1enc.c
(cherry picked from commit c900c6e5c26cd86cf34f9c8d4347cedbd01f3935)

4 years agoavcodec/dsputil: fix signedness in sizeof() comparissions
Michael Niedermayer [Fri, 30 Aug 2013 21:40:47 +0000 (23:40 +0200)]
avcodec/dsputil: fix signedness in sizeof() comparissions

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 454a11a1c9c686c78aa97954306fb63453299760)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agomatroska_read_seek: Fix used streams for subtitle index compensation
Michael Niedermayer [Mon, 20 May 2013 02:00:30 +0000 (04:00 +0200)]
matroska_read_seek: Fix used streams for subtitle index compensation

Might fix Ticket1907 (I have no testcase so i cant test)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4758e32a6c48044f77102a49110c79b4f338f648)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec/rpza: Perform pointer advance and checks before using the pointers
Michael Niedermayer [Wed, 21 Aug 2013 23:07:32 +0000 (01:07 +0200)]
avcodec/rpza: Perform pointer advance and checks before using the pointers

Fixes out of array accesses
Fixes Ticket2850

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3819db745da2ac7fb3faacb116788c32f4753f34)

Conflicts:

libavcodec/rpza.c
(cherry picked from commit edba432b8b01d68c22e70a508f47553359f59fb5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Sat, 17 Aug 2013 20:06:56 +0000 (22:06 +0200)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5:
  Bump version number for the 0.5.11 release
  update year to 2013

Conflicts:
VERSION

Merge is for metadata only, issues have been fixed in previous commits
already

Merged-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoBump version number for the 0.5.11 release
Reinhard Tartler [Thu, 9 May 2013 15:53:33 +0000 (17:53 +0200)]
Bump version number for the 0.5.11 release

4 years agoUpdate for 0.5.12 n0.5.12
Michael Niedermayer [Thu, 28 Feb 2013 02:54:37 +0000 (03:54 +0100)]
Update for 0.5.12

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoavcodec_align_dimensions2: Ensure cinepak has large enough buffers.
Michael Niedermayer [Wed, 20 Feb 2013 01:24:30 +0000 (02:24 +0100)]
avcodec_align_dimensions2: Ensure cinepak has large enough buffers.

This is partly redundant with the following patches, but its safer

Found-by: u-bo1b@0w.se
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f5c00b347dc76285c639d9878a014c40395c5228)

Conflicts:

libavcodec/utils.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2b6f3be08250683407c7a9846d7133b116661eae)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agowma: check byte_offset_bits
Michael Niedermayer [Wed, 30 Jan 2013 21:56:45 +0000 (22:56 +0100)]
wma: check byte_offset_bits

Fixes assertion failure

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 984add64a41c3296a8a82051cc90bff2eb449609)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agovqavideo: fix return type
Michael Niedermayer [Tue, 19 Feb 2013 23:47:13 +0000 (00:47 +0100)]
vqavideo: fix return type

Fixes Ticket2281

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1fd86f9a2136165205b0370d5a6e916499f1da7f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoupdate year to 2013
Reinhard Tartler [Sun, 17 Feb 2013 08:06:55 +0000 (09:06 +0100)]
update year to 2013

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agoupdate for 0.5.11 n0.5.11
Michael Niedermayer [Sun, 17 Feb 2013 02:55:49 +0000 (03:55 +0100)]
update for 0.5.11

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agovqavideo: check chunk sizes before reading chunks
Michael Niedermayer [Fri, 25 Jan 2013 05:11:59 +0000 (06:11 +0100)]
vqavideo: check chunk sizes before reading chunks

Fixes out of array writes

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ab6c9332bfa1e20127a16392a0b85a4aa4840889)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoroqvideodec: check dimensions validity
Michael Niedermayer [Thu, 29 Nov 2012 14:18:17 +0000 (15:18 +0100)]
roqvideodec: check dimensions validity

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3ae610451170cd5a28b33950006ff0bd23036845)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoqdm2: check array index before use, fix out of array accesses
Michael Niedermayer [Fri, 30 Nov 2012 22:59:40 +0000 (23:59 +0100)]
qdm2: check array index before use, fix out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a7ee6281f7ef1c29284e3a4cadfe0f227ffde1ed)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Sun, 17 Feb 2013 02:38:29 +0000 (03:38 +0100)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5:
  Release notes and changelog for 0.5.10

Merged-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoRelease notes and changelog for 0.5.10
Reinhard Tartler [Fri, 15 Feb 2013 18:41:04 +0000 (19:41 +0100)]
Release notes and changelog for 0.5.10

4 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Wed, 13 Feb 2013 12:36:32 +0000 (13:36 +0100)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5:
  mpeg12: do not decode extradata more than once.

Merged-by: Michael Niedermayer <michaelni@gmx.at>
4 years agompeg12: do not decode extradata more than once.
Anton Khirnov [Thu, 13 Dec 2012 16:53:31 +0000 (17:53 +0100)]
mpeg12: do not decode extradata more than once.

Fixes CVE-2012-2803.

(cherry picked from commit 582368626188c070d4300913c6da5efa4c24cfb2)
(cherry picked from commit 301761792a693a1f3303a2af34a0fb066a03c10c)

Conflicts:

libavcodec/mpeg12.c

4 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Mon, 11 Feb 2013 11:29:22 +0000 (12:29 +0100)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5: (21 commits)
  vp6: properly fail on unsupported feature
  vp56: release frames on error
  shorten: Use separate pointers for the allocated memory for decoded samples.
  shorten: check for realloc failure
  h264: check context state before decoding slice data partitions
  oggdec: check memory allocation
  Fix uninitialized reads on malformed ogg files.
  lavf: avoid integer overflow in ff_compute_frame_duration()
  yuv4mpeg: reject unsupported codecs
  tiffenc: Check av_malloc() results.
  mpegaudiodec: fix short_start calculation
  h264: avoid stuck buffer pointer in decode_nal_units
  yuv4mpeg: return proper error codes.
  avidec: return 0, not packet size from read_packet().
  cavsdec: check for changing w/h.
  avidec: use actually read size instead of requested size
  bytestream: add a new set of bytestream functions with overread checking
  avsdec: Set dimensions instead of relying on the demuxer.
  lavfi: avfilter_merge_formats: handle case where inputs are same
  bmpdec: only initialize palette for pal8.
  ...

Merged-by: Michael Niedermayer <michaelni@gmx.at>
4 years agovp6: properly fail on unsupported feature
Luca Barbato [Thu, 13 Dec 2012 15:20:19 +0000 (16:20 +0100)]
vp6: properly fail on unsupported feature

Interlacing is not supported at all and mismanaged down the normal
codepaths causing possible buffer management issues.

Fixes: CVE-2012-2783
(cherry picked from commit be75fed9755c1285ba084574aff2d7ee0f81110d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 4ede95e69cf964cd46b1e9fcd48da80d8d92c433)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agovp56: release frames on error
Luca Barbato [Fri, 14 Dec 2012 08:55:04 +0000 (09:55 +0100)]
vp56: release frames on error

Fixes CVE-2012-2783

CC: libav-stable@libav.org
(cherry picked from commit f33b5ba63eee96c9d1c7f0e568169cb0c3694238)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 7fd7950174f9f2935fbf5bf1435fd0dc37be5c61)

Conflicts:

libavcodec/vp56.c

4 years agoshorten: Use separate pointers for the allocated memory for decoded samples.
Michael Niedermayer [Sun, 25 Dec 2011 11:28:50 +0000 (12:28 +0100)]
shorten: Use separate pointers for the allocated memory for decoded samples.

Fixes invalid free() if any of the buffers are not allocated due to either
not decoding a header or an error prior to allocating all buffers.

Fixes CVE-2012-0858
CC: libav-stable@libav.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 204cb29b3c84a74cbcd059d353c70c8bdc567d98)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agoshorten: check for realloc failure
Justin Ruggles [Thu, 15 Sep 2011 22:08:52 +0000 (18:08 -0400)]
shorten: check for realloc failure

(cherry picked from commit 9e5e2c2d010c05c10337e9c1ec9d0d61495e0c9c)

Conflicts:

libavcodec/shorten.c

4 years agoh264: check context state before decoding slice data partitions
Janne Grunau [Wed, 28 Nov 2012 21:17:14 +0000 (22:17 +0100)]
h264: check context state before decoding slice data partitions

Fixes mov_h264_aac__Demo_FlagOfOurFathers.mov.SIGSEGV.4e9.656.

Found-by: Mateusz "j00ru" Jurczyk
CC: libav-stable@libav.org
(cherry-picked from commit c1fcf563b13051f280db169ba41c6a1b21b25e08)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agooggdec: check memory allocation
Luca Barbato [Sat, 22 Dec 2012 16:58:24 +0000 (17:58 +0100)]
oggdec: check memory allocation

(cherry picked from commit ba064ebe48376e199f353ef0b335ed8a39c638c5)

Conflicts:

libavformat/oggdec.c

4 years agoFix uninitialized reads on malformed ogg files.
Dale Curtis [Wed, 7 Mar 2012 22:26:58 +0000 (14:26 -0800)]
Fix uninitialized reads on malformed ogg files.

The ogg decoder wasn't padding the input buffer with the appropriate
FF_INPUT_BUFFER_PADDING_SIZE bytes. Which led to uninitialized reads in
various pieces of parsing code when they thought they had more data than
they actually did.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit ef0d779706c77ca9007527bd8d41e9400682f4e4)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agolavf: avoid integer overflow in ff_compute_frame_duration()
Janne Grunau [Fri, 23 Nov 2012 13:05:36 +0000 (14:05 +0100)]
lavf: avoid integer overflow in ff_compute_frame_duration()

Scaling the denominator instead of the numerator if it is too large
loses precision. Fixes an assert caused by a negative frame duration in
the fuzzed sample nasa-8s2.ts_s202310.

CC: libav-stable@libav.org
(cherry picked from commit 7709ce029a7bc101b9ac1ceee607cda10dcb89dc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agoyuv4mpeg: reject unsupported codecs
Luca Barbato [Fri, 26 Oct 2012 20:55:04 +0000 (22:55 +0200)]
yuv4mpeg: reject unsupported codecs

The muxer already rejects unsupported pixel formats, reject also
unsupported codecs to prevent dangerous misuses.
(cherry picked from commit 424b1e764263b1493de4c34365ef367ddae856db)

Conflicts:

libavformat/yuv4mpeg.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agotiffenc: Check av_malloc() results.
Alex Converse [Wed, 19 Sep 2012 18:12:58 +0000 (11:12 -0700)]
tiffenc: Check av_malloc() results.

(cherry picked from commit b92dfb56d4582633571db18c3d904f8602eaa2a6)

Conflicts:

libavcodec/tiffenc.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agompegaudiodec: fix short_start calculation
Luca Barbato [Fri, 28 Sep 2012 12:38:13 +0000 (14:38 +0200)]
mpegaudiodec: fix short_start calculation

The value should be always 3, as it follows from the specification.

Fix a stack buffer overflow in exponents_from_scale_factors as reported
by asan. Thanks to Dale Curtis for the sample vector.
(cherry picked from commit 97cfa55eea39cef30abe14682c56c1e4e7f6f10d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agoh264: avoid stuck buffer pointer in decode_nal_units
Jindřich Makovička [Sat, 29 Sep 2012 09:16:45 +0000 (11:16 +0200)]
h264: avoid stuck buffer pointer in decode_nal_units

When decode_nal_units() previously encountered a NAL_END_SEQUENCE,
and there are some junk bytes left in the input buffer, but no start codes,
buf_index gets stuck 3 bytes before the end of the buffer.

This can trigger an infinite loop in the caller code, eg. in
try_decode_trame(), as avcodec_decode_video() then keeps returning zeroes,
with 3 bytes of the input packet still available.

With this change, the remaining bytes are skipped so the whole packet gets
consumed.

CC:libav-stable@libav.org

Signed-off-by: Jindřich Makovička <makovick@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 1a8c6917f68f7378465e18f7615762bfd22704c2)

Conflicts:

libavcodec/h264.c

4 years agoyuv4mpeg: return proper error codes.
Anton Khirnov [Fri, 5 Oct 2012 13:53:32 +0000 (15:53 +0200)]
yuv4mpeg: return proper error codes.

Fixes Bug 373.

CC:libav-stable@libav.org
(cherry picked from commit d3a72becc6371563185a509b94f5daf32ddbb485)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agoavidec: return 0, not packet size from read_packet().
Anton Khirnov [Fri, 28 Sep 2012 13:26:48 +0000 (15:26 +0200)]
avidec: return 0, not packet size from read_packet().

(cherry picked from commit eeade678f0a2bac127aeed2fb68d8717a6463420)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
4 years agocavsdec: check for changing w/h.
Michael Niedermayer [Sat, 24 Mar 2012 01:40:24 +0000 (02:40 +0100)]
cavsdec: check for changing w/h.

Our decoder does not support changing w/h.

Fixes CVE-2012-2777 and CVE-2012-2784.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit c20a69630619d14ae92c5541d52c579d7c8f3e94)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agoavidec: use actually read size instead of requested size
Anton Khirnov [Fri, 28 Sep 2012 13:42:29 +0000 (15:42 +0200)]
avidec: use actually read size instead of requested size

Fixes CVE-2012-2788
(cherry picked from commit 0af49a63c7f87876486ab09482d5b26b95abce60)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agobytestream: add a new set of bytestream functions with overread checking
Aneesh Dogra [Mon, 19 Dec 2011 22:24:50 +0000 (03:54 +0530)]
bytestream: add a new set of bytestream functions with overread checking

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
4 years agoavsdec: Set dimensions instead of relying on the demuxer.
Michael Niedermayer [Fri, 20 Apr 2012 15:42:18 +0000 (17:42 +0200)]
avsdec: Set dimensions instead of relying on the demuxer.

The decode function assumes that the video will have those dimensions.

Fixes CVE-2012-2801

CC:libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 85f477935cd6b34e6ec2716b20e15ce748277a89)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agolavfi: avfilter_merge_formats: handle case where inputs are same
Mina Nagy Zaki [Wed, 8 Jun 2011 16:24:25 +0000 (19:24 +0300)]
lavfi: avfilter_merge_formats: handle case where inputs are same

This fixes a double-free crash if lists are the same due to the two
merge_ref() calls at the end of the (useless) merging that happens.

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 11b6a82412bcd372adf694a26d83b07d337e1325)

Conflicts:

libavfilter/formats.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
4 years agobmpdec: only initialize palette for pal8.
Anton Khirnov [Sun, 16 Sep 2012 06:33:09 +0000 (08:33 +0200)]
bmpdec: only initialize palette for pal8.

Gray8 is not considered to be paletted, so this would cause an invalid
write.

Fixes bug 367.

CC: libav-stable@libav.org
(cherry picked from commit 8b78c2969a5b7dca939d93bf525aa2bcd737b5d9)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
4 years agoBump version number for the 0.5.10 release
Reinhard Tartler [Thu, 24 Jan 2013 13:26:56 +0000 (14:26 +0100)]
Bump version number for the 0.5.10 release

4 years agohuffyuvdec: Skip len==0 cases
Michael Niedermayer [Tue, 29 Jan 2013 18:22:33 +0000 (19:22 +0100)]
huffyuvdec: Skip len==0 cases

Fixes vlc decoding for hypothetical files that would contain such cases.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0dfc01c2bbf4b71bb56201bc4a393321e15d1b31)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5ff41ffeb4cb9ea6df49757dc859619dc3d3ab4f)

Conflicts:

libavcodec/huffyuv.c
(cherry picked from commit 9bc70fe1ae50fd2faa0b9429d47cfbda01a92ebc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agohuffyuvdec: Check init_vlc() return codes.
Michael Niedermayer [Tue, 29 Jan 2013 17:29:41 +0000 (18:29 +0100)]
huffyuvdec: Check init_vlc() return codes.

Prevents out of array writes

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f67a0d115254461649470452058fa3c28c0df294)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95ab8d33e1a680f30a5a9605175112008ab81afc)

Conflicts:

libavcodec/huffyuv.c
(cherry picked from commit 277def59fce10d91e3113e5c0f63e22bc4abfa88)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
4 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Tue, 16 Oct 2012 16:04:18 +0000 (18:04 +0200)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5:
  lavfi: avfilter_merge_formats: handle case where inputs are same
  mpegvideo: Don't use ff_mspel_motion() for vc1
  imgconvert: avoid undefined left shift in avcodec_find_best_pix_fmt
  nuv: check RTjpeg header for validity
  vc1dec: add flush function for WMV9 and VC-1 decoders

Merged-by: Michael Niedermayer <michaelni@gmx.at>
4 years agolavfi: avfilter_merge_formats: handle case where inputs are same
Mina Nagy Zaki [Wed, 8 Jun 2011 16:24:25 +0000 (19:24 +0300)]
lavfi: avfilter_merge_formats: handle case where inputs are same

This fixes a double-free crash if lists are the same due to the two
merge_ref() calls at the end of the (useless) merging that happens.

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 11b6a82412bcd372adf694a26d83b07d337e1325)

Conflicts:

libavfilter/formats.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit e5f4e249422834f727bcd432b73af971277f1371)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit b6c5848a1f8fc2755ea70d325acaddae9fac45ab)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit a4e277312cacfb78ef7583ed0b4fe4ccf5a0bcb1)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
4 years agompegvideo: Don't use ff_mspel_motion() for vc1
Michael Niedermayer [Sun, 20 Nov 2011 16:19:25 +0000 (17:19 +0100)]
mpegvideo: Don't use ff_mspel_motion() for vc1

Using ff_mspel_motion assumes that s (a MpegEncContext
poiinter) really is a Wmv2Context.

This fixes crashes in error resilience on vc1/wmv3 videos.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 18f2d5cb9c48d06895960f37467576725c9dc2d1)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit da0c457663479bc1828918e1bb3e4a5e4de0d557)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 899d95efe12f1e250b361837c1c8c06df9ac9b86)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit c82ae85a8a78a98f7c7fea68d24a4ac0ca74d01f)

Conflicts:
libavcodec/mpegvideo_common.h

Signed-off-by: Anton Khirnov <anton@khirnov.net>
4 years agoimgconvert: avoid undefined left shift in avcodec_find_best_pix_fmt
Janne Grunau [Mon, 2 Jul 2012 08:46:39 +0000 (10:46 +0200)]
imgconvert: avoid undefined left shift in avcodec_find_best_pix_fmt

CC: libav-stable@libav.org
(cherry picked from commit 39bb27bf79bc4c2d8beaed637a14176264cb1916)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 7a7229b52d1900279041991fadbd29b27e8dfe95)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 8812b5f164109553f009ce385e17a1af16b6ea53)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit fd7426ed898533bed98e6b472ff5f5c8e47f2eb5)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
4 years agonuv: check RTjpeg header for validity
Janne Grunau [Mon, 6 Aug 2012 11:59:04 +0000 (13:59 +0200)]
nuv: check RTjpeg header for validity

CC: libav-stable@libav.org
(cherry picked from commit 859a579e9bbf47fae2e09494c43bcf813dcb2fad)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 6704522ca9dd32c858ee474492be568c386910f9)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit f31170d4e7f9671e019315391160d454b18d7296)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 459feb7cce03af7154c098171fc9d36fc9d472f6)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
4 years agovc1dec: add flush function for WMV9 and VC-1 decoders
Kostya Shishkov [Thu, 27 Sep 2012 17:25:06 +0000 (19:25 +0200)]
vc1dec: add flush function for WMV9 and VC-1 decoders

CC: libav-stable@libav.org
(cherry picked from commit 4dc8c8386eef942dba35c4f2fb3210e22b511a5b)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 02b72394627933dc8ce26445231a69f00dba491b)

Conflicts:
libavcodec/vc1dec.c

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 0173a7966b331105158a88f96b9afcc431d2fef8)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit aa4121276777b20eaaa83bf9bd544b00748c865c)

Conflicts:
libavcodec/vc1dec.c

Signed-off-by: Anton Khirnov <anton@khirnov.net>
5 years agoFix muxing mjpeg in swf.
Carl Eugen Hoyos [Thu, 13 Sep 2012 07:26:55 +0000 (09:26 +0200)]
Fix muxing mjpeg in swf.
(cherry picked from commit 79234907128390d775ceb1206dd0fed111a17896)

5 years agoupdate for 0.5.10 n0.5.10
Michael Niedermayer [Sat, 9 Jun 2012 20:18:07 +0000 (22:18 +0200)]
update for 0.5.10

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agowmv1: check that the input buffer is large enough
Michael Niedermayer [Fri, 1 Jun 2012 19:42:29 +0000 (21:42 +0200)]
wmv1: check that the input buffer is large enough

Fixes null ptr deref
Fixes Ticket1367

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f23a2418fb0ccc56fdae4dbf83a5994cc917c475)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agotruemotion1: Check index, fix out of array read
Michael Niedermayer [Wed, 30 May 2012 14:19:36 +0000 (16:19 +0200)]
truemotion1: Check index, fix out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fd4c1c0b70b5a06dd572d7e27799a2f4c3d9b984)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Sat, 9 Jun 2012 17:02:31 +0000 (19:02 +0200)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5:
  Release notes for 0.5.9
  Update changelog for 0.5.9 release

Conflicts:
RELEASE

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoRelease notes for 0.5.9
Reinhard Tartler [Sat, 9 Jun 2012 10:12:52 +0000 (12:12 +0200)]
Release notes for 0.5.9

5 years agoUpdate changelog for 0.5.9 release
Derek Buitenhuis [Fri, 8 Jun 2012 19:41:31 +0000 (15:41 -0400)]
Update changelog for 0.5.9 release

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
5 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Mon, 4 Jun 2012 10:29:16 +0000 (12:29 +0200)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5:
  Bump version number for 0.5.9 release.
  png: check bit depth for PAL8/Y400A pixel formats.
  tqi: Pass errors from the MB decoder
  eatqi: move "block" variable into context to ensure sufficient alignment for idct_put for compilers/architectures that can not align stack variables that much. This is also consistent with similar code in eatgq.c
  ea: check chunk_size for validity.
  vfwcap: Include windows.h before vfw.h since the latter requires defines from the former. Patch by kemuri <kemuri9 at gmail dot com>
  mingw32: merge checks for mingw-w64 and mingw32-runtime >= 3.15 into one
  mingw32: properly check if vfw capture is supported by the system headers
  Replace every usage of -lvfw32 with what is particularly necessary for that case: Avisynth -> -lavifil32 VFW Cap -> -lavicap32 Patch by kemuri <kemuri9 at gmail dot com>
  configure: properly check for mingw-w64 through installed headers. mingw-w64 can also target 32-bit code.
  qdm2: clip array indices returned by qdm2_get_vlc().
  kmvc: Check palsize.
  adpcm: ADPCM Electronic Arts has always two channels
  h264: Add check for invalid chroma_format_idc
  dpcm: ignore extra unpaired bytes in stereo streams.

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoBump version number for 0.5.9 release.
Reinhard Tartler [Sun, 3 Jun 2012 20:42:30 +0000 (22:42 +0200)]
Bump version number for 0.5.9 release.

5 years agopng: check bit depth for PAL8/Y400A pixel formats.
Reinhard Tartler [Sun, 3 Jun 2012 17:35:50 +0000 (19:35 +0200)]
png: check bit depth for PAL8/Y400A pixel formats.

Wrong bit depth can lead to invalid rowsize values, which crashes the
decoder further down.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d2205d6543881f2e6fa18c8a354bbcf91a1235f7)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit b8d6ba9d50e80fdce2ed74cdaffd4960df8a21c5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 33f93005f1a86c108302b4c5978aa1a3d8e092cc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 4c8c2660bd9252775c9a1dc2e2f36cb34718595a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:

libavcodec/pngdec.c

5 years agotqi: Pass errors from the MB decoder
Michael Niedermayer [Mon, 19 Dec 2011 03:13:37 +0000 (04:13 +0100)]
tqi: Pass errors from the MB decoder

This silences some valgrind warnings.
CC: libav-stable@libav.org
Fixes second half of http://ffmpeg.org/trac/ffmpeg/ticket/794
Bug found by: Oana Stratulat

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit f85334f58e1286287d0547a49fa9c93b40cbf48f)
(cherry picked from commit 90290a5150e84fb138ccde57657dc03830f08c1c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 5872580e65aab026b77754eb184f97ba7cc6ea35)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 2f2fd8c6d1c51a6b817e6c0bc4eff308b8f9cd18)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit c3edce42704142f4c66954e9f24d7fbf0e5ae423)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoeatqi: move "block" variable into context to ensure sufficient alignment for
Reimar Döffinger [Sun, 24 May 2009 09:14:19 +0000 (09:14 +0000)]
eatqi: move "block" variable into context to ensure sufficient alignment for
idct_put for compilers/architectures that can not align stack variables that much.
This is also consistent with similar code in eatgq.c

Originally committed as revision 18927 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit 1eda87ce6366189eebf9956f826dfd92d9e64d9c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoea: check chunk_size for validity.
Ronald S. Bultje [Fri, 4 May 2012 23:06:26 +0000 (16:06 -0700)]
ea: check chunk_size for validity.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 273e6af47b38391f2bcc157cca0423fe7fcbf55c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 6a86b705e1d4b72f0dddfbe23ad3eed9947001d5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit e74bc64dd376c4691a610ba62a66ed30affc97ec)

Conflicts:

libavformat/electronicarts.c
(cherry picked from commit 38c45adfca299e3d96c07a700032695ec7ff2aeb)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agovfwcap: Include windows.h before vfw.h since the latter requires defines from the...
kemuri [Sat, 23 Jan 2010 20:58:29 +0000 (20:58 +0000)]
vfwcap: Include windows.h before vfw.h since the latter requires defines from the former. Patch by kemuri <kemuri9 at gmail dot com>

Originally committed as revision 21411 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit 420755dd282a913c2163d5589706d6a99a18d10f)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
5 years agomingw32: merge checks for mingw-w64 and mingw32-runtime >= 3.15 into one
Ramiro Polla [Sun, 11 Jul 2010 22:31:41 +0000 (22:31 +0000)]
mingw32: merge checks for mingw-w64 and mingw32-runtime >= 3.15 into one

Originally committed as revision 24204 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit e26011d0f495de1148b8014995cbe923611b6b76)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
5 years agomingw32: properly check if vfw capture is supported by the system headers
Ramiro Polla [Sun, 11 Jul 2010 22:17:17 +0000 (22:17 +0000)]
mingw32: properly check if vfw capture is supported by the system headers

Remove check for an specific w32api version, checking instead if vfw.h
supports vfw capture. The defines in w32api 3.12 were wrong, so this must be
accounted for in the check.

Originally committed as revision 24203 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit ec1ee802a2e1cb3317bd44851cc28f95b5916051)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Conflicts:

configure

5 years agoReplace every usage of -lvfw32 with what is particularly necessary for that case...
kemuri [Sat, 23 Jan 2010 20:42:00 +0000 (20:42 +0000)]
Replace every usage of -lvfw32 with what is particularly necessary for that case: Avisynth -> -lavifil32 VFW Cap -> -lavicap32 Patch by kemuri <kemuri9 at gmail dot com>

Originally committed as revision 21410 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit a1b3c5a377976d21b9daa878265c6eada24c2543)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Conflicts:

configure

5 years agoconfigure: properly check for mingw-w64 through installed headers. mingw-w64 can...
Ramiro Polla [Sat, 10 Jul 2010 04:08:02 +0000 (04:08 +0000)]
configure: properly check for mingw-w64 through installed headers. mingw-w64 can also target 32-bit code.

Originally committed as revision 24156 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit 0a4307d6307516d333ce2cde2a2ffa0f50bc176c)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
5 years agoqdm2: clip array indices returned by qdm2_get_vlc().
Ronald S. Bultje [Wed, 2 May 2012 16:12:46 +0000 (16:12 +0000)]
qdm2: clip array indices returned by qdm2_get_vlc().

Prevents subsequent overreads when these numbers are used as indices
in arrays.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 64953f67f98da2e787aeb45cc7f504390fa32a69)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Conflicts:

libavcodec/qdm2.c

5 years agokmvc: Check palsize.
Alex Converse [Thu, 26 Jan 2012 16:30:49 +0000 (17:30 +0100)]
kmvc: Check palsize.

Fixes: CVE-2011-3952

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Based on fix by Michael Niedermayer
(cherry picked from commit 386741f887714d3e46c9e8fe577e326a7964037b)
(cherry picked from commit 416849f2e06227b1b4a451c392f100db1d709a0c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit e7392dc349291eb94379d8cfb7ef73d32a768858)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoadpcm: ADPCM Electronic Arts has always two channels
Janne Grunau [Thu, 5 Jan 2012 19:50:55 +0000 (20:50 +0100)]
adpcm: ADPCM Electronic Arts has always two channels

Fixes half of http://ffmpeg.org/trac/ffmpeg/ticket/794
Adresses CVE-2012-0852

(cherry picked from commit bb5b3940b08d8dad5b7e948e8f3b02cd2eb70716)

Conflicts:

libavcodec/adpcm.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit b581580bd1cc8506befa65b0a5c9ae429240f21f)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit a0f58c3a605b8123039628d1598cb36f1da0e815)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoh264: Add check for invalid chroma_format_idc
Alexander Strange [Sat, 24 Mar 2012 21:32:14 +0000 (17:32 -0400)]
h264: Add check for invalid chroma_format_idc

Fixes a crash when FF_DEBUG_PICT_INFO is used.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 6ef4063957aa5025c8d2cd757b6a537e4b6874df)

Fixes: CVE-2012-0851

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 47132345184dc3d0ff962a57a1225564fe979548)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit c5f7c755cfccd7aa01010a2d566104c2b0fa6d86)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 00d2c432581cf61326973a1a48f2e63690b65515)

5 years agodpcm: ignore extra unpaired bytes in stereo streams.
Alex Converse [Fri, 17 Feb 2012 22:13:40 +0000 (14:13 -0800)]
dpcm: ignore extra unpaired bytes in stereo streams.

Fixes: CVE-2011-3951

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ce7aee9b733134649a6ce2fa743e51733f33e67e)
(cherry picked from commit eaeaeb265fe46e1d81452960de918227541873b4)

Conflicts:

libavcodec/dpcm.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 1ce9c93198fc997e8f23934a78e2937af670e4e9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 41f1f146c9e29dde63e293078819474c9b8111a1)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agodsp: fix diff_bytes_mmx() with small width n0.5.9
Michael Niedermayer [Sat, 17 Mar 2012 19:45:45 +0000 (20:45 +0100)]
dsp: fix diff_bytes_mmx() with small width

Fixes Ticket1068

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 73089eccd3e48539555349b36d8aabbf1cea416e)

5 years agommdemux: dont set pkt->size to an invalid value.
Michael Niedermayer [Thu, 22 Mar 2012 23:49:00 +0000 (00:49 +0100)]
mmdemux: dont set pkt->size to an invalid value.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0c97fd336e17535239ab44d755a0d957dc2688f3)

5 years agoh261: check mtype.
Michael Niedermayer [Fri, 2 Mar 2012 14:58:14 +0000 (15:58 +0100)]
h261: check mtype.

Fixes out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ec3cd74f2dab8e3e8234ccb994132b23d3098585)

5 years ago4xmdemux: Check chunk size
Michael Niedermayer [Mon, 16 Apr 2012 12:30:33 +0000 (14:30 +0200)]
4xmdemux: Check chunk size

Fixes over reading the header array

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 474e31c904f766b6989fe614c3fb093e697c847f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agofix release number
Michael Niedermayer [Fri, 11 May 2012 20:37:20 +0000 (22:37 +0200)]
fix release number

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Fri, 11 May 2012 20:02:11 +0000 (22:02 +0200)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5:
  Bump version number for 0.5.8 release.
  Release notes and changelog for 0.5.7
  vqavideo: return error if image size is not a multiple of block size
  motionpixels: Clip YUV values after applying a gradient.
  mjpegbdec: Fix overflow in SOS.
  atrac3: Fix crash in tonal component decoding.
  dv: Fix small stack overread related to CVE-2011-3929 and CVE-2011-3936.
  dv: Fix null pointer dereference due to ach=0
  dv: check stype
  nsvdec: Propagate errors
  nsvdec: Be more careful with av_malloc().
  nsvdec: Fix use of uninitialized streams.

Conflicts:
libavcodec/atrac3.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoBump version number for 0.5.8 release.
Reinhard Tartler [Thu, 10 May 2012 18:21:51 +0000 (20:21 +0200)]
Bump version number for 0.5.8 release.

5 years agoRelease notes and changelog for 0.5.7
Reinhard Tartler [Thu, 10 May 2012 18:15:51 +0000 (20:15 +0200)]
Release notes and changelog for 0.5.7

5 years agovqavideo: return error if image size is not a multiple of block size
Mans Rullgard [Mon, 23 Apr 2012 12:16:33 +0000 (13:16 +0100)]
vqavideo: return error if image size is not a multiple of block size

The decoder assumes in various places that the image size
is a multiple of the block size, and there is no obvious
way to support odd sizes.  Bailing out early if the header
specifies a bad size avoids various errors later on.

Fixes CVE-2012-0947.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 58b2e0f0f2fc96c1158e04f8aba95cbe6157a1a3)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit d5207e2af81580dd5e6277b354c8b459c3624f26)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit c71c77e56fcc6d469d45e1c8ce04aa053124d3f8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit c90da45d5a7a4045dbf22fba52c63ef55d207269)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agomotionpixels: Clip YUV values after applying a gradient.
Alex Converse [Wed, 2 May 2012 19:08:03 +0000 (12:08 -0700)]
motionpixels: Clip YUV values after applying a gradient.

Prevents illegal reads on truncated and malformed input.

CC: libav-stable@libav.org
(cherry picked from commit b5da848facd41169283d7bfe568b83bdfa7fc42e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit aaa6a666774eb02c351c84e80622a5c69e9b642e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 50073e2395522b6e2b8698ff0dd06ffaf8cbf8ce)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 2134e7f6e88959513ba1713ad6fd7a7c8d5a0f41)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agomjpegbdec: Fix overflow in SOS.
Alex Converse [Wed, 25 Jan 2012 21:39:24 +0000 (13:39 -0800)]
mjpegbdec: Fix overflow in SOS.

Based in part by a fix from Michael Niedermayer <michaelni@gmx.at>

Fixes CVE-2011-3947

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit b57d262412204e54a7ef8fa1b23ff4dcede622e5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 083a8a00373b12dc06b8ae4c49eec61fb5e55f4b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 6ae95a0b93e8df15fe5f364535a7214be0817736)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 6ca010f20965ef71d97a53e871edae2eb9c05a5f)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoatrac3: Fix crash in tonal component decoding.
Michael Niedermayer [Sat, 17 Dec 2011 02:18:58 +0000 (03:18 +0100)]
atrac3: Fix crash in tonal component decoding.

Add a check to avoid writing past the end of the channel_unit.components[]
array.

Bug Found by: cosminamironesei
Fixes CVE-2012-0853
CC: libav-stable@libav.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit c509f4f74713b035a06f79cb4d00e708f5226bc5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit f43b6e2b1ed47a1254a5d44c700a7fad5e9784be)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit f728ad26f0ec87650d2986a892785c0e2b97d161)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 224025d852dcc42f752c0922fef7121808d1e42f)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agodv: Fix small stack overread related to CVE-2011-3929 and CVE-2011-3936.
Alex Converse [Thu, 26 Jan 2012 23:08:26 +0000 (15:08 -0800)]
dv: Fix small stack overread related to CVE-2011-3929 and CVE-2011-3936.

Found with asan.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 2d1c0dea5f6b91bec7f5fa53ec050913d851e366)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 00fa6ffe1a0b252d6a81815e51f125225cd0b97a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit a8f4db0acd9b588ba33e3b8c0c21feea5916cfd1)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agodv: Fix null pointer dereference due to ach=0
Michael Niedermayer [Tue, 24 Jan 2012 16:51:40 +0000 (17:51 +0100)]
dv: Fix null pointer dereference due to ach=0

dv: Fix null pointer dereference due to ach=0

Fixes part2 of CVE-2011-3929

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Roman Shaposhnik <roman@shaposhnik.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 5a396bb3a66a61a68b80f2369d0249729bf85e04)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 44e182d41e3a73548f3f5e8445ec428d3846e6d6)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit b46141b0d1d7efb74dad172b7c1b52413441592f)

Conflicts:

libavformat/dv.c

5 years agodv: check stype
Michael Niedermayer [Tue, 24 Jan 2012 16:48:23 +0000 (17:48 +0100)]
dv: check stype

dv: check stype

Fixes part1 of CVE-2011-3929
Possibly fixes part of CVE-2011-3936

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Roman Shaposhnik <roman@shaposhnik.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 635bcfccd439480003b74a665b5aa7c872c1ad6b)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit bb737d381f6d6413899a0697f426fb082eac66fc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 38421f27b3899a930552750fe1e0dffd45b71b8e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agonsvdec: Propagate errors
Alex Converse [Fri, 27 Jan 2012 01:23:09 +0000 (17:23 -0800)]
nsvdec: Propagate errors

Related to CVE-2011-3940.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit c898431ca5ef2a997fe9388b650f658fb60783e5)

Conflicts:

libavformat/nsvdec.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 0100c4b1b0736e0f5b3c98f9b0ab8acbef574888)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 3253dd2b420583a7f10afa87e47b9cb73e950e2a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agonsvdec: Be more careful with av_malloc().
Alex Converse [Fri, 27 Jan 2012 01:21:46 +0000 (17:21 -0800)]
nsvdec: Be more careful with av_malloc().

Check results for av_malloc() and fix an overflow in one call.

Related to CVE-2011-3940.

Based in part on work from Michael Niedermayer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit be524c186b50337db64d34a5726dfe3e8ea94f09)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 87007519c81c37d8a3de424de3db14078ae84333)

Conflicts:

libavformat/nsvdec.c

5 years agonsvdec: Fix use of uninitialized streams.
Michael Niedermayer [Tue, 24 Jan 2012 21:20:26 +0000 (22:20 +0100)]
nsvdec: Fix use of uninitialized streams.

Fixes CVE-2011-3940 (Out of bounds read resulting in out of bounds write)

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c011706bc752d34bc6ada31d7df2ca0c9af7c6b)

Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 6a89b41d9780325ba6d89a37f2aeb925aa68e6a3)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 65beb8c1173906b0541442713cb29e8ba44c47ef)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 1edf848a81464afd514afbbbcb97b471d334e14a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
5 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Mon, 2 Apr 2012 00:25:43 +0000 (02:25 +0200)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5:
  id3v2: fix skipping extended header in id3v2.4

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoid3v2: fix skipping extended header in id3v2.4
Anton Khirnov [Sat, 31 Mar 2012 05:52:42 +0000 (07:52 +0200)]
id3v2: fix skipping extended header in id3v2.4

In v2.4, the length includes the length field itself.
(cherry picked from commit ddb4431208745ea270dce8fce4cba999f0ed4303)

Conflicts:

libavformat/id3v2.c

Signed-off-by: Anton Khirnov <anton@khirnov.net>
5 years agoupdate for 0.5.8 n0.5.8
Michael Niedermayer [Thu, 12 Jan 2012 21:19:09 +0000 (22:19 +0100)]
update for 0.5.8

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoatrac3: Fix crash in tonal component decoding.
Michael Niedermayer [Sat, 17 Dec 2011 02:18:58 +0000 (03:18 +0100)]
atrac3: Fix crash in tonal component decoding.
Fixes Ticket780
Bug Found by: cosminamironesei

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoMerge remote-tracking branch 'qatar/release/0.5' into release/0.5
Michael Niedermayer [Thu, 12 Jan 2012 21:14:01 +0000 (22:14 +0100)]
Merge remote-tracking branch 'qatar/release/0.5' into release/0.5

* qatar/release/0.5:
  Release notes and changelog for 0.5.7
  Bump version number for 0.5.7 release.
  vorbis: An additional defense in the Vorbis codec.
  vorbisdec: Fix decoding bug with channel handling

Merged-by: Michael Niedermayer <michaelni@gmx.at>
5 years agoRelease notes and changelog for 0.5.7
Reinhard Tartler [Tue, 10 Jan 2012 21:22:05 +0000 (22:22 +0100)]
Release notes and changelog for 0.5.7

5 years agoBump version number for 0.5.7 release.
Reinhard Tartler [Tue, 10 Jan 2012 20:23:27 +0000 (21:23 +0100)]
Bump version number for 0.5.7 release.

5 years agovorbis: An additional defense in the Vorbis codec.
Chris Evans [Thu, 5 Jan 2012 20:25:41 +0000 (21:25 +0100)]
vorbis: An additional defense in the Vorbis codec.

Fixes Bug: #190
Chromium Bug: #100543
Related to CVE-2011-3893

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit afb2aa537954db537d54358997b68f46561fd5a7)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit b0283ccb9e8945ce9e56f7c6ba0c676e7179d7a3)

Conflicts:

libavcodec/vorbis_dec.c
(cherry picked from commit a5e0afe3c936220a793db0cdae04bb228f1904e0)

Conflicts:

libavcodec/vorbis_dec.c

5 years agovorbisdec: Fix decoding bug with channel handling
Reinhard Tartler [Thu, 5 Jan 2012 20:40:18 +0000 (21:40 +0100)]
vorbisdec: Fix decoding bug with channel handling

Fixes Bug: #191
Chromium Bug: #101458
CVE-2011-3895

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit e6d527ff729e42d80e4756cab779ff4ad693631b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 97f23c72a3815739ab28e297ce60f943349f6939)

Conflicts:

libavcodec/vorbis_dec.c
(cherry picked from commit 42f0a6696889ba275aa2087b57fa99f7a97033a0)

Conflicts:

libavcodec/vorbis_dec.c