ffmpeg.git
23 months agoMAINTAINERS: Remove myself as leader release/0.10
Michael Niedermayer [Fri, 31 Jul 2015 13:54:38 +0000 (15:54 +0200)]
MAINTAINERS: Remove myself as leader

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f2c58931e629343f7d68258cc2b2d62c5f501ba5)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2 years agoUpdate for 0.10.16 n0.10.16
Michael Niedermayer [Thu, 12 Mar 2015 17:06:09 +0000 (18:06 +0100)]
Update for 0.10.16

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoroqvideoenc: set enc->avctx in roq_encode_init
Andreas Cadhalpun [Mon, 9 Mar 2015 18:24:09 +0000 (19:24 +0100)]
roqvideoenc: set enc->avctx in roq_encode_init

So far it is only set in roq_encode_frame, but it is used in
roq_encode_end to free the coded_frame. This currently segfaults if
roq_encode_frame is not called between roq_encode_init and
roq_encode_end.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cf82c426fadf90105e1fb9d5ecd267cc3aa2b288)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/tiff: move bpp check to after "end:"
Michael Niedermayer [Sun, 8 Mar 2015 22:27:43 +0000 (23:27 +0100)]
avcodec/tiff: move bpp check to after "end:"

This ensures that all current and future code-pathes get bpp checked

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d5e9fc782150d4596c72440a0aa02b7f4f1254b1)

Conflicts:

libavcodec/tiff.c

2 years agoavcodec/utils: Align YUV411 by as much as the other YUV variants
Michael Niedermayer [Sat, 7 Mar 2015 13:30:34 +0000 (14:30 +0100)]
avcodec/utils: Align YUV411 by as much as the other YUV variants

Fixes out of array accesses
Fixes: ffmpeg_mjpeg_crash2.avi

Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Tested-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e3201c38d53d2b8b24d0bc95d726b2cb1752dc12)

Conflicts:

libavcodec/utils.c

2 years agoavformat/bit: check that pkt->size is 10 in write_packet
Andreas Cadhalpun [Thu, 26 Feb 2015 20:38:50 +0000 (21:38 +0100)]
avformat/bit: check that pkt->size is 10 in write_packet

Ohter packet sizes are not supported by this muxer.

This avoids a null pointer dereference of pkt->data.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eeda2c3de8a8484d9e7d1e47ac836bec850b31fc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/adxdec: check avctx->channels for invalid values
Andreas Cadhalpun [Wed, 25 Feb 2015 21:55:44 +0000 (22:55 +0100)]
avformat/adxdec: check avctx->channels for invalid values

This avoids a null pointer dereference of pkt->data.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7faa40af982960608b117e20fec999b48011e5e0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoFix buffer_size argument to init_put_bits() in multiple encoders.
Dyami Caliri [Thu, 26 Feb 2015 18:17:01 +0000 (10:17 -0800)]
Fix buffer_size argument to init_put_bits() in multiple encoders.

Several encoders were multiplying the buffer size by 8, in order to get
a bit size. However, the buffer_size argument is for the byte size of
the buffer. We had experienced crashes encoding prores (Anatoliy) at
size 4096x4096.
(cherry picked from commit 50833c9f7b4e1922197a8955669f8ab3589c8cef)

Conflicts:

libavcodec/proresenc_kostya.c

Conflicts:

libavcodec/faxcompr.c
libavcodec/s302menc.c

Conflicts:

libavcodec/adpcmenc.c

2 years agoavcodec/zmbv: Check len before reading in decode_frame()
Michael Niedermayer [Wed, 25 Feb 2015 11:29:10 +0000 (12:29 +0100)]
avcodec/zmbv: Check len before reading in decode_frame()

Fixes out of array read
Fixes: asan_heap-oob_4d4eb0_3994_cov_3169972261_zmbv_15bit.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1f5c7781e63d6519192ada59c1e36bcecc92791d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/snowdec: Fix ref value check
Michael Niedermayer [Tue, 24 Feb 2015 02:12:22 +0000 (03:12 +0100)]
avcodec/snowdec: Fix ref value check

Fixes integer overflow and out of array read.
Fixes: signal_sigsegv_24169e6_3445_cov_3778346427_snow_chroma_bug.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8f4cbf940212079a34753c7f4d6c6b5a43586d30)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/a64multienc: fix use of uninitialized values in to_meta_with_crop
Andreas Cadhalpun [Sun, 22 Feb 2015 19:48:38 +0000 (20:48 +0100)]
avcodec/a64multienc: fix use of uninitialized values in to_meta_with_crop

Averaging over 2 pixels doesn't work correctly for the last pixel, because the
rest of the buffer is not initialized.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 87513d654546a99f8ddb045ca4fa5d33778a617e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/gxf: Use 64bit for res to avoid overflow
Michael Niedermayer [Fri, 20 Feb 2015 19:14:56 +0000 (20:14 +0100)]
avformat/gxf: Use 64bit for res to avoid overflow

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 12987f89007ee82b9d3a6090085dfaef8461ab8b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f8be605800b801e59ea49657a560287883ebfc8a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/mjpegdec: Skip blocks which are outside the visible area
Michael Niedermayer [Wed, 11 Feb 2015 02:33:53 +0000 (03:33 +0100)]
avcodec/mjpegdec: Skip blocks which are outside the visible area

Fixes out of array accesses
Fixes: ffmpeg_mjpeg_crash.avi

Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08509c8f86626815a3e9e68d600d1aacbb8df4bf)

Conflicts:

libavcodec/mjpegdec.c
(cherry picked from commit 0bb0716d9c0699895abcef2d3954c1d6e4157cb2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/h264_ps: More completely check the bit depths
Michael Niedermayer [Fri, 6 Feb 2015 03:11:56 +0000 (04:11 +0100)]
avcodec/h264_ps: More completely check the bit depths

Fixes out of array read
Fixes: asan_static-oob_30328b6_719_cov_3325483287_H264_artifacts_motion.h264

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 69aa79365c1e8e1cb597d33e77bf1062c2ef47d4)

Conflicts:

libavcodec/h264_ps.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/thp: Check av_get_packet() for failure not only for partial output
Michael Niedermayer [Thu, 5 Feb 2015 02:45:21 +0000 (03:45 +0100)]
avformat/thp: Check av_get_packet() for failure not only for partial output

Fixes null pointer dereference
Fixes: signal_sigsegv_db2c1f_3108_cov_163322880_pikmin2_opening1_partial.thp

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f2579dbb4b31e6ae731e7f5555680528ef3020ab)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/mjpegdec: Check number of components for JPEG-LS
Michael Niedermayer [Wed, 4 Feb 2015 19:48:30 +0000 (20:48 +0100)]
avcodec/mjpegdec: Check number of components for JPEG-LS

Fixes out of array accesses
Fixes: asan_heap-oob_1c1a4ea_1242_cov_2274415971_TESTcmyk.jpg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fabbfaa095660982cc0bc63242c459561fa37037)

Conflicts:

libavcodec/mjpegdec.c

2 years agoavcodec/mjpegdec: Check escape sequence validity
Michael Niedermayer [Wed, 4 Feb 2015 19:13:18 +0000 (20:13 +0100)]
avcodec/mjpegdec: Check escape sequence validity

Fixes assertion failure
Fixes: asan_heap-oob_1c1a4ea_1242_cov_2274415971_TESTcmyk.jpg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/mpc8: Use uint64_t in *_get_v() to avoid undefined behavior
Michael Niedermayer [Wed, 4 Feb 2015 13:47:41 +0000 (14:47 +0100)]
avformat/mpc8: Use uint64_t in *_get_v() to avoid undefined behavior

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 05e161952954acf247e0fd1fdef00559675c4d4d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/mpc8: fix broken pointer math
wm4 [Tue, 3 Feb 2015 18:04:11 +0000 (19:04 +0100)]
avformat/mpc8: fix broken pointer math

This could overflow and crash at least on 32 bit systems.

Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b737a2c52857b214be246ff615c6293730033cfa)

Conflicts:

libavformat/mpc8.c
(cherry picked from commit 49dd89f9027f3def12e170bb7d986d37812eedba)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/mpc8: fix hang with fuzzed file
wm4 [Tue, 3 Feb 2015 18:04:12 +0000 (19:04 +0100)]
avformat/mpc8: fix hang with fuzzed file

This can lead to an endless loop by seeking back a few bytes after each
attempted chunk read. Assuming negative sizes are always invalid, this
is easy to fix. Other code in this demuxer treats negative sizes as
invalid as well.

Fixes ticket #4262.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56cc024220886927350cfc26ee695062ca7ecaf4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/smacker: Fix number suffix
Michael Niedermayer [Sun, 1 Feb 2015 18:36:13 +0000 (19:36 +0100)]
avformat/smacker: Fix number suffix

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 465f3705b1ef832fd6904750d018f81f9044f3ab)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/utils: Fix number suffixes in tb_unreliable()
Michael Niedermayer [Sun, 1 Feb 2015 18:19:25 +0000 (19:19 +0100)]
avformat/utils: Fix number suffixes in tb_unreliable()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4b15bba2aec93776bfdc69a1bca42a4795a7d191)

Conflicts:

libavformat/utils.c
(cherry picked from commit e651a2f88c219e74c9851563e74100f7652a6005)

2 years agoavcodec/flac_parser: fix handling EOF if no headers are found
Michael Niedermayer [Sat, 17 Jan 2015 00:56:03 +0000 (01:56 +0100)]
avcodec/flac_parser: fix handling EOF if no headers are found

Fixes assertion failure
Fixes Ticket4269

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c4d85fc23c100f7a27d9bad710eb153214868e27)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/dvdsubdec: error on bitmaps with size 0
wm4 [Wed, 7 Jan 2015 22:57:50 +0000 (23:57 +0100)]
avcodec/dvdsubdec: error on bitmaps with size 0

Attemtping to decode them could lead to invalid writes with some fuzzed
samples.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bcaa9099b3648b47060e1724a97dc98b63c83702)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agocmdutils: update copyright year to 2015.
Johan Andersson [Sat, 3 Jan 2015 16:31:36 +0000 (17:31 +0100)]
cmdutils: update copyright year to 2015.

(cherry picked from commit 3e160652219ff4da433f5672ae1e5f4956abb815)

Conflicts:

cmdutils.c

2 years agoavformat/mov: fix integer overflow in mov_read_udta_string()
Michael Niedermayer [Tue, 6 Jan 2015 03:29:10 +0000 (04:29 +0100)]
avformat/mov: fix integer overflow in mov_read_udta_string()

Found-by: Paul Mehta <paul@paulmehta.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3859868c75313e318ebc5d0d33baada62d45dd75)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/dvdsubdec: fix out of bounds accesses
wm4 [Mon, 5 Jan 2015 03:45:26 +0000 (04:45 +0100)]
avcodec/dvdsubdec: fix out of bounds accesses

The code blindly trusted buffer offsets read from the file in the RLE
decoder. Explicitly check the offset. Also error out on other RLE
decoding errors.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c9151de7c42553bb145be608df8513c1287f1f24)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/indeo3: ensure offsets are non negative
Michael Niedermayer [Thu, 18 Dec 2014 17:57:27 +0000 (18:57 +0100)]
avcodec/indeo3: ensure offsets are non negative

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 368642361f3a589d7b0c23ea327d988edb434e3f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/indeo3: use signed variables to avoid underflow
Michael Niedermayer [Wed, 17 Dec 2014 02:14:21 +0000 (03:14 +0100)]
avcodec/indeo3: use signed variables to avoid underflow

Fixes out of array read
Fixes: signal_sigsegv_1b0a4da_1865_cov_2167818389_computer_anger.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3305acdc92fa37869f160a11a87741c8a0de0454)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoswscale: increase yuv2rgb table headroom
Michael Niedermayer [Tue, 16 Dec 2014 21:21:21 +0000 (22:21 +0100)]
swscale: increase yuv2rgb table headroom

Fixes out of array access
Fixes: case2_bad_read_yuv2rgbx32.mp4
Found-by: Michal Zalewski <lcamtuf@coredump.cx>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/vmdvideo: Check len before using it in method 3
Michael Niedermayer [Tue, 16 Dec 2014 15:24:55 +0000 (16:24 +0100)]
avcodec/vmdvideo: Check len before using it in method 3

Fixes out of array access
Fixes: asan_heap-oob_4d23ba_91_cov_3853393937_128.vmd

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3030fb7e0d41836f8add6399e9a7c7b740b48bfd)

Conflicts:

libavcodec/vmdav.c

2 years agoavformat/aviobuf: Check that avio_seek() target is non negative
Michael Niedermayer [Sun, 14 Dec 2014 16:26:11 +0000 (17:26 +0100)]
avformat/aviobuf: Check that avio_seek() target is non negative

Fixes out of array access

Suggested-by: Andrew Scherkus <scherkus@google.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ed86dbd05d61363dc1c0d33f3267e2177c985fdd)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/matroskadec: fix handling of recursive SeekHead elements
wm4 [Sat, 6 Dec 2014 15:53:30 +0000 (16:53 +0100)]
avformat/matroskadec: fix handling of recursive SeekHead elements

When matroska_execute_seekhead() is called, it goes through the list of
seekhead entries and attempts to read elements not read yet. When doing
this, the parser can find further SeekHead elements, and will extend the
matroska->seekhead list. This can lead to a (practically) infinite loop
with certain broken files. (Maybe it can happen even with valid files.
The demuxer doesn't seem to check correctly whether an element has
already been read.)

Fix this by ignoring elements that were added to the seekhead field
during executing seekhead entries.

This does not fix the possible situation when multiple SeekHead elements
after the file header (i.e. occur after the "before_pos" file position)
point to the same elements. These elements will probably be parsed
multiple times, likely leading to bugs.

Fixes ticket #4162.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6551acab6877addae815decd02aeca33ba4990c8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoswscale/x86/rgb2rgb_template: fix crash with tiny size and nv12 output
Michael Niedermayer [Wed, 3 Dec 2014 19:21:56 +0000 (20:21 +0100)]
swscale/x86/rgb2rgb_template: fix crash with tiny size and nv12 output

Fixes Ticket4151

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8524558858b7e14bc50afa10233e0194f591ab9d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/rmdec: Check codec_data_size
Michael Niedermayer [Wed, 3 Dec 2014 19:01:18 +0000 (20:01 +0100)]
avformat/rmdec: Check codec_data_size

Fixes infinite loop
Fixes Ticket4154

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a6f730730b82645a9d31aad0968487cb77d6946c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/pngdec: Check IHDR/IDAT order
Michael Niedermayer [Wed, 26 Nov 2014 14:45:47 +0000 (15:45 +0100)]
avcodec/pngdec: Check IHDR/IDAT order

Fixes out of array access
Fixes: asan_heap-oob_20a6c26_2690_cov_3434532168_mail.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 79ceaf827be0b070675d4cd0a55c3386542defd8)

Conflicts:

libavcodec/pngdec.c

2 years agoavcodec/mjpegdec: Fix context fields becoming inconsistent
Michael Niedermayer [Tue, 25 Nov 2014 12:53:06 +0000 (13:53 +0100)]
avcodec/mjpegdec: Fix context fields becoming inconsistent

Fixes out of array access
Fixes: asan_heap-oob_1ca4f85_2760_cov_144449187_miss_congeniality_pegasus_ljpg.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0eecf40935b22644e6cd74c586057237ecfd6844)

Conflicts:

libavcodec/mjpegdec.c
(cherry picked from commit 32d3acac727f3f4a6489ca129a5ea4ccdfcb34a5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/wmaprodec: Fix integer overflow in sfb_offsets initialization
Michael Niedermayer [Mon, 10 Nov 2014 22:07:50 +0000 (23:07 +0100)]
avcodec/wmaprodec: Fix integer overflow in sfb_offsets initialization

Fixes out of array read
Fixes: asan_heap-oob_2aec5b0_1828_classical_22_16_2_16000_v3c_0_exclusive_0_29.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5dcb99033df16eccc4dbbc4a099ad64457f9f090)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/h264_slice: Clear table pointers to avoid stale pointers
Michael Niedermayer [Sun, 2 Nov 2014 00:55:40 +0000 (01:55 +0100)]
avcodec/h264_slice: Clear table pointers to avoid stale pointers

Might fix Ticket3889

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 547fce95858ef83f8c25ae347e3ae3b8ba437fd9)

Conflicts:

libavcodec/h264_slice.c

Conflicts:

libavcodec/h264.c

2 years agoavcodec/dnxhddec: treat pix_fmt like width/height
Michael Niedermayer [Tue, 28 Oct 2014 23:57:07 +0000 (00:57 +0100)]
avcodec/dnxhddec: treat pix_fmt like width/height

Fixes out of array accesses
Fixes: asan_heap-oob_22c9a39_16_015.mxf
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f3c0e0bf6f53df0977f3878d4f5cec99dff8de9e)

Conflicts:

libavcodec/dnxhddec.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/dxa: check dimensions
Michael Niedermayer [Tue, 28 Oct 2014 14:26:42 +0000 (15:26 +0100)]
avcodec/dxa: check dimensions

Fixes out of array access
Fixes: asan_heap-oob_11222fb_21_020.dxa
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e70312dfc22c4e54d5716f28f28db8f99c74cc90)

Conflicts:

libavcodec/dxa.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/mpegts: Check desc_len / get8() return code
Michael Niedermayer [Sat, 4 Oct 2014 02:29:40 +0000 (04:29 +0200)]
avformat/mpegts: Check desc_len / get8() return code

Fixes out of array read
Fixes: signal_sigsegv_844d59_10_signal_sigsegv_a17bb7_366_mpegts_mpeg2video_mp2_dvbsub_topfield.rec

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c3d7f00ee3e09801f56f25db8b5961f25e842bd2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/qpeg: fix off by 1 error in MV bounds check
Michael Niedermayer [Fri, 3 Oct 2014 19:08:52 +0000 (21:08 +0200)]
avcodec/qpeg: fix off by 1 error in MV bounds check

Fixes out of array access
Fixes: asan_heap-oob_153760f_4_asan_heap-oob_1d7a4cf_164_VWbig6.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dd3bfe3cc1ca26d0fff3a3baf61a40207032143f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/pngdec: Calculate MPNG bytewidth more defensively
Michael Niedermayer [Fri, 3 Oct 2014 15:54:21 +0000 (17:54 +0200)]
avcodec/pngdec: Calculate MPNG bytewidth more defensively

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e830902934a29df05c7af65aef2a480b15f572c4)

Conflicts:

libavcodec/pngdec.c

2 years agoavcodec/pngdec: Check bits per pixel before setting monoblack pixel format
Michael Niedermayer [Fri, 3 Oct 2014 15:35:58 +0000 (17:35 +0200)]
avcodec/pngdec: Check bits per pixel before setting monoblack pixel format

Fixes out of array accesses
Fixes: asan_heap-oob_14dbfcf_4_asan_heap-oob_1ce5767_179_add_method_small.png

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e2b745020c2dbf0201fe7df3dad9e7e0b2e1bb6)

Conflicts:

libavcodec/pngdec.c

2 years agoavcodec/tiff: more completely check bpp/bppcount
Michael Niedermayer [Fri, 3 Oct 2014 14:08:32 +0000 (16:08 +0200)]
avcodec/tiff: more completely check bpp/bppcount

Fixes pixel format selection
Fixes out of array accesses
Fixes: asan_heap-oob_1766029_6_asan_heap-oob_20aa045_332_cov_1823216757_m2-d1d366d7965db766c19a66c7a2ccbb6b.tif

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e1c0cfaa419aa5d320540d5a1b3f8fd9b82ab7e5)

Conflicts:

libavcodec/tiff.c
(cherry picked from commit e9125e74897135d690cf44f6e6d39e80dcd07803)

Conflicts:

libavcodec/tiff.c

2 years agoavcodec/mmvideo: Bounds check 2nd line of HHV Intra blocks
Michael Niedermayer [Fri, 3 Oct 2014 12:45:04 +0000 (14:45 +0200)]
avcodec/mmvideo: Bounds check 2nd line of HHV Intra blocks

Fixes out of array access
Fixes: asan_heap-oob_4da4f3_8_asan_heap-oob_4da4f3_419_scene1a.mm

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8b0e96e1f21b761ca15dbb470cd619a1ebf86c3e)

Conflicts:

libavcodec/mmvideo.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/utils: Add case for jv to avcodec_align_dimensions2()
Michael Niedermayer [Fri, 3 Oct 2014 02:30:58 +0000 (04:30 +0200)]
avcodec/utils: Add case for jv to avcodec_align_dimensions2()

Fixes out of array accesses
Fixes: asan_heap-oob_12304aa_8_asan_heap-oob_4da4f3_300_intro.jv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 105654e376a736d243aef4a1d121abebce912e6b)

Conflicts:

libavcodec/utils.c

2 years agoavcodec/mjpegdec: check bits per pixel for changes similar to dimensions
Michael Niedermayer [Thu, 2 Oct 2014 23:50:27 +0000 (01:50 +0200)]
avcodec/mjpegdec: check bits per pixel for changes similar to dimensions

Fixes out of array accesses
Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c378d6a6df8243f06c87962b873bd563e58cd39)

Conflicts:

libavcodec/mjpegdec.c
(cherry picked from commit 94371a404c663c3dae3d542fa43951567ab67f82)

Conflicts:

libavcodec/mjpegdec.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/jpeglsdec: Check run value more completely in ls_decode_line()
Michael Niedermayer [Thu, 2 Oct 2014 21:17:21 +0000 (23:17 +0200)]
avcodec/jpeglsdec: Check run value more completely in ls_decode_line()

previously it could have been by 1 too large
Fixes out of array access
Fixes: asan_heap-oob_12240f5_1_asan_heap-oob_12240f5_448_t8c1e3.jls
Fixes: asan_heap-oob_12240f5_1_asan_heap-oob_12240f5_448_t8nde0.jls
Fixes: asan_heap-oob_12240fa_1_asan_heap-oob_12240fa_448_t16e3.jls

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 06e7d58410a17dc72c30ee7f3145fcacc425f4f2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoconfigure: add noexecstack to linker options if supported.
Reimar Döffinger [Sun, 21 Sep 2014 08:58:10 +0000 (09:58 +0100)]
configure: add noexecstack to linker options if supported.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit b7082d953fda93f7841ffffe7d15a6c3cd15bdee)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec/ac3enc_template: fix out of array read
Michael Niedermayer [Sat, 27 Sep 2014 18:34:44 +0000 (20:34 +0200)]
avcodec/ac3enc_template: fix out of array read

Found-by: Andreas Cadhalpun
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d85ebea3f3b68ebccfe308fa839fc30fa634e4de)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavformat/m4vdec: Check for non startcode 00 00 00 sequences in probe
Michael Niedermayer [Sun, 7 Sep 2014 14:39:39 +0000 (16:39 +0200)]
avformat/m4vdec: Check for non startcode 00 00 00 sequences in probe

Fixes miss detection of PCM as m4v
Fixes Ticket 3928

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7c1835c52a4be2e4e996f83c91a8d5a147b01100)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoavcodec: fix aac/ac3 parser bitstream buffer size
Michael Niedermayer [Thu, 21 Aug 2014 23:15:57 +0000 (01:15 +0200)]
avcodec: fix aac/ac3 parser bitstream buffer size

Buffers containing copies of the AAC and AC3 header bits were not padded
before parsing, violating init_get_bits() buffer padding requirement,
leading to potential buffer read overflows.
This change adds FF_INPUT_BUFFER_PADDING_SIZE bytes to the bit buffer
for parsing the header in each of aac_parser.c and ac3_parser.c.

Based on patch by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fccd85b9f30525f88692f53134eba41f1f2d90db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '0e810255596070e2c503c5da9001f7087f71de6e' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 22:12:31 +0000 (23:12 +0100)]
Merge commit '0e810255596070e2c503c5da9001f7087f71de6e' into release/0.10

* commit '0e810255596070e2c503c5da9001f7087f71de6e':
  doc: More changelog updates for v0.8.17

Conflicts:
Changelog

not merged

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '335ec616cc38ee6206a3acebd46d01aad73d721b' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 22:11:29 +0000 (23:11 +0100)]
Merge commit '335ec616cc38ee6206a3acebd46d01aad73d721b' into release/0.10

* commit '335ec616cc38ee6206a3acebd46d01aad73d721b':
  utvideodec: Handle slice_height being zero

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '76435f5e40854567252756ea7f788958dd2cc04c' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 22:09:55 +0000 (23:09 +0100)]
Merge commit '76435f5e40854567252756ea7f788958dd2cc04c' into release/0.10

* commit '76435f5e40854567252756ea7f788958dd2cc04c':
  doc: More changelog updates for v0.8.17

Conflicts:
Changelog

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'ec5b2f6a385959048f780b4e7d3d259dc1fa8421' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:51:05 +0000 (22:51 +0100)]
Merge commit 'ec5b2f6a385959048f780b4e7d3d259dc1fa8421' into release/0.10

* commit 'ec5b2f6a385959048f780b4e7d3d259dc1fa8421':
  tiff: Check that there is no aliasing in pixel format selection

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '82776caf7993221719eefbe576f851c7e52dfef9' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:50:45 +0000 (22:50 +0100)]
Merge commit '82776caf7993221719eefbe576f851c7e52dfef9' into release/0.10

* commit '82776caf7993221719eefbe576f851c7e52dfef9':
  rmenc: limit packet size

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '905988fe1a8accbc1ab93120aa4cd29252b81cce' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:50:00 +0000 (22:50 +0100)]
Merge commit '905988fe1a8accbc1ab93120aa4cd29252b81cce' into release/0.10

* commit '905988fe1a8accbc1ab93120aa4cd29252b81cce':
  eamad: check for out of bounds read

Conflicts:
libavcodec/eamad.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '8b1f8fb26bfe6a4cd9f72b962b45643fa331dbe1' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:49:09 +0000 (22:49 +0100)]
Merge commit '8b1f8fb26bfe6a4cd9f72b962b45643fa331dbe1' into release/0.10

* commit '8b1f8fb26bfe6a4cd9f72b962b45643fa331dbe1':
  Update Changelog for 0.8.17 Release

Conflicts:
Changelog

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'aace8b184c867875e2715b2af23fa98886f90427' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:39:24 +0000 (22:39 +0100)]
Merge commit 'aace8b184c867875e2715b2af23fa98886f90427' into release/0.10

* commit 'aace8b184c867875e2715b2af23fa98886f90427':
  Prepare for 0.8.17 Release

Conflicts:
RELEASE

not merged

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'd6deed7916f7f52dbfc88e2fc2c43e3cfb8ee74b' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:37:34 +0000 (22:37 +0100)]
Merge commit 'd6deed7916f7f52dbfc88e2fc2c43e3cfb8ee74b' into release/0.10

* commit 'd6deed7916f7f52dbfc88e2fc2c43e3cfb8ee74b':
  h264_cabac: Break infinite loops

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '51dd54c51aaca909893c9f90a4119e96ff71ffdf' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:37:11 +0000 (22:37 +0100)]
Merge commit '51dd54c51aaca909893c9f90a4119e96ff71ffdf' into release/0.10

* commit '51dd54c51aaca909893c9f90a4119e96ff71ffdf':
  matroskadec: Fix read-after-free in matroska_read_seek()

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '9ae3cd6e7271a3d6b8cd92a4d35ebb16d2e03f1a' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:32:08 +0000 (22:32 +0100)]
Merge commit '9ae3cd6e7271a3d6b8cd92a4d35ebb16d2e03f1a' into release/0.10

* commit '9ae3cd6e7271a3d6b8cd92a4d35ebb16d2e03f1a':
  gifdec: refactor interleave end handling

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'a331e11906b196c9a00f5ffbc45d80fcd7fe8423' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:31:54 +0000 (22:31 +0100)]
Merge commit 'a331e11906b196c9a00f5ffbc45d80fcd7fe8423' into release/0.10

* commit 'a331e11906b196c9a00f5ffbc45d80fcd7fe8423':
  smc: fix the bounds check

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'fc159ba88ea2dd1fa11e4ab6af8b574fc80db454' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:31:40 +0000 (22:31 +0100)]
Merge commit 'fc159ba88ea2dd1fa11e4ab6af8b574fc80db454' into release/0.10

* commit 'fc159ba88ea2dd1fa11e4ab6af8b574fc80db454':
  mmvideo: check frame dimensions

Conflicts:
libavcodec/mmvideo.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '954aafaa961c32c655ad38fb622e8cbe249ebd5a' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:20:49 +0000 (22:20 +0100)]
Merge commit '954aafaa961c32c655ad38fb622e8cbe249ebd5a' into release/0.10

* commit '954aafaa961c32c655ad38fb622e8cbe249ebd5a':
  jvdec: check frame dimensions

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '0ceb2dffb6ba082a8abcc57c53a14b2512f0aa48' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:20:28 +0000 (22:20 +0100)]
Merge commit '0ceb2dffb6ba082a8abcc57c53a14b2512f0aa48' into release/0.10

* commit '0ceb2dffb6ba082a8abcc57c53a14b2512f0aa48':
  mov: avoid a memleak when multiple stss boxes are present

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '22103315c2a1cb2de336750c50cf6bf7c109220c' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:19:30 +0000 (22:19 +0100)]
Merge commit '22103315c2a1cb2de336750c50cf6bf7c109220c' into release/0.10

* commit '22103315c2a1cb2de336750c50cf6bf7c109220c':
  Add some bug references to the changelog

Conflicts:
Changelog

not merged as this isnt the FFmpeg Changelog

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'b989bb7adee0f3286dcaa63c5cd0753eac45f6be' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:05:00 +0000 (22:05 +0100)]
Merge commit 'b989bb7adee0f3286dcaa63c5cd0753eac45f6be' into release/0.10

* commit 'b989bb7adee0f3286dcaa63c5cd0753eac45f6be':
  apetag: Fix APE tag size check

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '893b353362bc220280efd8d14c4878a1cafe18a8' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:04:41 +0000 (22:04 +0100)]
Merge commit '893b353362bc220280efd8d14c4878a1cafe18a8' into release/0.10

* commit '893b353362bc220280efd8d14c4878a1cafe18a8':
  x86: Only use optimizations with cmov if the CPU supports the instruction

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '8637f4edeee1a6bd18bc90740fafadd3e1b412aa' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 21:04:04 +0000 (22:04 +0100)]
Merge commit '8637f4edeee1a6bd18bc90740fafadd3e1b412aa' into release/0.10

* commit '8637f4edeee1a6bd18bc90740fafadd3e1b412aa':
  x86: Add CPU flag for the i686 cmov instruction

Conflicts:
doc/APIchanges
libavutil/avutil.h

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'c6af9e944ebeb336f6520f59afaebb62392fb026' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:55:54 +0000 (21:55 +0100)]
Merge commit 'c6af9e944ebeb336f6520f59afaebb62392fb026' into release/0.10

* commit 'c6af9e944ebeb336f6520f59afaebb62392fb026':
  Update Changelog for v0.8.16
  Prepare for 0.8.16 release
  Update Changelog for v0.8.15

Conflicts:
Changelog
RELEASE

not merged

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'f661006f235fa58bc756610cdc76c662ac0fab5f' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:54:41 +0000 (21:54 +0100)]
Merge commit 'f661006f235fa58bc756610cdc76c662ac0fab5f' into release/0.10

* commit 'f661006f235fa58bc756610cdc76c662ac0fab5f':
  doc: Fix syntax and logical errors in avconv stream combination example

Conflicts:
doc/avconv.texi

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '554fd5cd630073b8273aa044a6bdfd6f608209e9' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:50:29 +0000 (21:50 +0100)]
Merge commit '554fd5cd630073b8273aa044a6bdfd6f608209e9' into release/0.10

* commit '554fd5cd630073b8273aa044a6bdfd6f608209e9':
  ffmpeg: Clarify wording of ffmpeg --> avconv deprecation message

Conflicts:
ffmpeg.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '2deac60a387409dcbc7b37a8c30de89c7aeb58ac' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:49:59 +0000 (21:49 +0100)]
Merge commit '2deac60a387409dcbc7b37a8c30de89c7aeb58ac' into release/0.10

* commit '2deac60a387409dcbc7b37a8c30de89c7aeb58ac':
  adpcmenc: Calculate the IMA_QT predictor without overflow

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '3eed35addb461c42471e0367bb6cd68d8ffd3aec' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:49:26 +0000 (21:49 +0100)]
Merge commit '3eed35addb461c42471e0367bb6cd68d8ffd3aec' into release/0.10

* commit '3eed35addb461c42471e0367bb6cd68d8ffd3aec':
  svq1enc: Set picture_structure correctly

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'ec0df23765bd41846f66e4a4fb694779b432fc62' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:44:20 +0000 (21:44 +0100)]
Merge commit 'ec0df23765bd41846f66e4a4fb694779b432fc62' into release/0.10

* commit 'ec0df23765bd41846f66e4a4fb694779b432fc62':
  h264: Remove an assert on current_picture_ptr being null

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '372f742dd18911dc5c6552b1bb2e2ca235c5ee47' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:44:05 +0000 (21:44 +0100)]
Merge commit '372f742dd18911dc5c6552b1bb2e2ca235c5ee47' into release/0.10

* commit '372f742dd18911dc5c6552b1bb2e2ca235c5ee47':
  parser: Don't use pc as context for av_dlog

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'd1c490448cbe3f7715773c673e92139a7192326f' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:43:36 +0000 (21:43 +0100)]
Merge commit 'd1c490448cbe3f7715773c673e92139a7192326f' into release/0.10

* commit 'd1c490448cbe3f7715773c673e92139a7192326f':
  mpegvideo: remove last_picture_ptr / h264 assert.

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '9858a723cbcb206287fd0232d74c6a0991eecdc8' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:37:43 +0000 (21:37 +0100)]
Merge commit '9858a723cbcb206287fd0232d74c6a0991eecdc8' into release/0.10

* commit '9858a723cbcb206287fd0232d74c6a0991eecdc8':
  elbg: Fix an assert

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit 'ce57531a8894d69e3da085c7c6cba45b1f133b35' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:36:47 +0000 (21:36 +0100)]
Merge commit 'ce57531a8894d69e3da085c7c6cba45b1f133b35' into release/0.10

* commit 'ce57531a8894d69e3da085c7c6cba45b1f133b35':
  swscale: Remove two bogus asserts

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '233d1b4861e252cbc4571840e7f264e1db151c13' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:36:28 +0000 (21:36 +0100)]
Merge commit '233d1b4861e252cbc4571840e7f264e1db151c13' into release/0.10

* commit '233d1b4861e252cbc4571840e7f264e1db151c13':
  h264_refs: Fix debug tprintf argument types

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '90a2359fef5325f90aec0eca51b145d90ca3df7d' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:32:04 +0000 (21:32 +0100)]
Merge commit '90a2359fef5325f90aec0eca51b145d90ca3df7d' into release/0.10

* commit '90a2359fef5325f90aec0eca51b145d90ca3df7d':
  nutdec: Remove unused and broken debug function stub

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '57c36de7265761dd94fb6bb4a9180011f796128f' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:29:31 +0000 (21:29 +0100)]
Merge commit '57c36de7265761dd94fb6bb4a9180011f796128f' into release/0.10

* commit '57c36de7265761dd94fb6bb4a9180011f796128f':
  vp8: avoid race condition on segment map.

Conflicts:
libavcodec/vp8.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '8152b02f33a7b939cb2c9a5f26d10cd10465d4f9' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:10:46 +0000 (21:10 +0100)]
Merge commit '8152b02f33a7b939cb2c9a5f26d10cd10465d4f9' into release/0.10

* commit '8152b02f33a7b939cb2c9a5f26d10cd10465d4f9':
  arm/neon: dsputil: use correct size specifiers on vld1/vst1

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '9fa9d471a7af57a62843fdae0dc36e67960c3f3d' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:10:27 +0000 (21:10 +0100)]
Merge commit '9fa9d471a7af57a62843fdae0dc36e67960c3f3d' into release/0.10

* commit '9fa9d471a7af57a62843fdae0dc36e67960c3f3d':
  arm: dsputil: prettify some conditional instructions in put_pixels macros

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agoMerge commit '6dd19ffd39babd651744082301d133264a30882c' into release/0.10
Michael Niedermayer [Wed, 11 Mar 2015 20:10:03 +0000 (21:10 +0100)]
Merge commit '6dd19ffd39babd651744082301d133264a30882c' into release/0.10

* commit '6dd19ffd39babd651744082301d133264a30882c':
  arm: dsputil: fix overreads in put/avg_pixels functions

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2 years agodoc: More changelog updates for v0.8.17
Reinhard Tartler [Tue, 10 Mar 2015 02:11:14 +0000 (22:11 -0400)]
doc: More changelog updates for v0.8.17

2 years agoutvideodec: Handle slice_height being zero
Michael Niedermayer [Wed, 4 Mar 2015 17:36:14 +0000 (17:36 +0000)]
utvideodec: Handle slice_height being zero

Fixes out of array accesses.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-9604
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0ce3a0f9d9523a9bcad4c6d451ca5bbd7a4f420d)
(cherry picked from commit 3a417a86b330b7c1acf9db4f729be7d619caaded)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit e032e647dd79e7748145792dfee0358eccb1982e)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 789f433bc6376e6e45d41ae491007d482fa1df85)

Conflicts:
libavcodec/utvideodec.c

2 years agodoc: More changelog updates for v0.8.17
Reinhard Tartler [Mon, 9 Mar 2015 02:34:43 +0000 (22:34 -0400)]
doc: More changelog updates for v0.8.17

2 years agotiff: Check that there is no aliasing in pixel format selection
Anton Khirnov [Sat, 7 Mar 2015 21:06:59 +0000 (22:06 +0100)]
tiff: Check that there is no aliasing in pixel format selection

Fixes possible issues with unexpected bpp/bppcount values.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-8544
(cherry picked from commit ae5e1f3d663a8c9a532d89e588cbc61f171c9186)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit eb9041403d820634c45ed4ee98570246a252507a)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 62b0462e5fa78901380ca229ddb6a7625efd61a2)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2 years agormenc: limit packet size
Andreas Cadhalpun [Mon, 2 Mar 2015 15:52:26 +0000 (16:52 +0100)]
rmenc: limit packet size

The chunk size is limited to UINT16_MAX (written by avio_wb16), so make
sure that the packet size is not too large.

Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
2 years agoeamad: check for out of bounds read
Federico Tomassetti [Wed, 18 Feb 2015 12:11:44 +0000 (12:11 +0000)]
eamad: check for out of bounds read

Bug-Id: CID 1257500
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2 years agoUpdate Changelog for 0.8.17 Release
Reinhard Tartler [Sun, 8 Mar 2015 15:32:09 +0000 (11:32 -0400)]
Update Changelog for 0.8.17 Release

2 years agoPrepare for 0.8.17 Release
Reinhard Tartler [Sun, 8 Mar 2015 15:29:56 +0000 (11:29 -0400)]
Prepare for 0.8.17 Release

2 years agoh264_cabac: Break infinite loops
Michael Niedermayer [Thu, 31 Jan 2013 03:20:24 +0000 (04:20 +0100)]
h264_cabac: Break infinite loops

This fixes out of array reads and/or infinite loops.

30 is the maximum number of bits that can be read into
coeff_abs below.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Martin Storsjö <martin@martin.st>
2 years agomatroskadec: Fix read-after-free in matroska_read_seek()
Xiaohan Wang [Thu, 6 Nov 2014 20:59:54 +0000 (12:59 -0800)]
matroskadec: Fix read-after-free in matroska_read_seek()

In matroska_read_seek(), |tracks| is assigned at the begining of the
function. However, functions like matroska_parse_cues() could reallocate
the tracks and invalidate |tracks|.

This assigns |tracks| only before using it, so that it will not get
invalidated elsewhere.

Bug-Id: chromium/427266

2 years agogifdec: refactor interleave end handling
Michael Niedermayer [Fri, 3 Oct 2014 18:15:52 +0000 (20:15 +0200)]
gifdec: refactor interleave end handling

Fixes invalid writes with very small image heights.

CC: libav-stable@libav.org
Bug-ID: CVE-2014-8547
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 0b39ac6f54505a538c21fe49a626de94c518c903)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit eac49477aa95cf727d87d2741ee8e60be59d394b)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 92888e9ed4ea4e761ae953bbe28c85cc658abc8f)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 02de44073a8e116ea177b53081219d32ef135ad8)
Signed-off-by: Anton Khirnov <anton@khirnov.net>