FFmpeg 0.8.15 release
* tag 'n0.8.15': (49 commits)
update for 0.8.15
avcodec/ffv1enc: update buffer check for 16bps
avcodec/dsputil: fix signedness in sizeof() comparissions
avcodec/pngdsp: fix (un)signed type in end comparission
matroska_read_seek: Fix used streams for subtitle index compensation
jpeg2000: check log2_cblk dimensions
avcodec/rpza: Perform pointer advance and checks before using the pointers
update all trac links to use the trac subdomain
doc/APIchanges: List merge commit hashes and version numbers
apichanges: fix 2 wrong hashes
avcodec/parser: reset indexes on realloc failure
mpeg12dec: avoid reinitialization on PS changes when possible.
mpegts: only reopen pmt_cb filter if its different from the previous.
Autodetect idcin only if audio properties allow decoding.
alacenc: Fix missing sign_extend()
h264_cavlc: fix reading skip run
Update changelog for 0.7.8 release
aac: check the maximum number of channels
oggdec: fix faulty cleanup prototype
qdm2: check that the FFT size is a power of 2
...
Conflicts:
Doxyfile
RELEASE
VERSION
libavformat/matroskadec.c
Merged-by: Michael Niedermayer <[email protected]>
Fixes out of array accesses
Fixes Ticket2850
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 3819db745d)
Signed-off-by: Michael Niedermayer <[email protected]>
* qatar/release/0.7:
Update changelog for 0.7.8 release
aac: check the maximum number of channels
oggdec: fix faulty cleanup prototype
qdm2: check that the FFT size is a power of 2
rv10: check that extradata is large enough
lavf: make sure stream probe data gets freed.
dfa: check for invalid access in decode_wdlt().
avfiltergraph: check for sws opts being non-NULL before using them.
Conflicts:
Changelog
libavformat/utils.c
Merged-by: Michael Niedermayer <[email protected]>
* commit '9c713f30e4913a28d93eb37ea5db7f62be4c0ef6':
parser: fix large overreads
dsputil: fix invalid array indexing
shorten: use the unsigned type where needed
Merged-by: Michael Niedermayer <[email protected]>
* commit 'd785f6940144eb6ce4c24309ed034056b81395bc':
shorten: validate that the channel count in the header is not <= 0
matroskadec: request a read buffer for the wav header
h264: check for luma and chroma bit depth being equal
xxan: fix invalid memory access in xan_decode_frame_type0()
wmadec: require block_align to be set.
Merged-by: Michael Niedermayer <[email protected]>
* commit '5025dbc577c9a9e0109cb363ac630a9eeda6dc1d':
wmaprodec: return an error, not 0, when the input is too small.
vorbisdec: Error on bark_map_size equal to 0.
Update RELEASE file for 0.7.8
update year to 2013
oggdec: make sure the private parse data is cleaned up
indeo5: update AVCodecContext width/height on size change
doc: filters: Correct BNF FILTER description
Conflicts:
RELEASE
Merged-by: Michael Niedermayer <[email protected]>
Broken bitstreams could report a larger than specified number of
channels and cause outbound writes.
CC:[email protected]
(cherry picked from commit a943a132f3)
Signed-off-by: Luca Barbato <[email protected]>
Conflicts:
libavcodec/aacdec.c
Avoids an infinite loop in the calling programs with decoder not
consuming any input and not returning output.
CC:[email protected]
(cherry picked from commit cacad1c058)
Signed-off-by: Reinhard Tartler <[email protected]>
(cherry picked from commit 20373a66ec)
Signed-off-by: Reinhard Tartler <[email protected]>
This can happen when the number of skipped lines is not consistent with
the number of coded lines.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: [email protected]
(cherry picked from commit 3623589edc)
Signed-off-by: Reinhard Tartler <[email protected]>
Indexing outside an array is invalid and causes errors with
gcc 4.8.
Signed-off-by: Mans Rullgard <[email protected]>
(cherry picked from commit 0a07f2b346)
Signed-off-by: Diego Biurrun <[email protected]>
When `off' is 0, `0x537F6103 << 32' in the following expression invokes
undefined behavior, the result of which is not necessarily 0.
(0x537F6103 >> (off * 8)) | (0x537F6103 << (32 - (off * 8)))
Avoid oversized shifting.
CC: [email protected]
Signed-off-by: Xi Wang <[email protected]>
Signed-off-by: Luca Barbato <[email protected]>
(cherry picked from commit eba1ff3130)
Conflicts:
libavcodec/atrac3.c
get_uint returns an unsigned value, use an unsigned to store
blocksize to make sure the comparison logic is correct and report
correctly the error for the channel count not supported.
CC: [email protected]
(cherry picked from commit 5cf7c72757)
(cherry picked from commit 88089eecfd)
(cherry picked from commit f42d03746a)
Signed-off-by: Luca Barbato <[email protected]>
Signed-off-by: Reinhard Tartler <[email protected]>
Conflicts:
libavcodec/shorten.c
Prevent the loop shorten_decode_close from writing and freeing out of
the array boundary.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <[email protected]>
CC: [email protected]
(cherry picked from commit c10da30d84)
(cherry picked from commit 21d568be17)
Signed-off-by: Luca Barbato <[email protected]>
Conflicts:
libavcodec/shorten.c
Returning 0 may result in an infinite loop in valid calling programs. A
decoder should never return 0 without producing any output.
CC:[email protected]
(cherry picked from commit 4c0080b7e7)
Signed-off-by: Reinhard Tartler <[email protected]>
(cherry picked from commit 60dd8b5733)
Signed-off-by: Reinhard Tartler <[email protected]>
The decoder assumes a single bit depth for all the planes while
the specification allows different bit depths for luma and chroma.
Avoid the possible problems described in CVE-2013-2277
Conflicts:
libavcodec/h264.c
The loop a few lines below the xan_unpack() call accesses up to
dec_size * 2 bytes into y_buffer, so dec_size must be limited to
buffer_size / 2.
CC:[email protected]
(cherry picked from commit 8a49d2bcbe)
Signed-off-by: Reinhard Tartler <[email protected]>
(cherry picked from commit 62a657de16)
Signed-off-by: Reinhard Tartler <[email protected]>
Conflicts:
libavcodec/xxan.c
Avoids an infinite loop in the calling programs with decoder not
consuming any input and not returning output.
CC:[email protected]
(cherry picked from commit ea1136baaf)
Signed-off-by: Reinhard Tartler <[email protected]>
(cherry picked from commit c1f479e8df)
Signed-off-by: Reinhard Tartler <[email protected]>
Fixes CVE-2012-2787
Note that in 0.7, there is only indeo 5, no indeo 4 decoder
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <[email protected]>
(cherry picked from commit b146d74730)
Signed-off-by: Reinhard Tartler <[email protected]>
(cherry picked from commit 2bc1e4fcb9)
Conflicts:
libavcodec/ivi_common.c
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit c69315a5de)
Signed-off-by: Michael Niedermayer <[email protected]>
This is partly redundant with the following patches, but its safer
Found-by: [email protected]
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit f5c00b347d)
Conflicts:
libavcodec/utils.c
Signed-off-by: Michael Niedermayer <[email protected]>
This prevents out of array reads. An alternative solution would be
to check the index but this would require several checks in the
inner loops
Yet another alternative would be to change the index reset logic
but this likely would introduce a difference to the binary decoder
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 8c4aebb58d)
Signed-off-by: Michael Niedermayer <[email protected]>
* release/0.8: (92 commits)
Update for 0.8.13
pngdec/filter: dont access out of array elements at the end
aacdec: check channel count
vqavideo: check chunk sizes before reading chunks
eamad: fix out of array accesses
roqvideodec: check dimensions validity
qdm2: check array index before use, fix out of array accesses
alsdec: check block length
huffyuvdec: Skip len==0 cases
huffyuvdec: Check init_vlc() return codes.
Update changelog for 0.7.7 release
mpeg12: do not decode extradata more than once.
indeo4/5: check empty tile size in decode_mb_info().
dfa: improve boundary checks in decode_dds1()
indeo5dec: Make sure we have had a valid gop header.
rv34: error out on size changes with frame threading
rtmp: fix buffer overflows in ff_amf_tag_contents()
rtmp: fix multiple broken overflow checks
Revert "h264: allow cropping to AVCodecContext.width/height"
h264: check ref_count validity for num_ref_idx_active_override_flag
...
Conflicts:
Doxyfile
RELEASE
VERSION
libavcodec/rv34.c
Merged-by: Michael Niedermayer <[email protected]>
Prevent out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 96f452ac64)
Signed-off-by: Michael Niedermayer <[email protected]>
Fixes out of array writes
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit ab6c9332bf)
Signed-off-by: Michael Niedermayer <[email protected]>
Michael Niedermayer