Commit Graph

61761 Commits

Author SHA1 Message Date
Andreas Cadhalpun 4f53eaaafa ffmdec: limit the backward seek to the last resync position
If resyncing leads to the same position as previously, it will again
lead to a resync attempt, resulting in an infinite loop.

Thus don't seek back beyond the last syncpoint.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6b8263b03a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-11 00:18:22 +01:00
Michael Niedermayer 1177e047f1 Merge commit '8ae0d702a1ba1c3c8d88a29c181f8434f25bf53c' into release/2.2
* commit '8ae0d702a1ba1c3c8d88a29c181f8434f25bf53c':
  doc: More changelog updates for v10.6

Conflicts:
	Changelog

not merged

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 13:28:40 +01:00
Michael Niedermayer 66342aab73 Merge commit 'e032e647dd79e7748145792dfee0358eccb1982e' into release/2.2
* commit 'e032e647dd79e7748145792dfee0358eccb1982e':
  utvideodec: Handle slice_height being zero

See: 3881606240
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 13:28:01 +01:00
Michael Niedermayer 17b2ad6f43 Merge commit 'eb9041403d820634c45ed4ee98570246a252507a' into release/2.2
* commit 'eb9041403d820634c45ed4ee98570246a252507a':
  tiff: Check that there is no aliasing in pixel format selection

Conflicts:
	libavcodec/tiff.c

See: e1c0cfaa41
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 13:27:22 +01:00
Michael Niedermayer 19640e99df Merge commit '0051174c70810b66378cf8ea093eab01302f6049' into release/2.2
* commit '0051174c70810b66378cf8ea093eab01302f6049':
  rmenc: limit packet size

Conflicts:
	libavformat/rmenc.c

See: 08728f400b
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 13:26:02 +01:00
Michael Niedermayer 4b70e6e6e5 Merge commit '61c966ef30129a0e4dba485242c039a895914d33' into release/2.2
* commit '61c966ef30129a0e4dba485242c039a895914d33':
  webp: validate the distance prefix code

See: c089e720c1
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 13:05:54 +01:00
Michael Niedermayer 1d9a93682d Merge commit '772f50c1f3e4a50ce3f35e31a6f0cd64e7cbe818' into release/2.2
* commit '772f50c1f3e4a50ce3f35e31a6f0cd64e7cbe818':
  rv10: check size of s->mb_width * s->mb_height

Conflicts:
	libavcodec/rv10enc.c

See: 2578a54618
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 13:05:04 +01:00
Michael Niedermayer 51c580102d Merge commit '0eb8786eac1f4a2132ad80dc49f90d5f81665c5c' into release/2.2
* commit '0eb8786eac1f4a2132ad80dc49f90d5f81665c5c':
  eamad: check for out of bounds read

Conflicts:
	libavcodec/eamad.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 13:00:10 +01:00
Andreas Cadhalpun 25b73ae265 avformat/rm: limit packet size
The chunk size is limited to 0xFFFF (written by avio_wb16), so make
sure that the packet size is not too large.

Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

See Ticket244

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08728f400b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:58:53 +01:00
Andreas Cadhalpun b55be8b266 avcodec/webp: validate the distance prefix code
According to the WebP Lossless Bitstream Specification the highest
allowed value for a prefix code is 39.

If prefix_code is too large, the calculated extra_bits has an invalid
value and triggers an assertion in get_bits.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5de2dab12b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:58:39 +01:00
Andreas Cadhalpun fc6a00d20d avcodec/rv10: check size of s->mb_width * s->mb_height
If it doesn't fit into 12 bits it triggers an assertion.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2578a54618)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:58:34 +01:00
Andreas Cadhalpun c0dc649e81 webp: ensure that each transform is only used once
According to the WebP Lossless Bitstream Specification
"each transform is allowed to be used only once".

If a transform is more than once this can lead to memory
corruption.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c089e720c1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:58:15 +01:00
Michael Niedermayer ce167a49ba Merge commit 'b2b359f12465c8445484be24278b324da8ebb0e1' into release/2.2
* commit 'b2b359f12465c8445484be24278b324da8ebb0e1':
  mdec: check for out of bounds read

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:50:05 +01:00
Michael Niedermayer 4e6f1df657 Merge commit '0ad8d751337efbbd61c0d78762448b043100b653' into release/2.2
* commit '0ad8d751337efbbd61c0d78762448b043100b653':
  configure: Properly fail when libcdio/cdparanoia is not found

Conflicts:
	configure

See: f514b5dff7
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:49:05 +01:00
Michael Niedermayer bec350611e Merge commit '7fd11fbeeb41990427b475dc0d8800d2cf15a8c4' into release/2.2
* commit '7fd11fbeeb41990427b475dc0d8800d2cf15a8c4':
  arm: Suppress tags about used cpu arch and extensions

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:48:18 +01:00
Michael Niedermayer 895ddf1a80 Merge commit '470fd8e64e292d2336b2b860437dcbc053ba9eec' into release/2.2
* commit '470fd8e64e292d2336b2b860437dcbc053ba9eec':
  Update Changelog for v10.6

Conflicts:
	Changelog

not merged

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:40:22 +01:00
Michael Niedermayer e48f2847ab Merge commit 'f74f4a540151aacb38306f2e41a160c326be3d51' into release/2.2
* commit 'f74f4a540151aacb38306f2e41a160c326be3d51':
  Prepare for 10.6 Release

Conflicts:
	RELEASE

Not merged

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:38:44 +01:00
Michael Niedermayer 71c63e799f Merge commit 'c47cdf837c1b52681a84f434443e1f993757a5e9' into release/2.2
* commit 'c47cdf837c1b52681a84f434443e1f993757a5e9':
  img2dec: correctly use the parsed value from -start_number

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:35:20 +01:00
Michael Niedermayer 45eb2a0d49 Merge commit '91ef250713d04d675a16e5b030d7226baafe3f82' into release/2.2
* commit '91ef250713d04d675a16e5b030d7226baafe3f82':
  h264_cabac: Break infinite loops

Conflicts:
	libavcodec/h264_cabac.c

See: cdf0877bc3
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:27:47 +01:00
Michael Niedermayer 019b4b0650 Merge commit '3670942fae7beb2bfde52557ee95eab5f536e624' into release/2.2
* commit '3670942fae7beb2bfde52557ee95eab5f536e624':
  h264: initialize H264Context.avctx in init_thread_copy

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:24:50 +01:00
Michael Niedermayer e3654b25cf Merge commit 'fa4604d80580dde45bfce32ebe04a5c13c233895' into release/2.2
* commit 'fa4604d80580dde45bfce32ebe04a5c13c233895':
  h264: Do not share rbsp_buffer across threads

Conflicts:
	libavcodec/h264.c

See: ecbf838c7d
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:24:04 +01:00
Michael Niedermayer b837d5bf83 Merge commit '03fbb6ff3d28f639ea5a35aba3c6dca09c17225d' into release/2.2
* commit '03fbb6ff3d28f639ea5a35aba3c6dca09c17225d':
  h264: only ref cur_pic in update_thread_context if it is initialized

Conflicts:
	libavcodec/h264.c

See: 0fc01ae33c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:11:40 +01:00
Reinhard Tartler 8ae0d702a1 doc: More changelog updates for v10.6 2015-03-08 22:04:40 -04:00
Michael Niedermayer e032e647dd utvideodec: Handle slice_height being zero
Fixes out of array accesses.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-9604
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0ce3a0f9d9)
(cherry picked from commit 3a417a86b3)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2015-03-08 22:04:40 -04:00
Anton Khirnov eb9041403d tiff: Check that there is no aliasing in pixel format selection
Fixes possible issues with unexpected bpp/bppcount values.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Bug-Id: CVE-2014-8544
(cherry picked from commit ae5e1f3d66)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-03-08 22:04:40 -04:00
Andreas Cadhalpun 0051174c70 rmenc: limit packet size
The chunk size is limited to UINT16_MAX (written by avio_wb16), so make
sure that the packet size is not too large.

Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-08 19:36:26 +00:00
Andreas Cadhalpun 61c966ef30 webp: validate the distance prefix code
According to the WebP Lossless Bitstream Specification the highest
allowed value for a prefix code is 39.

If prefix_code is too large, the calculated extra_bits has an invalid
value and triggers an assertion in get_bits.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-08 19:36:18 +00:00
Andreas Cadhalpun 772f50c1f3 rv10: check size of s->mb_width * s->mb_height
If it doesn't fit into 12 bits it triggers an assertion.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-08 19:36:12 +00:00
Federico Tomassetti 0eb8786eac eamad: check for out of bounds read
Bug-Id: CID 1257500
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-03-08 19:36:06 +00:00
Federico Tomassetti b2b359f124 mdec: check for out of bounds read
Bug-Id: CID 1257501
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-03-08 19:35:56 +00:00
Vittorio Giovara 0ad8d75133 configure: Properly fail when libcdio/cdparanoia is not found 2015-03-08 19:35:48 +00:00
Martin Storsjö 7fd11fbeeb arm: Suppress tags about used cpu arch and extensions
When all the codepaths using manually set .arch/.fpu code is
behind runtime detection, the elf attributes should be suppressed.

This allows tools to know that the final built binary doesn't
strictly require these extensions.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit dcae2e32f7
and b77e335e44)
Signed-off-by: Martin Storsjö <martin@martin.st>
2015-03-08 18:12:02 +02:00
Reinhard Tartler 470fd8e64e Update Changelog for v10.6 2015-03-08 11:20:46 -04:00
Reinhard Tartler f74f4a5401 Prepare for 10.6 Release 2015-03-08 11:16:33 -04:00
Vittorio Giovara c47cdf837c img2dec: correctly use the parsed value from -start_number
Previously the image sequence was always starting from the minimum
number rather than the requested one.

CC: libav-stable@libav.org
2015-02-22 23:56:00 +00:00
Michael Niedermayer 91ef250713 h264_cabac: Break infinite loops
This fixes out of array reads and/or infinite loops.

30 is the maximum number of bits that can be read into
coeff_abs below.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Martin Storsjö <martin@martin.st>
2015-02-22 23:55:53 +00:00
Anton Khirnov 3670942fae h264: initialize H264Context.avctx in init_thread_copy
This prevents using a wrong (first thread's) AVCodecContext if decoding
a frame in the first pass over all threads fails.

(cherry picked from commit a06b0b1295)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 2686dab45e)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-02-21 09:41:30 +01:00
Michael Niedermayer fa4604d805 h264: Do not share rbsp_buffer across threads
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org
(cherry picked from commit 61928b68dc)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 06d433366c)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-02-21 09:41:24 +01:00
Anton Khirnov 03fbb6ff3d h264: only ref cur_pic in update_thread_context if it is initialized
It may be empty if the previous thread's decode call did not contain a
valid frame.

(cherry picked from commit 0dea4c77cc)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 1dbfaa34e6)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	libavcodec/h264_slice.c
2015-02-21 09:40:43 +01:00
Michael Niedermayer 36cfee3adc Update for 2.2.13
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
n2.2.13
2015-02-17 19:50:54 +01:00
Michael Niedermayer 2dca276dcb avcodec/arm/videodsp_armv5te: Fix linking failure with "g++ -shared -D__STDC_CONSTANT_MACROS -o test.so ... libavcodec.a"
Tested-by: Andreas Haupt
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cab6302534)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:19 +01:00
Michael Niedermayer 0ee5f46fd1 avcodec/mjpegdec: Skip blocks which are outside the visible area
Fixes out of array accesses
Fixes: ffmpeg_mjpeg_crash.avi

Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08509c8f86)

Conflicts:

	libavcodec/mjpegdec.c
2015-02-17 19:43:19 +01:00
Carl Eugen Hoyos b1b69baa01 lavc/aarch64: Do not use the neon horizontal chroma loop filter for H.264 4:2:2.
(cherry picked from commit 4faea46bd9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:19 +01:00
Michael Niedermayer f0526bc21e avcodec/h264_slice: ignore SAR changes in slices after the first
Fixes race condition and null pointer dereference
Fixes: signal_sigsegv_1472ac3_468_cov_2915641226_CABACI3_Sony_B.jsv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 38d5241b7f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Conflicts:

	libavcodec/h264_slice.c
2015-02-17 19:43:19 +01:00
Michael Niedermayer 0afe061f28 avcodec/h264_slice: Check picture structure before setting the related fields
This might fix a hypothetical race condition

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f111831ed6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Conflicts:

	libavcodec/h264_slice.c
2015-02-17 19:43:19 +01:00
Michael Niedermayer e6093f5b85 avcodec/h264_slice: Do not change frame_num after the first slice
Fixes potential race condition
Fixes: signal_sigsegv_1472ac3_468_cov_2915641226_CABACI3_Sony_B.jsv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f906982c94)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Conflicts:

	libavcodec/h264_slice.c
2015-02-17 19:43:19 +01:00
Michael Niedermayer 8323f09442 avutil/opt: Fix type used to access AV_OPT_TYPE_SAMPLE_FMT
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1750b45cdf)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:18 +01:00
Michael Niedermayer 68d83bc3a6 avutil/opt: Fix types used to access AV_OPT_TYPE_PIXEL_FMT
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a0640e6346)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:18 +01:00
Michael Niedermayer 0c9d465e98 avcodec/h264: Be more strict on rejecting pps/sps changes
Fixes race condition
Fixes: signal_sigsegv_1472ac3_468_cov_2915641226_CABACI3_Sony_B.jsv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6fafc62b0b)

Conflicts:

	libavcodec/h264_slice.c
2015-02-17 19:43:18 +01:00
Michael Niedermayer a3dca10470 avcodec/h264: Be more strict on rejecting pps_id changes
Fixes race condition
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 31cc9c04ca)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:18 +01:00