Fixes out of array accesses
Fixes: ffmpeg_mjpeg_crash.avi
Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08509c8f86)
Conflicts:
libavcodec/mjpegdec.c
Fixes out of array accesses
Fixes: asan_heap-oob_1c1a4ea_1242_cov_2274415971_TESTcmyk.jpg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fabbfaa095)
Conflicts:
libavcodec/mjpegdec.c
Fixes possible invalid memory access.
Based on code by Michael Niedermayer <michaelni@gmx.at>
CC: libav-stable@libav.org
Bug-ID: CVE-2014-8541
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 809c3023b6)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit aa7a19b417)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Fixes out of array access
Fixes: asan_heap-oob_1ca4f85_2760_cov_144449187_miss_congeniality_pegasus_ljpg.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0eecf40935)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c378d6a6d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Makes no difference for any file tested but is needed
for following bug-fix
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 493296800c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
0 should have been the default, this change should make no difference
but this is needed for the following bugfix
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 98f9aa389b)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Also fail if AV_EF_EXPLODE is set.
We do not fail by default, but rather return some image as it may be usefull to the
end user to see what is on the image, for example text could be read quite fine and
objects recognized.
Possibly fixes Ticket3424
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array access
No releases should be affected
Depends on 7c3700cd1d, do not backport without this one
Fixes: asan_heap-oob_14a37fe_9111_cov_1692584941_test4.amv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
It stored images wrong in the user provided buffers (that is you would
end up with a wrongly flipped image if you used direct rendering).
Also it used wrong dimensions as noticed by ubitux
Enable the old code unconditionally so flipping works correctly
again.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
mjpegdec: apply flipping after decoding, not before
Conflicts:
libavcodec/mjpegdec.c
libavcodec/mjpegdec.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f849c599487_6828_mjpeg.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'e2274aa555f023e4f4e4819bf29b2d7e0adec7d5':
mjpegdec: use the AVFrame API properly.
Conflicts:
libavcodec/mjpegdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Avoids len from becoming negative and causing assertion failure
Fixes: signal_sigabrt_7ffff7126425_5140_fd44dc63fa7bdd12ee34fc602231ef02.jpg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
