Commit Graph

57713 Commits

Author SHA1 Message Date
Michael Niedermayer d0d441b350 avcodec/h264: more completely check the loop filter parameters
Fixes out of array read
Fixes: caa65cc01655505705129b677189f036-signal_sigsegv_fdcc43_2681_cov_3043376737_PPH422I5_Panasonic_A.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 91253839e1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 15:02:14 +01:00
Michael Niedermayer 6341a7006d avcodec/alsdec: check predictor order against block length
Fixes out of array access
Fixes: abd3c041acbcb816be113455d138166b-asan_heap-oob_b11634_3707_cov_1707137151_als_05_2ch48k16b.mp4
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 18f94df8af)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 15:00:02 +01:00
Michael Niedermayer 7034e808f6 avcodec/hevc_ps: Use get_bits_long() in decode_vui()
Fix assertion failure
Fixes: a225222ef88a0f5b1e93e1d0432debc3-asan_static-oob_124a17d_1448_cov_77608227_DBLK_E_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b818637b84)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:58:13 +01:00
Michael Niedermayer ce5d9a2b4b avcodec/hevc: make check for previous slice segment tighter
This ensures the previous one is matching the curent and not just any

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1a3ed056c5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:53:59 +01:00
Michael Niedermayer aa672f5e6a avcodec/hevc: clear tab_slice_address of ctb on error.
This allows us to detect which areas have failed to decode

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a18f111582)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:53:23 +01:00
Michael Niedermayer b959e6393e avcodec/hevc: hls_decode_entry: check that the previous slice segment is available before decoding the next
Fixes use of uninitialized memory
Fixes out of array read
Fixes assertion failure
Fixes part of cb307d24befbd109c6f054008d6777b5/asan_static-oob_124a175_1445_cov_2355279992_DBLK_D_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6ef57f4d9a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:51:46 +01:00
Michael Niedermayer 69f99f80d1 avcodec/hevc: clear tab_slice_address in hevc_frame_start()
Fixes inconsistencies
Fixes use of uninitilaized memory
Fixes part of  cb307d24befbd109c6f054008d6777b5/asan_static-oob_124a175_1445_cov_2355279992_DBLK_D_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56985d26d7)

Conflicts:

	libavcodec/hevc.c
2014-02-23 14:51:22 +01:00
Michael Niedermayer e7b7e69416 avcodec/h264: update current_sps & sps->new only after the whole slice header decoder and init code finished
This avoids them being cleared before the full initialization finished

Fixes out of array read
Fixes: asan_heap-oob_f0c5e6_7071_cov_1605985132_mov_h264_aac__Demo_FlagOfOurFathers.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8a3b85f3a7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:49:47 +01:00
Michael Niedermayer 9330bcff9b avcodec/h264: Disallow pps_id changing between slices
Such changes are forbidden in H.264 and lead to race conditions

Fixes out of array read
Fixes: signal_sigsegv_f9796a_1613_cov_3114610371_FM1_BT_B.h264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e708424b70)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:49:37 +01:00
Michael Niedermayer 9fb364babd avcodec/aacdec: Fix pulse position checks in decode_pulses()
Fixes out of array read
Fixes: asan_static-oob_1efed25_1887_cov_2013541199_HeyYa_RA10_AAC_192K_30s.rm
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6e42ccb9db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:49:29 +01:00
Michael Niedermayer d79419d0f9 avcodec/hevc: propagate error code from hls_coding_quadtree()
Fixes use of uninitialized memory
Fixes out of array read
Fixes: asan_static-oob_123cee5_2630_cov_1869071233_PICSIZE_A_Bossen_1.bin
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 96c4ba2392)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:48:30 +01:00
Michael Niedermayer ebc490e744 avcodec/tiff: reset geotag_count in free_geotags()
Fixes null pointer dereference
Fixes: signal_sigsegv_19d922e_3688_cov_1577641655_aletrek_tiff.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a744064c41)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:48:07 +01:00
Michael Niedermayer ab1c7113f9 avcodec/vc1: Check bfraction_lut_index
Fixes: out of array read
Fixes: asan_static-oob_1b40507_2849_SA10143.vc1
Fixes: asan_static-oob_1b40a15_2849_cov_1182297305_SA10143.vc1
Fixes: asan_static-oob_1b40f15_2849_cov_2159513432_SA10143.vc1
Fixes: asan_static-oob_1b40f15_2849_cov_3230311510_SA10143.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dcf5bfbdb6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:47:46 +01:00
Michael Niedermayer 10a30e4de5 avcodec/vc1: factor read_bfraction() out
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 388b4cf86e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:47:41 +01:00
Michael Niedermayer 9368b91834 avcodec/vc1dec: field pictures with direct mode MBs, followed by frame pictures are not supported
This case could occur when cuting and concatenating bitstreams

Fixes out of array read
Fixes: asan_heap-oob_1b33fdd_2849_cov_478905890_SA10143.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 85d51d8e32)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:43:52 +01:00
Michael Niedermayer f22e88c177 avcodec/mjpegdec: pass into ff_mjpeg_decode_sos() and check bitmask size
Fixes: heap array overread
Fixes: asan_heap-oob_149b2bc_6577_m1.mxg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2884688bd5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:43:28 +01:00
Michael Niedermayer e266fcf083 avformat/flac_picture: clear padding area
aviod use of uninitialized memory

Fixes: asan_heap-oob_1487fa4_4706_cov_364534849_cover_art.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 13aa82bbbb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:43:18 +01:00
Michael Niedermayer c9b961748f avformat/flac_picture: allocate buffer padding for picture
Fixes: heap array overread
Fixes: asan_heap-oob_14876d9_4706_cov_815472558_cover_art.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fff2953163)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:43:07 +01:00
Michael Niedermayer a94f367424 avcodec/snow: split block clipping checks
Fixes out of array read
Fixes: d4476f68ca1c1c57afbc45806f581963-asan_heap-oob_2266b27_8607_cov_4044577381_snow_chroma_bug.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 61d59703c9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer 18eac12c6d avcodec/ansi: fix integer overflow
Fixes out of array read
Fixes: 5f9698e86d92f19bb08d54ff0d57027f-signal_sigsegv_b30756_3795_cov_2693691257_ansi256.ans
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d42ec8433c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer 4cc18ee5da avcodec/msrle: use av_image_get_linesize() to calculate the linesize
Fixes out of array access
Fixes: 14a74a0a2dc67ede543f0e35d834fbbe-asan_heap-oob_49572c_556_cov_215466444_44_001_engine_room.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c919e1ca2e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer f8985cb9d9 avcodec/utils: set AVFrame format unconditional
Fixes inconsistency and out of array accesses
Fixes: 10cdd7e63e7f66e3e66273939e0863dd-asan_heap-oob_1a4ff32_7078_cov_4056274555_mov_h264_aac__mp4box_frag.mp4
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e5c7229999)

Conflicts:

	libavcodec/utils.c
2014-02-23 14:28:10 +01:00
Michael Niedermayer 656770e2aa avcodec/hevc: make *ps_id unsigned
Fixes integer overflow
Fixes out of array accesses
Fixes 2f65e7dbd02a12f426a423bd7bf880b4-signal_sigsegv_127c952_2793_cov_2517424539_RPLM_A_qualcomm_4.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d1e6602665)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer 4a28a3ddc4 avformat/mpegtsenc: Check data array size in mpegts_write_pmt()
Prevents out of array writes

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 842b6c14bc)

Conflicts:

	libavformat/mpegtsenc.c
2014-02-23 14:28:10 +01:00
Michael Niedermayer f91ef98c9d avcodec/wmalosslessdec: fix mclms_coeffs* array size
Fixes corruption of context
Fixes: 8835659dde6a4f7dcdf341de6a45c6c8-signal_sigsegv_1dce67b_4564_cov_2504444599_classical_22_16_1_14000_v3c_0_extend_0_29.wma
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ec9578d54d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Justin Ruggles a644272a4a samplefmt: avoid integer overflow in av_samples_get_buffer_size()
CC:libav-stable@libav.org
(cherry picked from commit 0e830094ad)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer 325feb8e0d avcodec/vc1: reset fcm/field_mode in non advanced header parsing
Fixes NULL pointer dereference
Fixes: signal_sigsegv_1ab8bf4_2847_cov_4254117347_SA10091.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b51e935477)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Michael Niedermayer 8c6a976fee avcodec/takdec: always check bits_per_raw_sample
Fixes out of array access
Fixes: asan_heap-oob_19c7a94_6470_cov_1453611734_luckynight-partial.tak
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f58eab1512)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-02-23 14:28:10 +01:00
Carl Eugen Hoyos ac38860ec9 Add decoder dependency to the HEVC parser.
Fixes compilation with --disable-everything --enable-parser=hevc
(cherry picked from commit d4a6133ab8)
2014-02-19 16:59:21 +01:00
Martin Storsjö d0e0329e9d rtpdec_asf: Copy the need_parsing field from the chained demuxer
This fixes playback of mp3 streams in rtp/asf. This used to work
until 950482bf, but mostly by coincidence.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 2aec9e228c)

Fixes ticket #3223
2014-01-27 15:45:10 +01:00
Alex Sukhanov 9ca79d2849 avformat/matroskadec: Fix start_time
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 251c96a70b)

Fixes ticket #3337.
2014-01-26 16:22:47 +01:00
Lukasz Marek c5a2a65e1e lavf/libssh: fix seek with whence==SEEK_CUR
Signed-off-by: Lukasz Marek <lukasz.m.luki@gmail.com>
(cherry picked from commit e0d124a920)

Conflicts:

	libavformat/libssh.c
2014-01-22 01:36:31 +01:00
Michael Niedermayer a8ed3685e1 avcodec/jpeg2000dec: fix error detection in pix_fmt_match()
Fixes out of array accesses with CODEC_FLAG_EMU_EDGE

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8001e9f7d1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:59:12 +01:00
Michael Niedermayer 32262ca7d7 avcodec/vmnc: Check that rectangles are within the picture
Prevents out of array accesses with CODEC_FLAG_EMU_EDGE

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6ba02602aa)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:59:06 +01:00
Michael Niedermayer 5f56e495ae avcodec/apedec: more checks for k
Fixes assertion failure
Fixes part of msan_uninit-mem_7fa0d8c8bd58_8417_sh3.ape
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d5128fce38)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:42:32 +01:00
Michael Niedermayer fedbba5ea0 avformat/rmdec: move packet allocation down
Fixes memleak
Fixes: msan_uninit-mem_7fc5d73327d4_6192_kuerti.ra
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 165f96cd2d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:42:32 +01:00
Michael Niedermayer d35916f6ea avformat/mpegts: check sl.timestamp_len
Fixes: msan_uninit-mem_7ff4404547ba_4883_dmbts.ts
Fixes assertion failure
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e630ca5111)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:42:32 +01:00
Michael Niedermayer 94e2673f4e avformat/ape: free packet on avio_read() failure
Fixes memleak
Fixes: msan_uninit-mem_7fcc198b365b_8417_sh3.ape
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 459db51271)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:42:32 +01:00
Michael Niedermayer 23ae7bfb4e dnxhdenc: fix mb_rc size
Fixes out of array access with RC_VARIANCE set to 0

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f1caaa1c61)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:42:32 +01:00
Michael Niedermayer 9e8464e81b Merge commit '9eef9eb3014b2ed9c3ff4aac510a9f04edb555cf'
* commit '9eef9eb3014b2ed9c3ff4aac510a9f04edb555cf':
  h264: check that execute_decode_slices() is not called too many times

Conflicts:
	libavcodec/h264.c

The check is replaced by an assert() as the mb index should not ever go out
of bounds.

Merged-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 64591f8f86)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:42:32 +01:00
Michael Niedermayer c9a8dfa5ae Merge commit '6892d145a0c80249bd61ee7dd31ec851c5076bcd'
* commit '6892d145a0c80249bd61ee7dd31ec851c5076bcd':
  segafilm: fix leaks if reading the header fails

Conflicts:
	libavformat/segafilm.c

See: ca5456db7f
Merged-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2a58d5fc0e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:42:32 +01:00
Michael Niedermayer e6299a4cf9 cmdutils: update year
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-01-21 16:42:32 +01:00
Carl Eugen Hoyos ee3822af63 Allow decoding of slightly broken Nikon avi files.
Fixes ticket #3330.
(cherry picked from commit f9c2d4d17e)
2014-01-20 22:37:18 +01:00
Nicolas George fc5261c219 lavfi/dualinput: fix shortest option.
Fix trac ticket #3315.
(cherry picked from commit 2dc5980d61)
2014-01-20 22:28:01 +01:00
Michael Niedermayer 30a94f1159 avcodec/mjpegdec: Dont skip picture allocation if theres no picture allocated
Fixes Ticket 3245
(cherry picked from commit ad8d063f23)
2014-01-20 22:26:00 +01:00
Michael Niedermayer 9d83cff1f1 avcodec/aacdec: Dont fail if channels arent known yet
Fixes Ticket3312

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 676a395ab9)
2014-01-19 14:28:18 +01:00
Michael Niedermayer 756cd1a305 avcodec/mjpegdec: Dont treat the lack of a startcode differently from end of the bitstream
Fixes Ticket3303

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 31e703e899)
2014-01-19 14:27:56 +01:00
Michael Niedermayer 83dc8f044d avcodec/mjpegdec: only run EOI emulation code when there was a scan
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361e27a3d8)
2014-01-19 14:27:48 +01:00
Michael Niedermayer 2c5c6affb1 avcodec/mjpegdec: update cur_scan also for non-LS jpeg
This should make no difference but the variable will be used in a subsequent commit

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8893f31e20)
2014-01-19 14:27:40 +01:00
Carl Eugen Hoyos f4e051680e Fix libxvid crash on failing initialisation.
Fixes ticket #3297.
(cherry picked from commit ee3fc8aa86)
2014-01-19 14:26:15 +01:00