f64ffbbdc0
avcodec/ivi: Check image dimensions
...
Fixes integer overflow
Fixes: 1e32c6c591d940337c20b197ec1c4d3d/asan_heap-oob_4a52e5_8946_0bb0d9e863def56005e49f1d89bdc94d.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df91aa034bmichael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
c0748b9954
avcodec/utils: Better check for channels in av_get_audio_frame_duration()
...
Fixes integer overflow
Fixes: 0c2625f236ced104d402b4a03c0d65c7/asan_generic_274e1ce_5990_9314e7a67c26aecf011b178ade9f217c.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4e16ad2868michael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
dbfec68d32
avcodec/jpeg2000dec: Check for duplicate SIZ marker
...
Fixes: 0231a17345734228011c6f35a64e4594/asan_heap-oob_1d92a72_3218_1213809a9e3affec77e4c191fdfdc0a9.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 44a7f17d0bmichael@niedermayer.cc >
2015-11-26 16:05:41 +01:00
34f2d74555
aacsbr: don't call sbr_dequant twice without intermediate read_sbr_data
...
Doing that doesn't make sense, because the only purpose of sbr_dequant
is to process the data from read_sbr_data.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1c3e43a627Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
22017f7745
hqx: correct type and size check of info_offset
...
It is used as size argument of ff_canopus_parse_info_tag, which uses it
as size argument to bytestream2_init, which only supports sizes up to
INT_MAX.
Changing it's type to unsigned simplifies the check.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1ed7fcd42aAndreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
b372ad819e
mxfdec: check edit_rate also for physical_track
...
Previously only the edit_rate of material_track was checked.
If it's negative, it causes assertion failures in av_rescale_rnd.
Reviewed-by: Tim Nicholson <nichot20-at-yahoo.com@ffmpeg.org >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 047bf82c18Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
bdbfc12e7f
avcodec/jpeg2000: Change coord to 32bit to support larger than 32k width or height
...
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 0eb7de1973Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
c3a44a2a55
avcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range
...
Fixes potential integer overflows
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi
This fix is choosen to be simple to backport, better solution
for master is planed
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 6ef819c40bAndreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
d1d48d4319
avcodec/jpeg2000: Check comp coords to be within the supported size
...
Fixes assertion failure
Fixes: 03e0abe721b1174856d41a1eb5d6a896/signal_sigabrt_7ffff6ae7cc9_3813_e71bf3541abed3ccba031cd5ba0269a4.avi
This fix is choosen to be simple to backport, better solution
for master is planed
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1a8cbcb35Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
6b0bc64f54
mpegvideo: clear overread in clear_context
...
Otherwise the h263p decoder can try to copy overread bytes, even though
buffer is NULL.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 6a69a175e7Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
983e63b490
avcodec/avrndec: Use the AVFrame format instead of the context
...
Fixes out of array read
Fixes: 20dd01398dee0f6d83d7e5410a2ae8eb/signal_sigsegv_39eeb1f_4001_62efbdf1c60748dabf1ec310b59525fd.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ccba8aaff2Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
bf2f7115d9
dds: disable palette flag for compressed images
...
Having both is not valid and can cause a NULL pointer dereference of
frame->data[1] later.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com >
(cherry picked from commit 0a8bff788bAndreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
ef699b4135
dds: validate compressed source buffer size
...
A too small buffer will cause segfaults somewhere below
decompress_texture_thread.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9a37d47644Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
a8513826dd
dds: validate source buffer size before copying
...
If it is too small av_image_copy_plane segfaults.
Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 1675809d2dAndreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:46 +01:00
df31acda64
dvdsubdec: validate offset2 similar to offset1
...
If it is negative, it causes segmentation faults in decode_rle.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f621749d11Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
d09fd0736a
brstm: reject negative sample rate
...
A negative sample rate causes assertion failures in av_rescale_rnd.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 7b67fe20f6Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
c3f276b608
aacps: avoid division by zero in stereo_processing
...
This fixes a SIGFPE crash in the aac_fixed decoder.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com >
(cherry picked from commit ef7fe9851eAndreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
510d88ae93
softfloat: assert when the argument of av_sqrt_sf is negative
...
The correct result can't be expressed in SoftFloat.
Currently it returns a random value from an out of bounds read.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit f3866a14c3Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:45 +01:00
c4133b25f8
avcodec/takdec: Use memove, avoid undefined memcpy() use
...
Fixes: e214333cbd94c91228e624ff39329ce6/asan_generic_4a5159_6412_96cda2530e80607210ab41ccae3d456d.tak
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 7cea3430a5Andreas.Cadhalpun@googlemail.com >
2015-11-26 01:35:41 +01:00
c9b3451da3
Update Changelog
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-12 01:17:17 +01:00
46f83b059b
aacsbr_fixed: check for envelope scalefactors overflowing
...
This prevents various values from getting an insanely huge exponent.
If someone knows a cleaner solution, thats welcome!
This is similar to commit 8978c74michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 0e36a14a42michael@niedermayer.cc >
2015-11-12 00:43:01 +01:00
ce2664f5f7
aacdec: don't return frames without data from aac_decode_er_frame
...
This is similar to commit ec38a1bAndreas.Cadhalpun@googlemail.com >
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d7f29bfa69michael@niedermayer.cc >
2015-11-12 00:42:50 +01:00
8364d607ac
avcodec/aacsbr_fixed: Try to initialize sum[0..1] differently to fix build with VS2012
...
Found-by: Hendrik Leppkes <h.leppkes@gmail.com >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 8a024f6a43michael@niedermayer.cc >
2015-11-12 00:42:43 +01:00
21e42d9b0d
avcodec/aacsbr: Use FLOAT_0
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit dcf1cf5d24michael@niedermayer.cc >
2015-11-12 00:42:35 +01:00
e10c353ca5
softfloat: handle INT_MIN correctly in av_int2sf
...
Otherwise v=INT_MIN doesn't get normalized and thus triggers av_assert2
in other functions.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 9ac61e73d0michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
72be96ac55
avutil/softfloat: Include negative numbers in cmp/gt tests
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 955cdc43a3michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
6581e40e1a
avutil/softfloat: Fix av_gt_sf() with large exponents try #2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 05b05a7a84michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
0f9c617979
avutil/softfloat: Add test for av_gt_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 791ea23e57michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
f9998d1994
avutil/softfloat: Extend the av_cmp_sf() test to cover a wider range of exponents
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit ecfb076141michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
7ad4bf4899
avutil/softfloat: Fix overflows in shifts in av_cmp_sf() and av_gt_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit cee3c9d29amichael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
43ada90fc5
avutil/softfloat: Add test for av_cmp_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit df2a2117d2michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
476ddffccb
avutil/common: add FFDIFFSIGN macro
...
This is of use for defining comparator callbacks. Common approaches like
return x-y are not safe due to the risks of overflow.
Furthermore, the (x > y) - (x < y) trick is optimized to branchless
code.
This also documents this macro accordingly.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc >
Signed-off-by: Ganesh Ajjanagadde <gajjanagadde@gmail.com >
(cherry picked from commit 265f83fd35michael@niedermayer.cc >
2015-11-12 00:00:57 +01:00
b533998d0a
avutil/softfloat: Add tests for exponent underflows
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 596dfe7d6cmichael@niedermayer.cc >
2015-11-11 23:32:58 +01:00
acd203fc0d
avutil/softfloat: Fix exponent underflow in av_div_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 046218b212michael@niedermayer.cc >
2015-11-11 23:32:54 +01:00
402c4a9f81
avutil/softfloat: Fix exponent underflow in av_mul_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a1e3303fc0michael@niedermayer.cc >
2015-11-11 23:32:51 +01:00
6e4bfbe936
avutil/softfloat: Fix typo in av_mul_sf() doxy
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 4135a2bfd6michael@niedermayer.cc >
2015-11-11 23:32:48 +01:00
f38beb47da
avutil/softfloat: Correctly set the exponent for 0.0 in av_sqrt_sf()
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 107db5abf3michael@niedermayer.cc >
2015-11-11 23:32:32 +01:00
efa9128556
avutil/softfloat: FLOAT_0 should use MIN_EXP
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit a66b243d52michael@niedermayer.cc >
2015-11-11 23:32:27 +01:00
3de8521667
swresample/resample: increase precision for compensation
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 351e625d60michael@niedermayer.cc >
2015-11-11 18:41:01 +01:00
edf5e88eac
lavf/mov: add support for sidx fragment indexes
...
Fixes trac #3842
(cherry picked from commit 4ab5666759michael@niedermayer.cc >
2015-11-11 02:50:39 +01:00
8d634be4ce
update versions for 2.8.2
...
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
2015-11-11 02:50:39 +01:00
9a6d581076
avformat/mxfenc: Only store user comment related tags when needed
...
Also support disabling them as they seem to cause problems to some
Users. They are also not allowed in IRT D-10 thus the default for
mxf_d10 is not to write them
This also decreases the filesize when no user comment are stored
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit d9726893f3
2015-11-11 02:21:32 +01:00
84f8157662
tests/fate/avformat: Fix fate-lavf
...
The CMP variable seems to have been inherited from fate-api-seek which set it to null
the mxf reference needed a change due to c7e14a279fmichael@niedermayer.cc >
(cherry picked from commit b83c849e87michael@niedermayer.cc >
2015-11-10 11:20:21 +01:00
e5a2f5e74d
doc/ffmpeg: Clarify that the sdp_file option requires an rtp output.
...
Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit b02201efb5michael@niedermayer.cc >
2015-11-09 23:58:05 +01:00
dac3598563
ffmpeg: Don't try and write sdp info if none of the outputs had an rtp format.
...
Fixes a segfault when trying to write nonexistent rtp information.
Signed-off-by: Simon Thelen <ffmpeg-dev@c-14.de >
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 70fb5eadc5michael@niedermayer.cc >
2015-11-09 23:56:29 +01:00
c0cd8747ef
apng: use correct size for output buffer
...
The buffer needs s->bpp bytes, at maximum currently 10.
Assert that s->bpp is not larger.
This fixes a stack buffer overflow.
Reviewed-by: wm4 <nfxjfg@googlemail.com >
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit 3e8e1a660emichael@niedermayer.cc >
2015-11-07 14:11:12 +01:00
e217224456
jvdec: avoid unsigned overflow in comparison
...
The return type of strlen is size_t, i.e. unsigned, so if pd->buf_size
is 3, the right side overflows leading to a wrong result of the
comparison and subsequently a heap buffer overflow.
Reviewed-by: Paul B Mahol <onemda@gmail.com >
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com >
(cherry picked from commit db374790c7michael@niedermayer.cc >
2015-11-07 14:10:41 +01:00
56419053bc
avcodec/jpeg2000dec: Clip all tile coordinates
...
Fixes out of array access
Fixes: b877a6b788a25c70e8b1d014f8628549/asan_heap-oob_1da2c3f_2324_5a1b329b0b3c4bb6b1d775660ac56717.r3d
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit 43492ff3abmichael@niedermayer.cc >
2015-11-07 03:02:04 +01:00
11b4822ddb
avcodec/microdvddec: Check for string end in 'P' case
...
Fixes out of array read
Fixes: a9502b60f4cecc19475382aee255f73c/asan_heap-oob_1e87fba_2548_a8ad47f6dde36644fe9cdc444d4632d0.sub
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit c719cd6cf7michael@niedermayer.cc >
2015-11-07 01:10:58 +01:00
2de2959305
avcodec/dirac_parser: Fix undefined memcpy() use
...
Fixes: 9d375e415486edd1a0c826f2307d89a4/asan_generic_4a5159_1577_faa333e83dacdd9e4dd322380aeed537.iss
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc >
(cherry picked from commit daefd8ab2fmichael@niedermayer.cc >
2015-11-07 01:10:16 +01:00
Michael Niedermayer