* commit '65830277d2d2ee3658e1f070a61044fff261ed3e':
prores: Add a codepath for decoding errors
nut: Fix unchecked allocations
avi: directly resync on DV in AVI read failure
mov: Don't allocate arrays with av_malloc that will be realloced
shorten: Extend fixed_coeffs to properly support pred_order 0
Prepare for 9.11 RELEASE
avi: properly fail if the dv demuxer is missing
prores: Reject negative run and level values
audio_mix: fix channel order in mix_1_to_2_fltp_flt_c
indeo4: Check the inherited quant_mat
Conflicts:
RELEASE
libavcodec/indeo4.c
libavcodec/shorten.c
libavformat/nut.c
libavformat/nutdec.c
libavformat/nutenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '0358a099f8abe60230dc2e5bec59bfceb7d1be07':
indeo4: Check the block size if reusing the band configuration
ffv1: Assume bitdepth 0 means 8bit
alsa-audio-dec: explicitly cast the delay to a signed int64
matroskadec: pad EBML_BIN data.
motionpixels: clip VLC codes.
avidec: fix a memleak in the dv init code.
Conflicts:
libavcodec/ffv1dec.c
libavcodec/indeo4.c
libavdevice/alsa-audio-dec.c
libavformat/matroskadec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '7b337b122959b9bf634c31b549892df974f35b40':
truemotion1: make sure index does not go out of bounds
pcx: round up in bits->bytes conversion in a buffer size check
omadec: Fix wrong number of array elements
omadec: check GEOB sizes against buffer size
ac3dec: fix outptr increment.
avio: Use AVERROR_PROTOCOL_NOT_FOUND
Conflicts:
libavcodec/ac3dec.c
libavcodec/pcx.c
libavformat/omadec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '0e8ae6d10c609bb968c141aa2436413a55852590':
mpegvideo: Drop a faulty assert
lavr: check that current_buffer is not NULL before using it
pmpdec: check that there is at least one audio packet.
lzw: switch to bytestream2
gifdec: convert to bytestream2
Conflicts:
libavcodec/gifdec.c
libavcodec/lzw.c
libavcodec/lzw.h
libavformat/pmpdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c5c7e3e6f7cf17943c04bd078f260eaf789afbc9':
gifdec: check that the image dimensions are non-zero
gifdec: return meaningful error codes.
eacmv: check the framerate before setting it.
rv30: fix extradata size check.
sdp: Check that fmt->oformat is non-null before accessing it
matroskadec: use correct compression parameters for current track CodecPrivate
vc1: Reset numref if fieldmode is not set
Conflicts:
libavcodec/gifdec.c
libavcodec/rv30.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The header parser uses forward and backward parsing, making the
bulletproof prevention of loops difficult, thus this simple
detection code.
If someone improves the forward/backward parsing so it cannot loop
then this commit should be reverted
Fixes Ticket3278
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1c010fd035)
Some muxers store invalid timestamps there, which breaks seeking
Fixes Ticket2739
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5e0c7eab2a)
Otherwise the expression will be evaluated as unsigned, which will break
when the result should be negative.
CC:libav-stable@libav.org
(cherry picked from commit 089fac77a6)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
It might be passed to code requiring padding, such as lzo decompression.
Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 30be1ea33e)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
When the protocol is missing ffurl_alloc() should return
AVERROR_PROTOCOL_NOT_FOUND instead of AVERROR(ENOENT).
Bug-Id: 577
CC: libav-stable@libav.org
(cherry picked from commit ea71aafd68)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Fixes a segfault during resampling when compiled with -DDEBUG.
Fixes all fate-lavr-resample tests with -DDEBUG.
CC:libav-stable@libav.org
(cherry picked from commit 211ca69b13)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
The code cannot handle there being none, but that should not happen for
valid files.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 1b5d065ca7)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Also add an error message an return a more suitable error code
(INVALIDDATA, not EINVAL);
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit c453723ad7)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
It has been checking the number of bits in the offset instead of the
actual offset.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit a6a2282c25)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This fixes an assertion failure and regression and restores previous behaviour
Fixes Ticket3197
An alternative would be to fail hard in this case and refuse to mux such data.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit de2a2caf4d)
* qatar/release/9:
arm: Don't clobber callee saved registers in scalarproduct
alsdec: check block length
h264/mpegvideo: do not provide pixel formats for hwaccels that are not compiled in
mpeg4video_parser: init mpeg4 static tables.
Conflicts:
libavcodec/mpeg4video_parser.c
libavcodec/mpeg4videodec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '56eded8bc7bccdf14245bae3a45b0fecf9d9d122':
mpeg4videodec: split initializing static tables into a separate function
x86: ac3dsp: Remove 3dnow version of ff_ac3_extract_exponents
pthread: Avoid spurious wakeups
Conflicts:
libavcodec/mpeg4videodec.c
tests/fate/ac3.mak
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of bounds access
Fixes CID732170
Fixes CID732169
No filter is known to use this function in a way so the issue can be reproduced.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ab2bfb85d4)
Conflicts:
libavfilter/avfilter.c
(cherry picked from commit 86591b244f3a27293153896813f5569b49b2f5c0)
Conflicts:
libavfilter/avfilter.c
(cherry picked from commit 400c4f8fa3fd58951dc3f356b2b00484e3363694)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fix writing over the end
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Addresses: CVE-2013-0845
(cherry picked from commit 2a0fb7286d)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
works around bug in gccs inline asm register assignment
Fixes Ticket3177
gcc from 4.4 to 4.6 is affected at least, no non affected gccs known
clang seems not affected
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0538b29ae8)
They are used when decoding the frame header.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Such pics behave more like headers which we also dont count.
Fixes Ticket3146
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a8dec360c5)
a758c5e added probing for various tools, such as AS. Unfortunately, GNU
AS is reading stdin with -v, and thus configure is stalled with
configure arguments such as --as=as.
Fixes Ticket #1898.
(cherry picked from commit dbb41f93c1)
The function requires increasing the fuzz factor for the ac3/eac3 encode
tests and even so makes fate fail. It only provides a slight encoding
speedup for legacy CPUs that do not support SSE2. Thus its benefit is not
worth the trouble it creates and fixing it would be a waste of time.
This ensures that frames do not get mixed on context reinits
Fixes Ticket2836
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3c9dd93faa)
Do not consider it an error if we have no frames and should discard one.
This condition can easily happen when decoding is started from an I frame
Fixes Ticket2811
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08a8976196)
Conflicts:
libavcodec/h264_refs.c
Fixes seeking to the last frame in CBR files
Fixes Ticket2773
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ba8716df7f)
This simplifies the code and fixes a deadlock
Fixes Ticket2927
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 29ffeef5e7)
Conflicts:
libavcodec/h264.c
pthread_wait_cond can wake up unexpectedly (Wikipedia: Spurious_wakeup).
The FF_THREAD_SLICE thread mechanism could spontaneously execute
jobs or allow the caller of avctx->execute to return before all
jobs were complete.
Test both cases to ensure the wakeup is real.
Signed-off-by: Ben Jackson <ben@ben.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Sometimes, if pthread_create() failed, then pthread_cond_wait() could
accidentally be called in the worker threads after the uninit function
had already called pthread_cond_broadcast(), leading to a deadlock.
Don't call pthread_cond_wait() if c->done is set.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
* TimothyGu/release/1.1:
doc/encoders: add doc for AAC encoder
doc/ffmpeg-formats: Add documentation for 2 parameters that have been missing
doc/encoders: improve libvo-aacenc doc
doc/encoders: Remove options that were not there when branch was cut from master
doc/encoders: reformat and add some clarification in libtwolame doc
doc/encoders: reformat libmp3lame doc
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The merges have filled the changelog of the 1.1 branch with bugfix
entries that ffmpeg 1.1 was never affected by or that where fixed
long ago.
No one has cleaned this mess up and its better to have no changelog file
than one that is 80% wrong.
If someone wants to clean this up, thats of course very welcome, aka yes
patches and pull requests welcome!
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
Prepare for 9.10 RELEASE
h263dec: Remove a hack that can cause infinite loops
mpegvideo: Initialize chroma_*_shift and codec_tag even if the size is 0
vc1dec: Don't decode slices when the latest slice header failed to decode
Conflicts:
RELEASE
libavcodec/h263dec.c
libavcodec/mpegvideo.c
libavcodec/vc1dec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '494f2d4f9e834db1eaf1a7d0160d497f9802013d':
vc1dec: Make sure last_picture is initialized in vc1_decode_skip_blocks
r3d: Add more input value validation
fraps: Make the input buffer size checks more strict
svq3: Avoid a division by zero
rmdec: Validate the fps value
twinvqdec: Check the ibps parameter separately
asfdec: Check the return value of asf_read_stream_properties
mxfdec: set audio timebase to 1/samplerate
Conflicts:
libavcodec/fraps.c
libavcodec/svq3.c
libavformat/mxfdec.c
tests/ref/fate/mxf-demux
tests/ref/seek/lavf-mxf
tests/ref/seek/lavf-mxf_d10
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '7e350b7ddd19af856b55634233d609e29baab646':
pcx: Check the packet size before assuming it fits a palette
rpza: Fix a buffer size check
xxan: Disallow odd width
xan: Only read within the data that actually was initialized
xan: Use bytestream2 to limit reading to within the buffer
pcx: Consume the whole packet if giving up due to missing palette
pngdec: Stop trying to decode once inflate returns Z_STREAM_END
mov: Make sure the read sample count is nonnegative
bfi: Add some very basic sanity checks for input packet sizes
bfi: Avoid divisions by zero
electronicarts: Add more sanity checking for the number of channels
riffdec: Add sanity checks for the sample rate
Conflicts:
libavcodec/pcx.c
libavcodec/xan.c
libavformat/mov.c
libavformat/riff.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '04d2f9ace3fb6e880f3488770fc5a39de5b63cbb':
mvi: Add sanity checking for the audio frame size
alac: Do bounds checking of lpc_order read from the bitstream
xwma: Avoid division by zero
avidec: Make sure a packet is large enough before reading its data
vqf: Make sure the bitrate is in the valid range
vqf: Make sure sample_rate is set to a valid value
electronicarts: Check packet sizes before reading
lavf: Avoid setting avg_frame_rate if delta_dts is negative
vc1dec: Undo mpegvideo initialization if unable to allocate tables
vc1dec: Fix leaks in ff_vc1_decode_init_alloc_tables on errors
wnv1: Make sure the input packet is large enough
dcadec: Validate the lfe parameter
Conflicts:
libavcodec/dcadec.c
libavcodec/wnv1.c
libavformat/avidec.c
libavformat/electronicarts.c
libavformat/utils.c
libavformat/xwma.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'ce1dacb435460dda1f9d453eaaeac44bd502aca4':
rl2: Avoid a division by zero
wtv: Add more sanity checks for a length read from the file
segafilm: Validate the number of audio channels
qpeg: Add checks for running out of rows in qpeg_decode_inter
mpegaudiodec: Validate that the number of channels fits at the given offset
asvdec: Verify the amount of extradata
idroqdec: Make sure a video stream has been allocated before returning packets
rv10: Validate the dimensions set from the container
xmv: Add more sanity checks for parameters read from the bitstream
ffv1: Make sure at least one slice context is initialized
truemotion2: Use av_freep properly in an error path
eacmv: Make sure a reference frame exists before referencing it
mpeg4videodec: Check the width/height in mpeg4_decode_sprite_trajectory
ivi_common: Make sure color planes have been initialized
mov: Don't use a negative duration for setting other fields
Conflicts:
libavcodec/eacmv.c
libavcodec/ffv1.c
libavcodec/mpeg4videodec.c
libavcodec/mpegaudiodec.c
libavcodec/qpeg.c
libavformat/mov.c
libavformat/wtv.c
libavformat/xmv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '163196562fe744149ef599d754c30c08a9898381':
oggparseogm: Convert to use bytestream2
rv34: Check the return value from ff_rv34_decode_init
matroskadec: Verify realaudio codec parameters
mace: Make sure that the channel count is set to a valid value
svq3: Check for any negative return value from ff_h264_check_intra_pred_mode
vp3: Check the framerate for validity
cavsdec: Make sure a sequence header has been decoded before decoding pictures
vocdec: Don't update codec parameters mid-stream
sierravmd: Do sanity checking of frame sizes
omadec: Properly check lengths before incrementing the position
mpc8: Make sure the first stream exists before parsing the seek table
Conflicts:
libavcodec/mace.c
libavformat/oggparseogm.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'f8a72f041c049e812dfa1f32156327e9778f5710':
mpc8: Check the seek table size parsed from the bitstream
zmbvdec: Check the buffer size for uncompressed data
ape: Don't allow the seektable to be omitted
shorten: Break out of loop looking for fmt chunk if none is found
shorten: Use a checked bytestream reader for the wave header
smacker: Make sure we don't fill in huffman codes out of range
smacker: Avoid integer overflow when allocating packets
smacker: Don't return packets in unallocated streams
dsicin: Add some basic sanity checks for fields read from the file
Conflicts:
libavcodec/shorten.c
libavcodec/smacker.c
libavcodec/zmbv.c
libavformat/mpc8.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The actual usefulness of the hack is not known, and it does cause
infinite loops with some broken input files.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8812a8057f)
Signed-off-by: Martin Storsjö <martin@martin.st>
This fixes breakage in a few fate tests on certain setups
(that for some reason didn't break on OS X) after the previous
commit (8812a8057). Currently, some video streams are initialized
in ff_MPV_common_init with width/height set at 0 and only changed
to a proper video size with ff_MPV_common_frame_size_change later.
The breakage was diagnosed by Anton Khirnov.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5f24fe82e5)
Signed-off-by: Martin Storsjö <martin@martin.st>
If the height is zero, the decompression will probably end up
failing due to not fitting into the allocated buffer later
anyway, so this doesn't need any more elaborate check.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 601c2015bc)
Abort if it is invalid if strict error checking has been requested.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0f310a6f33)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavformat/rmdec.c
This is required, since invalid parameters actually could
pass the switch check below.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c77d409bf9)
This fixes reads out of bounds.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d1d99e3bef)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/pcx.c
This makes sure errors in setting stream parameters are passed
on to the caller. This avoids successfully opening files while
some parameters aren't filled in properly.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit cc41167aed)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
We read 2 bytes for 15 out of 16 pixels, therefore we need to
have at least 30 bytes, not 16.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 7ba0cedbfe)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Decoded data is always written in pairs within this decoder.
This fixes writes out of bounds.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit aa0dd52434)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Previously, we returned 0, meaning successful decoding but 0
bytes consumed, leading to an infinite loop.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 9fb0de86b4)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
If the input buffer contains more data after the deflate stream,
the loop previously left running infinitely, with inflate returning
Z_STREAM_END.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a81cad8f86)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This avoids setting a negative number of frames, ending up with a
negative average frame rate.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c231987662)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
In lpc_prediction(), we write up to array element 'lpc_order' in
an array allocated to hold 'max_samples_per_frame' elements.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 59480abce7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
If a zero-length video packet is to be returned, just return
AVERROR(EAGAIN) and switch back to the audio stream.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 9fc7184d1a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This avoids divisions by zero later (and possibly assertions in
time base scaling), since an invalid rate_flag combined with an
invalid bitrate below could pass the mode combination test.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 9277050e29)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Previously, s->context_initialized was left set to 1
if ff_vc1_decode_init_alloc_tables failed, skipping the
initialization completely on the next decode call.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit b772b0e28e)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The init function reads one byte of extradata.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f50803354c)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Since the number of channels is multiplied by 36 and assigned to
to a uint16_t, make sure this calculation didn't overflow. (In
certain cases the calculation could overflow leaving the
truncated block_align at 0, leading to divisions by zero later.)
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d4c2a3740f)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This avoids crashes when initializing the range coder for
the first slice context.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit b1db33159f)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This is similar to an existing check for the second-last frame
from 062421e3.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit ea78a348d8)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/eacmv.c
Some files have the duration set to -1 in the mdhd atom, more
or less legitimately. (We produce such files ourselves, for the
initial duration in fragmented mp4 files.)
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 7f8d41eb09)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Also pass on any returned error code.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 1115689d54)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/svq3.c
If we really want to support parameter changes, they need to be
signalled along with the AVPackets as parameter change side data,
not just changing the AVCodecContext parameters when a packet
is demuxed (since there may be other earlier packets yet undecoded).
Something similar was already done for the sample rate in 0883109b2,
but some parameters were left changeable.
This avoids having to recheck the channel count for validity for
each decoded frame in (ad)pcm decoders, unless the decoders
explicitly say that they accept parameter changes.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5bbfe193a0)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Limit the size to INT_MAX/2 (for simplicity) to be sure that
size + BYTES_PER_FRAME_RECORD won't overflow.
Also factorize other existing error return paths.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0ef1660a63)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Limit the size to INT_MAX/2 (for simplicity) to be sure that
size + FF_INPUT_BUFFER_PADDING_SIZE won't overflow.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 459f2b393a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Also don't pointlessly set the buffer size to 1 after copying
one packet.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0d61f26001)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The seektable is required for filling in ape->frames[i].pos
further down.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 183b9d843a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* qatar/release/9:
Update Changelog
Prepare for 9.9 RELEASE
lavf: fix the comparison in an overflow check
dv: Add a guard to not overread the ppcm array
nuv: check ff_rtjpeg_decode_frame_yuv420 return value
Conflicts:
Changelog
RELEASE
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Currently all uses of the emu edge code as well as the code itself
assume int linesize
changing some but not changing all would introduce a security issue
once all use this typedef a simple search and replace can be
done to switch them all to ptrdiff_t
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2ffead98dd)
Conflicts:
libavcodec/videodsp.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
mpegvideo: Avoid 32-bit wrapping of linesize multiplications
mjpegb: Detect changing number of planes in interlaced video
alac: Check that the channels fit at the given offset
4xm: Check that the read track value is non-negative
Conflicts:
libavcodec/alac.c
libavcodec/mjpegdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The check added in df33a58e53 does not work
at all, rather it broke the summing of bitrates completely.
The comparission was wrong way around.
This commit replaces it by a simpler and hopefully clearer check
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a5d67bc796)
Conflicts:
libavformat/utils.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'aade60ab165716523788cd11caf03ae61b40144a':
matroskadec: Check that .lang was allocated and set before reading it
alac: Limit max_samples_per_frame
ape demuxer: check for EOF in potentially long loops
4xm: check that bits per sample is strictly positive
lavf: avoid integer overflow when estimating bitrate
pictordec: pass correct context to avpriv_request_sample
Conflicts:
libavcodec/pictordec.c
libavformat/matroskadec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '8dc4b2c92e492aa172327d10c926d5ca3a04371c':
pictordec: break out of both decoding loops when y drops below 0
vcr1: add sanity checks
Conflicts:
libavcodec/pictordec.c
libavcodec/vcr1.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
These prevent the rgb ljpeg code from being run on parameters that it doesnt
support. No testcase available but it seems possible to trigger these.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 61c68000ed)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This makes sure that linesize * start_y doesn't overflow, so that
emulated_edge_mc can get back the original value if needed.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a711a2cb47)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The code tries to decode a number of channels at the
offset given by the ff_alac_channel_layout_offsets table.
Even if the number of channels decoded so far doesn't
exceed the total number of channels, we need to check that
we actually can decode that number of channels at this offset
as well.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 35cbc98b72)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Otherwise buffer size calculations in allocate_buffers could
overflow later, making the code think a large enough buffer
actually was allocated.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f7c5883126)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Otherwise picmemset can get called with negative y, resulting in an
invalid write.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5f7aecde02)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
lxf needs a parser (or would need to set a few fields explicitly).
Fixes Ticket2917
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8349be852b)
Such changes are not allowed nor supported
Fixes Ticket2906
Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 547d690d67)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Fixes Ticket2919
Found_by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 86736f59d6)
* jamrial/release/1.1:
avformat/matroskadec: check out_samplerate before using it in av_rescale()
matroskadec: Improve TTA duration calculation
matroskaenc: simplify mkv_check_tag()
lavf/matroskaenc: Check for valid metadata before creating tags
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Might fix Ticket1907 (I have no testcase so i cant test)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4758e32a6c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This allows to name an internal reference in the POD/MAN output.
(cherry picked from commit c499d45c6b)
Signed-off-by: Timothy Gu <timothygu99@gmail.com>
In particular, fix wrong vertical mirroring command, and clarify
and extend explanation.
Based on a patch by littlebat <dashing.meng@gmail.com>.
Should fix trac ticket #2413.
(cherry picked from commit 215ca86475)
Signed-off-by: Timothy Gu <timothygu99@gmail.com>
Conflicts:
doc/filters.texi
Fixes out of array access
Fixes Ticket2895
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9a271a9368)
Conflicts:
libavcodec/jpeg2000dec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Fixes Ticket2850
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3819db745d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Fixes Ticket2844
Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 880c73cd76)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
ac3: Return proper error codes
ac3: Clean up the error paths
ac3: Do not clash with normal AVERROR
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9: (21 commits)
ogg: Fix potential infinite discard loop
dxa: Make sure the reference frame exists
h261: check the mtype index
segafilm: Error out on impossible packet size
ogg: Always alloc the private context in vorbis_header
rtjpeg: Use init_get_bits8
nuv: Reset the frame on resize
nuv: Use av_fast_realloc
nuv: return meaningful error codes.
nuv: Pad the lzo outbuf
nuv: Do not ignore lzo decompression failures
rtmp: Do not misuse memcmp
rtmp: rename data_size to size
vc1: check mb_height validity.
vc1: check the source buffer in vc1_mc functions
bink: Bound check the quantization matrix.
aac: Check init_get_bits return value
aac: return meaningful errors
aac: K&R formatting cosmetics
oma: correctly mark and decrypt partial packets
...
Conflicts:
libavcodec/aacdec.c
libavcodec/h261dec.c
libavcodec/nuv.c
libavcodec/vc1dec.c
libavformat/oggparsevorbis.c
libavformat/omadec.c
libavformat/rtmpproto.c
tests/ref/fate/nuv-rtjpeg
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '0b6adcf76bda8994902f5b6d8e694b0b916ea210':
oma: refactor seek function
xl: Make sure the width is valid
8bps: Bound-check the input buffer
4xm: Reject not a multiple of 16 dimension
alsdec: Clean up error paths
alsdec: Fix the clipping range
dsicinav: Clip the source size to the expected maximum
dsicinav: Bound-check the source buffer when needed
dsicinav: K&R formatting cosmetics
lavf: Make sure avg_frame_rate can be calculated without integer overflow
mov: Do not allow updating the time scale after it has been set
mov: Seek back if overreading an individual atom
ac3dec: Don't consume more data than the actual input packet size
indeo: Reject impossible FRAMETYPE_NULL
indeo: Do not reference mismatched tiles
Conflicts:
libavcodec/4xm.c
libavcodec/8bps.c
libavcodec/alsdec.c
libavcodec/dsicinav.c
libavcodec/ivi_common.c
libavcodec/xl.c
libavformat/mov.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'fbbe487b1c1f21339cff9ca86c3dfc495ad1c2c6':
indeo: Sanitize ff_ivi_init_planes fail paths
indeo5: return proper error codes
indeo: Bound-check before applying motion compensation
indeo: Bound-check before applying transform
indeo4: Validate scantable dimension
indeo4: Check the quantization matrix index
indeo4: Do not access missing reference MV
ac3dec: Increment channel pointers only once per channel
dca: Respect the current limits in the downmixing capabilities
dca: Error out on missing DSYNC
pcm: always use codec->id instead of codec_id
mlpdec: Do not set invalid context in read_restart_header
pcx: Do not overread source buffer in pcx_rle_decode
wmavoice: conceal clearly corrupted blocks
iff: Do not read over the source buffer
qdm2: Conceal broken samples
qdm2: refactor joined stereo support
Conflicts:
libavcodec/ac3dec.c
libavcodec/dcadec.c
libavcodec/iff.c
libavcodec/indeo4.c
libavcodec/indeo5.c
libavcodec/ivi_common.c
libavcodec/mlpdec.c
libavcodec/pcx.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The parsing function return AVERROR and AAC_AC3_PARSE_ERROR values,
make sure they are not misunderstood.
(cherry picked from commit 6258d362b8)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* commit 'c02d4c1a98aef485be25228b33adb4ce357173e4':
adpcm: Write the correct number of samples for ima-dk4
imc: Catch a division by zero
atrac3: Error on impossible encoding/channel combinations
atrac3: set the getbits context the right buffer_end
atrac3: fix error handling
qdm2: check and reset dithering index per channel
qdm2: formatting cosmetics
qdm2: use init_static_data
westwood_vqa: do not free extradata on error in read_header
vqavideo: check the version
rmdec: Use the AVIOContext given as parameter in rm_read_metadata()
avio: Handle AVERROR_EOF in the same way as the return value 0
Conflicts:
libavcodec/adpcm.c
libavcodec/qdm2.c
libavcodec/vqavideo.c
libavformat/rmdec.c
libavformat/westwood_vqa.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'fa6eef4210c2fd7f7324d558b09311c75987a31e':
wtv: Mark attachment with a negative stream id
avconv: do not use lavfi direct rendering with -deinterlace
avidec: Let the inner dv demuxer take care of discarding
Update Changelog
kmvc: Clip pixel position to valid range
kmvc: use fixed sized arrays in the context
indeo: reject negative array indexes
indeo: Cosmetic formatting
indeo: Refactor ff_ivi_init_tiles and ivi_decode_blocks
indeo: Refactor ff_ivi_dec_huff_desc
indeo: use a typedef for the mc function pointer
indeo: use proper error code
Conflicts:
Changelog
ffmpeg.c
libavcodec/ivi_common.c
libavformat/wtv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c8fb5d0f383fcbb0da9bdef609c3a826df0064f7':
Update Changelog
indeo: check for reference when inheriting mvs
indeo: use proper error code
indeo: Properly forward the error codes
mjpeg: Check the unescaped size for overflows
wmapro: error out on impossible scale factor offsets
wmapro: check the min_samples_per_subframe
wmapro: return early on unsupported condition
wmapro: check num_vec_coeffs against the actual available buffer
wmapro: make sure there is room to store the current packet
lavc: move put_bits_left in put_bits.h
4xm: do not overread the source buffer in decode_p_block
4xm: check bitstream_size boundary before using it
Conflicts:
Changelog
libavcodec/4xm.c
libavcodec/mjpegdec.c
libavcodec/wmaprodec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '5c54fc6195e52c329b88cf5a56d18628f0ee0029':
Prepare for 9.8 RELEASE
update Changelog
smacker: check frame size validity
smacker: pad the extradata allocation
smacker: check the return value of smacker_decode_tree
smacker: fix an off by one in huff.length computation
4xm: do not overread the prestream buffer
4xm: validate the buffer size before parsing it
4xm: reject frames not compatible with the declared version
4xm: drop pointless assert
4xm: forward errors from decode_p_block
4xm: fold last_picture lazy allocation in decode_p_frame
4xm: do not overread while parsing header
4xm: refactor fourxm_read_header
4xm: K&R formatting cosmetics
4xm: use the correct logging context
Conflicts:
Changelog
RELEASE
libavcodec/4xm.c
libavcodec/smacker.c
libavformat/4xm.c
libavformat/smacker.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Calculate the duration as accurately as possible to improve decoding of samples
where the last frame is smaller than the rest.
Signed-off-by: James Almer <jamrial@gmail.com>
Approved-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit af248fa117)
Tags must have at least one SimpleTag element to be spec conformant.
Updated lavf-mkv and seek-lavf-mkv FATE references as the tests were affected by
this.
Fixes ticket #2785
Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 088ed53146)
Conflicts:
tests/ref/lavf/mkv
Seeking in certain broken files would cause ogg_read_timestamp
to fail because ogg_packet would go into a state where all packets
of stream 1 would be discarded until the end of the stream.
Bug-Id: 553
CC: libav-stable@libav.org
Signed-off-by: Jan Gerber <j@v2v.cc>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 9a27acae9e)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
It is possible to have an initial broken header and then valid packets.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3562684db7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The decompressed buffer can be used after codec_reinit, so it must be
preserved.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2df0776c22)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
And properly update the buf_size with the correct size.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 075dbc1855)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Update the fate reference since the last broken frame is not decoded
anymore.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit aae159a7cc)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Incomplete crypted files would lead to a read after buffer boundary
otherwise.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2219e27b5b)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavformat/omadec.c
A packet larger than cin->bitmap_size does not make sense.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit fd81899321)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
If either of the deltas is too large for the multiplications to
succeed, don't use this for setting the avg frame rate.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e740929a07)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The time scale is set in mdhd, and later validated in the
enclosing trak atom once all of its children have been parsed.
A loose mdhd atom outside of a trak atom could update the time
scale of the last stream without any validation.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 31931520df)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This was handled properly in the normal return case at the end
of the function, but not in this special case.
Returning a value larger than the input packet size can cause
problems for certain library users.
Returning the actual input buffer size unconditionally, since
it is not guaranteed that frame_size is set to a sensible
value at this point.
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8f24c12be7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
If the channel mapping map multiple output channels to one
input channel, we should only increment the actual pointer once.
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 68e57cde68)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The faulty values rippled further down the codepath causing a
hard-to-track segfault in the assembly code.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e9d394f3fa)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/mlpdec.c
qdm2 does support only two channels. Loop over the run once.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit adadc3f244)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Checking per subband would have the index exceed the
dithering noise table size.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 744a11c996)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Apply the usual style plus drop few unnecessary return at the end
of void functions.
(cherry picked from commit 76efedeadb)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The extradata is already freed by avformat_open_input on
failure.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 76f5dfbfd9)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This fixes crashes when playing back certain RealRTSP streams.
When invoked from the RTP depacketizer, the full realmedia
demuxer isn't invoked, but only certain functions from it, where
a separate AVIOContext is passed in as parameter (for the buffer
containing the data to parse). The functions called from within
those entry points should only be using that parameter, not
s->pb. In the depacketizer case, s is the RTSP context, where ->pb
is null.
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d35b6cd377)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This makes sure the ffurl_read_complete function actually
returns the number of bytes read, as the documentation of the
function says, even if the underlying protocol uses AVERROR_EOF
instead of 0.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d876be87a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
A sid 0 would be mismatched to the attachment.
Prevent NULL pointer dereference.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f5e646a00a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Fixes Ticket2859
Note, testcases related to the downmix channels are welcome.
(id like to make sure this is working correctly now, as obviously it didnt
work before ...)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c56d4dab03)
Without this the block_align or bitrate value is not available to the decoder
Fixes Ticket2858
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3d64845600)
-deinterlace allocates a temporary buffer that is freed immediately
after the frame is sent to lavfi, which results in use after free.
Disable direct rendering when -deinterlace is used.
CC:libav-stable@libav.org
Bug-id: 479
Breaks decoding pgms with 255 < maxval < 65535.
Found-by: Carl Eugen Hoyos <cehoyos@ag.or.at>.
This reverts commit a0348d0966.
(cherry picked from commit 768e40b451)
This should also work reasonable with truncated and growing mp3s.
Fixes Ticket2590
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e096283ea5)
Conflicts:
libavformat/mp3dec.c
since there should not be more than one fisbone for a given stream.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 63d7684fef)
Conflicts:
libavformat/oggparseskeleton.c
start_granule should be applied to the stream referenced in the fisbone packet, not to the
Skeleton stream.
This was broken in d1f05dd183 and produced bogus warnings about
multiple fisbone in the same stream on files with more than one stream.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3960992f0a)
Avoid some boilerplate code to dynamically allocate and then free the
buffers.
(cherry picked from commit 8f68977054)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/kmvc.c
Spin large and mostly self contained blocks into stand alone
functions.
(cherry picked from commit 62256010e9)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The same is done already for qdelta.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b36e1893ef)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
If the tile data size does not match the buffer size it did not
return an AVERROR_INVALIDDATA causing futher corruption later.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7388c0c586)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Must be at least WMAPRO_BLOCK_MIN_SIZE.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d4a217a408)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Check for out of picture macroblocks before calling mcdc.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 94aefb1932)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
The code that copies any extradata from the MXFDescriptor to the codec does
not set the size, which it should otherwise the copied data is useless.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 42bd0cd21a)
Conflicts:
libavformat/mxfdec.c
The volatile is not required here, and prevents a miscompilation with GCC
4.8.1 when building on x86 with --cpu=i686
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 659df32a9d)
Fixes resource leak and Ticket2450
Reviewed-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1ee8fadb81)
This ensures that theres enough data for mpeg_probe() to recognize mpeg-ps
Fixes Ticket2583
Based on code by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c605adbf56)
Split sound and video tag parsing in separate functions.
(cherry picked from commit e7a44f87d0)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/4xm.c
* qatar/release/9:
tiff: do not overread the source buffer
apetag: use int64_t for filesize
Conflicts:
libavcodec/tiff.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
At least 2 bytes from the source are read every loop.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9c22169769)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/tiff.c
This fixes out of array accesses
The code prior to this commit could not have worked, thus obviously
was untested. I was also not able to find a valid sample that uses this
code.
This fix is thus only based on the description of the format
If someone has a sample that uses unpack_rle(), please mail me.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c1f2c4c3b4)
Conflicts:
libavcodec/vmdav.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '5a01ab0e62c95a60b4848744e623640f5dafe23b':
vmd: use the PALETTE_COUNT constant uniformly
Conflicts:
libavcodec/vmdav.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '7251de30322aff5660e571856132dc6c7256fe94':
wavpack: use bytestream2 in wavpack_decode_block
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '10f77c165c3b3e881bb174a0f57dd62083639072':
pixdesc: mark gray8 as pseudopal
mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
mjpeg: Validate sampling factors
ljpeg: use the correct number of components in yuv
wavpack: validate samples size parsed in wavpack_decode_block
Conflicts:
libavcodec/mjpegdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Otherwise, during error conditions, the caller will be left with
dangling pointers to a destructed packet => boom.
BUG=242786
TEST=ffmpeg_regression_tests
Commit slightly simplified by commiter
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c54a1565f5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes a case where multichannel bitrate isn't accurately
targetted by psy model alone, never achieving the target bitrate.
Now fixed.
Fixes ticket #2625.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
Simplify a little, assume empty frames are acceptable and
do not pointlessly reinit the bytestream2 contexts using
possibly wrong size values.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 676da248ca)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/vmdav.c
Odd chunk size makes no sense for stereo and incomplete chunks are
not supported.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 701966730c)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
And forward those that were already meaningful.
(cherry picked from commit 8c34558131)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/wavpack.c
When JPEG-LS support is disabled the decoder would feed the
data to the JPEG Lossless decode_*_scan function resulting in
faulty decoding.
CC: libav-stable@libav.org
(cherry picked from commit b25e49b187)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
MPV_decode_mb_internal needs 3 * 16 * linesize bytes of scratch buffer
For interlaced content, linesize is multiplied by two after the allocation
of the scratch buffer, and the dest_cr pointer ends past the buffer.
This patch makes ff_mpv_frame_size_alloc allocate a total of
(aligned line_size) * 2 * 16 * 3 bytes, which suffices even for the
interlaced case.
CC:libav-stable@libav.org
Signed-off-by: Jindrich Makovicka <makovick@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 259af1b923)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Fixes out of array read
Fixes ticket #2609.
Found-by: durandal_1707
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 695a766bff)
Prevents inconsistent state and null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 46cb61819d)
Conflicts:
libavcodec/gifdec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d23b8462b5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ee5e97c46)
Conflicts:
libavcodec/gifdec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad002e1a13)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes integer overflow and out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9dd04f6d8c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Solution based on rational.c, which uses isinf() too
This should fix compilation with msvc
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c25224737c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Should fix pgc warning
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc6f848dba)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes calling a random pointer
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7edb984dd0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes out of array accesses
The code prior to this commit could not have worked, thus obviously
was untested. I was also not able to find a valid sample that uses this
code.
This fix is thus only based on the description of the format
If someone has a sample that uses unpack_rle(), please mail me.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c1f2c4c3b4)
Conflicts:
libavcodec/vmdav.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0baa0a5a02)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8d3c99e825)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b39fd7d63648442c20671c3e4b357268ec5c49f2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes a few green artifacts at the top
Fixes rest of Ticket 2535
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c67bca2b5a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes green trash
Fixes part of Ticket2535
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bca50e5cd5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit adaa7743f5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '1ab4578c88dc3e1407da15471bd323ba40c3ebbb':
lavc: Fix assignments in if() when calling ff_af_queue_add
wav: Always seek to an even offset
swscale: Use alpha from the right row in yuva2rgba_c
Prepare for 9.6 Release
Conflicts:
RELEASE
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '0662967d2bbdbe90540eaa8c847f521fa4b75aab':
hls, segment: fix splitting for audio-only streams.
afifo: fix request_samples on the last frame in certain cases
id3v2: check for end of file while unescaping tags
indeo3: fix off by one in MV validity check
Conflicts:
libavformat/id3v2.c
libavformat/segment.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '46fd6e4f2ebbcd5a00847cdb05fe416466d06d37':
aac: check the maximum number of channels
update Changelog
riff: check for eof if chunk size and code are 0
oggdec: fix faulty cleanup prototype
Conflicts:
Changelog
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c8462bd17f35f435192281a2ea4ce8008a7398d3':
mp3dec: fallback to generic seeking when a TOC is not present
svq1dec: clip motion vectors to the frame size.
svq1dec: check that the reference frame has the same dimensions as the current one
qdm2: check that the FFT size is a power of 2
Conflicts:
libavcodec/svq1dec.c
libavformat/mp3dec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '95db1624ef98ccc4ba7ff70d50c4b4d0f8ffed54':
indeo3: switch parsing the header to bytestream2
indeo3: check motion vectors.
rv10: check that extradata is large enough
indeo3: fix data size check
Conflicts:
libavcodec/indeo3.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '8f558c3e101859aec9adcb4b4b270ae1ef8f88b5':
af_channelmap: sanity check input channel indices in all cases.
id3v2: pad the APIC packets as required by lavc.
lavf: make sure stream probe data gets freed.
dfa: check for invalid access in decode_wdlt().
Conflicts:
libavformat/id3v2.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '858864d350320dd807e349bda017026e61a47fe0':
xmv: check audio track parameters validity.
bmv: check for len being valid in bmv_decode_frame().
xmv: do not leak memory in the error paths in xmv_read_header()
matroska: pass the lace size to the matroska_parse_rm_audio
Conflicts:
libavformat/matroskadec.c
libavformat/xmv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'b90816d94b0b5c01f451ff98cfbf1d5ddec9c3c1':
matroska: Update the available size after lace parsing
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '05015d03da1d745bb92915b5cea92dec16af719f':
matroska: fix a corner case in ebml-lace parsing
avfiltergraph: check for sws opts being non-NULL before using them.
configure: Enable hwaccels without external dependencies by default.
oma: Validate sample rates
Conflicts:
libavfilter/avfiltergraph.c
libavfilter/graphparser.c
libavformat/oma.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '2e06758479650f6e2a8820c7105f2d193a701175':
Prepare for 9.5 Release
update Changelog
add missed CVE reference in 9.2 release
fate: fetch samples that match the release series
Conflicts:
Changelog
RELEASE
tests/Makefile
The rsync change is not merged
We need to maintain the ability to checkout and test old revissions
from master. This implies that the default sample repository has the
needed samples for both older and newer revissions. Thus there is no
need for a seperate one for each release.
Comments & Suggestions of course welcome
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Set interlaced to false if we don't have an interlaced frame
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 0881cbf314)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
delta is in samples, not bytes. Also the sample format is not guaranteed
to be planar.
CC:libav-stable@libav.org
(cherry picked from commit 16a4a18db0)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
The current code can fail to return the last frame if it contains
exactly the requested number of samples.
Fixes the join filter test, which previously did not include the last
408 samples in most cases.
CC:libav-stable@libav.org
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 9bfc6e02ba)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavfilter/fifo.c
tests/fate/filter-audio.mak
Prevent an out of buffer bound write.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit af4cc2605c)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Broken bitstreams could report a larger than specified number of
channels and cause outbound writes.
CC:libav-stable@libav.org
(cherry picked from commit a943a132f3)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
They can be different if the last keyframe failed to decode correctly.
Fixes possible invalid reads in such a case.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit b1bb8fb860)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Also add an additional sanity check to the alt_quant table.
Fixes invalid reads with corrupted files.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 66531d634e)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
The data offsets are relative to the bistream header, which is 16 bytes
after the start of the data.
Fixes invalid reads with corrupted files.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 34e6af9e20)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This can happen when the number of skipped lines is not consistent with
the number of coded lines.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3623589edc)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
It can be 0 or -1 for invalid files, which may result in invalid memory
access.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b88f902125)
Conflicts:
libavcodec/bmv.c
Each lace must be independent according to the specification.
Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.
Stricter check than fc43c19a56
CC: libav-stable@libav.org
(cherry picked from commit 25a80a931a)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 2e2ec66741)
This is a fixup for f074618 to reenable auto-detection of dxva in the
build environment.
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
The sample rate index is 3 bits even if currently index 5, 6 and 7 are
not supported.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 0933fd1533)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This is needed in order for the FLV demuxer not to detect a codec change when
using the "flv_metadata" option.
(cherry picked from commit e46a2a7309)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Many players ignore broken aac frames, so don't abort mov or flv
muxing when encountering one, just print a warning instead.
Fixes ticket #2380.
(cherry picked from commit 1741fece70)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361319d0f4)
Conflicts:
tests/ref/lavf/dpx
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
hqdn3d: Fix out of array read in LOWPASS
vf_gradfun: fix uninitialized variable use
Conflicts:
libavfilter/vf_hqdn3d.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c50241080d7599c90fc8b4e74c5f8d62a4caae52':
vf_hqdn3d: fix uninitialized variable use
lzo: fix overflow checking in copy_backptr()
flacdec: simplify bounds checking in flac_probe()
atrac3: avoid oversized shifting in decode_bytes()
shorten: use the unsigned type where needed
shorten: report meaningful errors
shorten: K&R formatting cosmetics
shorten: set invalid channels count to 0
Conflicts:
libavcodec/shorten.c
libavformat/flacdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.
Remove the check. Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.
CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit ca6c3f2c53)
Simplify `p->buf > p->buf + p->buf_size - 4' as `p->buf_size < 4'.
Avoid a possible out-of-bounds pointer, which is undefined behavior
in C.
CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 8425d693ee)
When `off' is 0, `0x537F6103 << 32' in the following expression invokes
undefined behavior, the result of which is not necessarily 0.
(0x537F6103 >> (off * 8)) | (0x537F6103 << (32 - (off * 8)))
Avoid oversized shifting.
CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit eba1ff3130)
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3dbc0ff9c3)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e398990eb8)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
More speedup and fixes 'may be used uninitialized in this function' warnings
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d2e0a276d5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
speeds up code and allows more simplifications
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dbaae33c2c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
See:
commit 29d8cd265a
Author: Alexander Kojevnikov <alexander@kojevnikov.com>
Date: Tue Feb 26 21:47:11 2013 -0800
mp3dec: Fix VBR bit rate parsing
When parsing the Xing/Info tag, don't set the bit rate if it's an Info tag.
When parsing the stream, don't override the bit rate if it's already set,
otherwise calculate the mean bit rate from parsed frames. This way, the bit
rate will be set correctly both for CBR and VBR streams.
Signed-off-by: Alexander Kojevnikov <alexander@kojevnikov.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
eamad: allocate a dummy reference frame when the real one is missing
libmp3lame: use the correct remaining buffer size when flushing
png: use av_mallocz_array() for the zlib zalloc function
wmaprodec: require block_align to be set.
ffv1: fix calculating slice dimensions for version 2
xxan: fix invalid memory access in xan_decode_frame_type0()
wmadec: require block_align to be set.
ivi_common: do not call MC for intra frames when dc_transform is unset
Conflicts:
libavcodec/ffv1dec.c
libavcodec/ivi_common.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '747fbe0c212b81952bb27ec7b99fa709081e2d63':
roqvideodec: fix a potential infinite loop in roqvideo_decode_frame().
mp3dec: Fix VBR bit rate parsing
wmaprodec: return an error, not 0, when the input is too small.
vmdaudio: fix invalid reads when packet size is not a multiple of chunk size
h264: check for luma and chroma bit dept being equal
Prepare for 9.4 Release
Conflicts:
RELEASE
libavcodec/vmdav.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
get_uint returns an unsigned value, use an unsigned to store
blocksize to make sure the comparison logic is correct and report
correctly the error for the channel count not supported.
CC: libav-stable@libav.org
(cherry picked from commit 5cf7c72757)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Prevent the loop shorten_decode_close from writing and freeing out of
the array boundary.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
CC: libav-stable@libav.org
(cherry picked from commit c10da30d84)
Avoids an infinite loop in the calling programs with decoder not
consuming any input and not returning output.
CC:libav-stable@libav.org
(cherry picked from commit cacad1c058)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
The loop a few lines below the xan_unpack() call accesses up to
dec_size * 2 bytes into y_buffer, so dec_size must be limited to
buffer_size / 2.
CC:libav-stable@libav.org
(cherry picked from commit 8a49d2bcbe)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
When there is just 1 byte remanining in the buffer, nothing will be read
and the loop will continue forever. Check that there are at least 8
bytes, which are always read at the beginning.
CC:libav-stable@libav.org
(cherry picked from commit 3e2f200237)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Avoids an infinite loop in the calling programs with decoder not
consuming any input and not returning output.
CC:libav-stable@libav.org
(cherry picked from commit ea1136baaf)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
When parsing the Xing/Info tag, don't set the bit rate if it's an Info tag.
When parsing the stream, don't override the bit rate if it's already set,
otherwise calculate the mean bit rate from parsed frames. This way, the bit
rate will be set correctly both for CBR and VBR streams.
CC:libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit eae0879d96)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Returning 0 may result in an infinite loop in valid calling programs. A
decoder should never return 0 without producing any output.
CC:libav-stable@libav.org
(cherry picked from commit 4c0080b7e7)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
The decoder assumes a single bit depth for all the planes
while the specification allows different bit depths for luma
and chroma.
Avoid the possible problems described in CVE-2013-2277
CC: libav-stable@libav.org
(cherry picked from commit 4987faee78)
Conflicts:
libavcodec/h264.c
This prevents various values from becoming stuck at NAN and
output to become silent
If someone knows a cleaner solution, thats welcome!
Fixes Ticket2335
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8978c743fb)
The IIR filter numerically diverges in such cases, this could easily be
fixed but would make the filter slower on some platforms
Fixes Ticket2246
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fee5da6b0a)
Fix linking failures with -all_load due to multiple log2_tabs
Signed-off-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
(cherry picked from commit 03148fd174)
* qatar/release/9:
update Changelog
h264: set ref_count to 0 for intra slices.
h264: on reference overflow, reset the reference count to 0, not 1.
flvdec: Check the return value of a malloc
Conflicts:
Changelog
libavcodec/h264.c
libavformat/flvdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Since decode_slice_header() returns before the reference lists are
constructed, there are zero valid references.
CC:libav-stable@libav.org
(cherry picked from commit 668e16a0dd)
Conflicts:
libavcodec/h264.c
The callers of this function can't report errors sanely. If this
one malloc fails, don't write the extradata byte, make sure we
try to malloc it the next time we're called instead, and make sure
we still consume the input data byte.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c5a738ca4e)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This header byte is only present when actually reading a VP6 frame,
not when reading the codec type field in the metadata. This
potential bug has been present since 5b54a90c.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c91c63b538)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
If the first "special" character in a filename is a comma,
it can introduce protocol options, but only if there is a
colon at the end. Otherwise, it is just a filename with a
comma.
Fix trac ticket #2303.
(cherry picked from commit d9fad53f4b)
Two instances of non-ascii characters have crept into file
doc/filters.texi which causes pod2man to error out and
break the build.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The specification does not prevent an encoder to write the amplitude 0
as 0 amplitude_bits.
Our get_bits() implementation might not support a zero sized read
properly, thus the additional branch.
(cherry picked from commit 23bd9ef4b2)
Conflicts:
libavcodec/vorbisdec.c
Rate and order must not be 0 even if the specification does not say that
explicitly.
(cherry picked from commit 5b47c19bfd)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Damaged frames can lead to a mismatch, which can cause a segfault
due to using an incorrect channel mapping.
CC:libav-stable@libav.org
(cherry picked from commit d7c450436f)
Conflicts:
libavcodec/ac3dec.c
* qatar/release/9:
doc: developer: Allow tabs in the vim configuration for Automake files
doc: filters: Correct BNF FILTER description
Prepare for 9.3 Release
update Changelog
cavs: initialize various context tables to 0
4xm: check the return value of read_huffman_tables().
qtrle: add more checks against pixel_ptr being negative.
mlpdec: do not try to allocate a zero-sized output buffer.
av_memcpy_backptr: avoid an infinite loop for back = 0
flicvideo: avoid an infinite loop in byte run compression
lagarith: avoid infinite loop in lag_rac_refill()
mov: use the format context for logging.
loco: check that there is data left after decoding a plane.
update Changelog
x86: h264: Don't use redzone in AVX h264_deblock on Win64
Conflicts:
Changelog
RELEASE
libavcodec/4xm.c
libavcodec/loco.c
libavcodec/qtrle.c
libavutil/mem.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Write the packet unaltered if found.
Fixes ticket #1917
Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b454c64e03)
While we do not use Automake in libav, this allows our config to be
used more globally without introducing unwanted breakage.
(cherry picked from commit 040c565e51)
Conflicts:
doc/developer.texi
Fixes out of array access
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bdeb61ccc6)
Conflicts:
libavcodec/h264_ps.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8a6449167a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This fixes crashes in chromium on win64 on machines with AVX
(crashes that apparently aren't triggered by fate).
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 311443f6c7)
Signed-off-by: Martin Storsjö <martin@martin.st>
* qatar/release/9:
doc: Fix some obsolete references to av* tools as ff* tools
vqavideo: check chunk sizes before reading chunks
roqvideodec: check dimensions validity
qdm2: check array index before use, fix out of array accesses
mpegvideo: Do REBASE_PICTURE with byte pointers
Conflicts:
libavcodec/qdm2.c
libavcodec/roqvideodec.c
libavcodec/vqavideo.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
REBASE_PICTURE (more specifically, this half of it) takes a Picture
pointer that points into one larger struct, finds the offset of
that Picture within the struct and finds the corresponding field
within another instance of a similar struct.
The pointer difference "pic - (Picture*)old_ctx" is a value given
in sizeof(Picture) units, and when applied back on
(Picture*)new_ctx gets multiplied back with sizeof(Picture). Many
compilers seem to optimize out this division/multiplication, but
not all do.
GCC 4.2 on OS X doesn't seem to remove the division/multiplication,
therefore the new pointer didn't turn out to point to exactly
the right place in the new struct since it only had sizeof(Picture)
granularity (and the Picture is not aligned on a sizeof(Picture)
boundary within the encompassing struct). This bug has been present
before 47318953d as well - with H264, pointers to h->ref_list[0][0]
pointed to 88 bytes before h->ref_list[0][0] after the rebase. After
shrinking Picture, the difference ended up even larger, making
writes via such a Picture pointer overwrite other fields at random
in H264Context, ending up in crashes later.
This fixes H264 multithreaded decoding on OS X with GCC 4.2.
Fixes Bug: #439
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a65f965c04)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 21cd905cd4)
Conflicts:
libswresample/swresample.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e1219cdaf9)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1ac0fa50ef)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes integer overflow and out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5260edee7e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 365270aec5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 796012af6c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes FATE in MSVC DLL builds.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5ad43af9a6)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
svq3: unbreak decoding
build: make audio_frame_queue a stand-alone component
build: The libopencore-amrnb encoder depends on audio_frame_queue
libopencore-amrwb: Make AMR-WB ifdeffery more precise
libopencore-amr: Conditionally compile decoder and encoder bits
libopencore-amrnb: cosmetics: Group all encoder-related code together
Conflicts:
configure
libavcodec/Makefile
Merged-by: Michael Niedermayer <michaelni@gmx.at>
These warnings have no false positives and point to serious bugs.
(cherry picked from commit 99853cb8d4)
Conflicts:
configure
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Other software does not store it in this case, and the information
is provided by the codec stream
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 405cc0d905)
Conflicts:
tests/ref/lavf/mov
Some applications do not like that.
Fixes VDA
Reduces noise for VDPAU
Tested-by: Guillaume POIRIER <poirierg@gmail.com>
Tested-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dece584a63)
Conflicts:
libavcodec/h264.c
The library might provide an encoder in the future, so it's better to
check for the presence of the decoder rather than just the library.
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit ed89cad6aa04bbd692b3eb21c0e0bb56aca77130)
The QuickTime specification does not contain any hint that the atom
must not be written in some cases and both the QuickTime and the
AVID decoders do not fail if the atom is present.
This change allows to signal (visually) interlaced streams with
a codec different from uncompressed video.
As a side-effect, this fixes ticket #2202
(cherry picked from commit 7d0e3b197c)
Conflicts:
tests/ref/lavf/mov
* qatar/release/9:
arm: Fall back to runtime cpu feature detection via /proc/cpuinfo
doc/platform: Fix 10l typo
xxan: properly handle odd heights.
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This prevents faulty increasing of has_b_frames
Should fix Ticket 2062
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c230af9bcc)
* commit 'b7765d00f911fe0f8fcda21b93a540f27d2ba2f5':
msrledec: check bounds before constructing a possibly invalid pointer,
qtrle: fix the topmost line for 1bit
aasc: fix output for msrle compression.
Conflicts:
tests/ref/fate/aasc
tests/ref/fate/qtrle-1bit
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '108ca6fad1e0e9af8d6337f908bfd23807b7fbd6':
yop: check for input overreads.
yop: check that extradata is large enough.
fraps: fix off-by one bug for version 1.
Conflicts:
libavcodec/fraps.c
libavcodec/yop.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This fixes a regression introduced with todays merge
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6747b0be9b)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '5af78cc98d807f3b43510410dad46e1840c5c99f':
mlp: store the channel layout for each substream.
mlpdec: TrueHD: use Libav channel order.
mlpdec: set the channel layout.
x86: ac3: Fix HAVE_MMXEXT condition to only refer to external assembly
Conflicts:
libavcodec/mlp_parser.c
libavcodec/mlpdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '1fd2deedcc6400e08b31566a547a5fac3b38cefb':
mlpdec: set the channel layout.
Conflicts:
libavcodec/mlpdec.c
(cherry picked from commit 1cf6f6f3da)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '99ccd2ba10eac2b282c272ad9e75f082123c765a':
mlp: store the channel layout for each substream.
Conflicts:
libavcodec/mlp_parser.c
libavcodec/mlpdec.c
(cherry picked from commit fa36270c4c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
On recent android versions, /proc/self/auxw is unreadable
(unless the process is running running under the shell uid or
in debuggable mode, which makes it hard to notice). See
http://b.android.com/43055 and
https://android-review.googlesource.com/51271 for more information
about the issue.
This makes sure e.g. neon optimizations are enabled at runtime in
android apps even when built in release mode, if configured to
use the runtime detection.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit ab8f1a6989)
Signed-off-by: Martin Storsjö <martin@martin.st>
Do not assume that frame dimensions are mod16 (or that height is mod32
for interlaced).
CC:libav-stable@libav.org
(cherry picked from commit 69c25c9284)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This should fix Ticket2116
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 127ff88639)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 695af8eed6)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Without any correctly decoded slices, there can be no frame.
Fixes out of array reads
Found-by: Rafaël Carré
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 60af6c3138)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The existing checks are insufficient to detect a pixel format
changes in case of some damaged streams.
Fixes inconsistency and later out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 11c99c78ba)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Prevent out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 96f452ac64)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array writes
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ab6c9332bf)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c10350358d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This prevents a buffer overflow in rle_decode()
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7357ca900e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes vlc decoding for hypothetical files that would contain such cases.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0dfc01c2bb)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Prevents out of array writes
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f67a0d1152)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/release/9:
arm: vp8: Fix the plain-armv6 version of vp8_luma_dc_wht
Prepare for 9.2 Release
lavr: call mix_function_init() in ff_audio_mix_set_matrix()
rtpenc_chain: Use the original AVFormatContext for getting payload type
rtp: Make sure the output format pointer is set
Conflicts:
RELEASE
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '62de693a17f9b107be7867d822d5accacd4be544':
rtp: Make sure priv_data is set before reading it
videodsp_armv5te: remove #if HAVE_ARMV5TE_EXTERNAL
get_bits: change the failure condition in init_get_bits
mpegvideo: fix loop condition in draw_line()
Conflicts:
libavcodec/get_bits.h
libavcodec/mpegvideo.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This makes the plain-armv6 version use the same registers as the
armv6t2 version above.
This fixes fate-vp8 on plain-armv6 devices.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 2026eb1408)
Signed-off-by: Martin Storsjö <martin@martin.st>
The fps is stored as a 8 bit value thus 255 is the maximum encodable.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 55d66b2790)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes part of Ticket2045
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9362f31b55)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes part of Ticket2045
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bee044d7c2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Avoids integer overflows and out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 49b729d3af)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
A negative `size' will bypass FFMIN(). In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.
Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e692374f7)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Sanity checks like `data + size >= data_end || data + size < data' are
broken, because `data + size < data' assumes pointer overflow, which is
undefined behavior in C. Many compilers such as gcc/clang optimize such
checks away.
Use `size < 0 || size >= data_end - data' instead.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 902cfe2f74)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The check `start + res < start' is broken since pointer overflow is
undefined behavior in C. Many compilers such as gcc/clang optimize
away this check.
Use `res > end - start' instead. Also change `res' to unsigned int
to avoid signed left-shift overflow.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2f014567cf)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This is needed if a custom matrix is set by the user after opening the
AVAudioResampleContext because the matrix channel count can change if
different mixing coefficients are used.
CC:libav-stable@libav.org
(cherry picked from commit f07ef2d9c9)
Conflicts:
libavresample/audio_mix.c
In ff_rtp_get_payload_type, the AVFormatContext is used for checking
whether the payload_type or rtpflags options are set. In rtpenc_chain,
the rtpctx struct is a newly initialized struct where no options have
been set yet, so no options can be fetched from there.
All muxers that internally chain rtp muxers have the "rtpflags" field
that allows passing such options on (which is how this worked before
8034130e06), so this works just as intended.
This makes it possible to produce H263 in RFC2190 format with chained
RTP muxers.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4a4a7e138c)
Signed-off-by: Martin Storsjö <martin@martin.st>
Not sure if this actually happens, but we do the same check when
checking payload_type further above in the function, so it might
be needed.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 932117171f)
Signed-off-by: Martin Storsjö <martin@martin.st>
This reverts 312645e :
"Do not set codec_tag property for matroska muxers."
Also adds dummy codec_tag lists with codecs
supported in mkv but not in wav / avi.
Fixes ticket #2169.
(cherry picked from commit df39c3ce38)
libavutil/arm/asm.S sets '.arch' depending on HAVE_ARMV5TE so that
assembling armv5te code will always succeed even if the default -march
flag does not support it. HAVE_ARMV5TE_EXTERNAL tests assembling code
with the default arch.
Fixes the missing symbol ff_prefetch_arm with --cpu= not including
armv5te.
CC: libav-stable@libav.org
Too much code relies in having init_get_bits fed with a valid
buffer and set its dimension to 0.
Check for NULL buffer instead.
(cherry picked from commit 4603ec85ed)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
The loop condition `x = ex' is incorrect. It should be `x <= ex'.
This bug was introduced in commit c65dfac4 "mpegvideo.c: K&R formatting
and cosmetics."
CC:libav-stable@libav.org
(cherry picked from commit 992b031838)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Fixes state becoming inconsistent
Fixes a null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 23318a5735)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Upstream decided to split the paranoia interface and move the headers
accordingly.
(cherry picked from commit 57224e425c567a87798b66425acc383c6dd37331)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This fixes a regression since d9cf5f51/7a2ee770f5 with theora
over RTP (possibly with other variants of theora as well).
In theora over RTP, the second of the 3 headers turns out to be
0 bytes long, which prior to d9cf5f51 worked just fine. After
d9cf5f51, reading from the bitstream reader fails (since the reader
wasn't initialized but returned an error if initialized with 0 bits).
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e33db35b4a)
Signed-off-by: Martin Storsjö <martin@martin.st>
* qatar/release/9:
libx264: use the library specific default rc_initial_buffer_occupancy
lavc: set the default rc_initial_buffer_occupancy
lavc: introduce the convenience function init_get_bits8
lavc: check for overflow in init_get_bits
APIchanges: Fill in missing hashes and dates; fix a version number typo.
configure: enable pic for shared libs on AArch64
zmbv: Reset the decoder on keyframe errors
vc1dec: prevent a crash due missing pred_flag parameter
matroska: Fix use after free
vp3: Fix double free in vp3_decode_end()
update Changelog
oggdec: make sure the private parse data is cleaned up
oggdec: free the ogg streams on read_header failure
update Changelog
x86: lavr: use the x86inc.asm automatic stack alignment in mixing functions
Prepare 9.1 Release
Conflicts:
Changelog
RELEASE
doc/APIchanges
libavcodec/utils.c
libavformat/oggdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
If the motion vector is at a subpixel position, we need 3 pixels below
the motion vector's wholepel position available, not 2, since the MC
filter is a sixtap filter for the hpel position, and then a bilin filter
for the qpel position.
This patch fixes highly irreproducible (0.1%) fate failures in frame 2
and 4 of h264-conformance-cama2_vtc_b (e.g. first P-frame, first field,
last line of MB x=40,y=2 and second field and last lines of MBs x=39-40,
y=3). These used pre-loopfilter instead of post-loopfilter data because
the await_progress() waited for one line too little in that field, and
the motion vector of these particular MBs happened to align exactly to a
position where that demonstrates the bug.
CC: libav-stable@libav.org
(cherry picked from commit fb845ffdd3)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
It's been returning an error value since
bad446e251
Also check for the errors it returns.
(cherry picked from commit ea382767ad)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Clobbering these tables will temporarily clobber the template used
as a basis for other threads to start decoding from. If the other
decoding thread updates from the template right at that moment,
subsequent threads will get invalid (or, usually, none at all) mmco
tables. This leads to invalid reference lists and subsequent decode
failures.
Therefore, instead, decode the mmco tables only for the first slice in
a field or frame. For other slices, decode the bits and ensure they
are identical to the mmco tables in the first slice, but don't ever
clobber the context state. This prevents other threads from using a
clobbered/invalid template as starting point for decoding, and thus
fixes decoding in these cases.
This fixes occasional (~1%) failures of h264-conformance-mr1_bt_a with
frame-multithreading enabled.
(cherry picked from commit bad446e251)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Attempting to re-parse the headers at demuxer level is a
pandora box the way its done currently.
This allows full reconfiguration of vorbis streams
Fixes Ticket2117
Fixes Ticket2121
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c994bb2fb7)
Previously we re synced from where we where which cam lead
to loosing pages.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c5cf58d4b9)
Accept the buffer size in bytes and check for overflow before passing
the value in bits to init_get_bits.
(cherry picked from commit e28ac6e5e2)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Fix an undefined behaviour and make the function return a proper
error in case of overflow.
CC: libav-stable@libav.org
(cherry picked from commit d9cf5f5169)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Regression since: ea6da80
Fixes Ticket2123
I cannot reproduce any regressions by flipping the wrong condition
to how it should have been.
Thanks-to: ubitux
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 57bdd67646)
Sometimes the muxer modifies the packet, like for instance lavf/mp3enc
changing pkt->destruct in order to keep a copy. These changes must be
kept, even though the muxer behaviour is questionable. Regression since
0072116.
Fixes#2124.
(cherry picked from commit 119d70db50)
Patches should be submitted to the [ffmpeg-devel mailing list](https://ffmpeg.org/mailman/listinfo/ffmpeg-devel) using `git format-patch` or `git send-email`. Github pull requests should be avoided because they are not part of our review process and **will be ignored**.
See [https://ffmpeg.org/developer.html#Contributing](https://ffmpeg.org/developer.html#Contributing) for more information.
Please try to keep entries where you are the maintainer up to date!
*Status*, one of the following:
[X] Old code. Something tagged obsolete generally means it has been replaced by a better system and you should be using that.
[0] No current maintainer [but maybe you could take the role as you write your new code].
[1] It has a maintainer but they don't have time to do much other than throw the odd patch in.
[2] Someone actually looks after it.
Names in () mean that the maintainer currently has no time to maintain the code.
A CC after the name means that the maintainer prefers to be CC-ed on patches
and related discussions.
A (CC <address>) after the name means that the maintainer prefers to be CC-ed on
patches and related discussions.
(L <address>) *Mailing list* that is relevant to this area
(W <address>) *Web-page* with status/info
(B <address>) URI for where to file *bugs*. A web-page with detailed bug
filing info, a direct bug tracker link, or a mailto: URI.
(P <address>) *Subsystem Profile* document for more details submitting
patches to the given subsystem. This is either an in-tree file,
or a URI. See Documentation/maintainer/maintainer-entry-profile.rst
for details.
(T <address>) *SCM* tree type and location.
Type is one of: git, hg, quilt, stgit, topgit
Project Leader
==============
Michael Niedermayer
final design decisions
Applications
============
ffmpeg:
ffmpeg.c Michael Niedermayer, Anton Khirnov
ffmpeg.c Michael Niedermayer
ffplay:
ffplay.c [2] Marton Balint
ffplay.c Marton Balint
ffprobe:
ffprobe.c [2] Stefano Sabatini
ffprobe.c Stefano Sabatini
ffserver:
ffserver.c, ffserver.h Baptiste Coudurier
Commandline utility code:
cmdutils.c, cmdutils.h Michael Niedermayer
@@ -45,32 +39,18 @@ Commandline utility code:
QuickTime faststart:
tools/qt-faststart.c Baptiste Coudurier
Execution Graph Printing
fftools/graph, fftools/resources [2] softworkz
Miscellaneous Areas
===================
documentation Stefano Sabatini, Mike Melanson, Timothy Gu, Gyan Doshi
project server day to day operations (L: root@ffmpeg.org) Michael Niedermayer, Reimar Doeffinger, Alexander Strasser, Nikolay Aleksandrov, Timo Rothenpieler
project server emergencies (L: root@ffmpeg.org) Reimar Doeffinger, Alexander Strasser, Nikolay Aleksandrov, Timo Rothenpieler
presets [0]
documentation Mike Melanson
website Robert Swain, Lou Logan
build system (configure,Makefiles) Diego Biurrun, Mans Rullgard
project serverÁrpád Gereöffy, Michael Niedermayer, Reimar Döffinger
mailinglists Michael Niedermayer, Baptiste Coudurier, Lou Logan
presets Robert Swain
metadata subsystem Aurelien Jacobs
release management Michael Niedermayer
API tests [0]
samples-request [2] Thilo Borgmann, James Almer, Ben Littler
Communication
=============
website (T: https://git.ffmpeg.org/ffmpeg-web) Deby Barbara Lepage
The FFmpeg project is organized through a community working on global consensus.
Decisions are taken by the ensemble of active members, through voting and are aided by two committees.
@anchor{General Assembly}
@chapter General Assembly
The ensemble of active members is called the General Assembly (GA).
The General Assembly is sovereign and legitimate for all its decisions regarding the FFmpeg project.
The General Assembly is made up of active contributors.
Contributors are considered "active contributors" if they have authored more than 20 patches in the last 36 months in the main FFmpeg repository, or if they have been voted in by the GA.
The list of active contributors is updated twice each year, on 1st January and 1st July, 0:00 UTC.
Additional members are added to the General Assembly through a vote after proposal by a member of the General Assembly. They are part of the GA for two years, after which they need a confirmation by the GA.
A script to generate the current members of the general assembly (minus members voted in) can be found in `tools/general_assembly.pl`.
@anchor{Voting}
@chapter Voting
Voting is done using a ranked voting system, currently running on https://vote.ffmpeg.org/ .
Majority vote means more than 50% of the expressed ballots.
@anchor{Technical Committee}
@chapter Technical Committee
The Technical Committee (TC) is here to arbitrate and make decisions when technical conflicts occur in the project. They will consider the merits of all the positions, judge them and make a decision.
The TC resolves technical conflicts but is not a technical steering committee.
Decisions by the TC are binding for all the contributors.
Decisions made by the TC can be re-opened after 1 year or by a majority vote of the General Assembly, requested by one of the member of the GA.
The TC is elected by the General Assembly for a duration of 1 year, and is composed of 5 members. Members can be re-elected if they wish. A majority vote in the General Assembly can trigger a new election of the TC.
The members of the TC can be elected from outside of the GA. Candidates for election can either be suggested or self-nominated.
The conflict resolution process is detailed in the resolution process document.
The TC can be contacted at <tc@@ffmpeg>.
@anchor{Resolution Process}
@section Resolution Process
The Technical Committee (TC) is here to arbitrate and make decisions when technical conflicts occur in the project.
The TC main role is to resolve technical conflicts. It is therefore not a technical steering committee, but it is understood that some decisions might impact the future of the project.
@subsection Seizing
The TC can take possession of any technical matter that it sees fit.
To involve the TC in a matter, email tc@ or CC them on an ongoing discussion.
As members of TC are developers, they also can email tc@ to raise an issue.
@subsection Announcement
The TC, once seized, must announce itself on the main mailing list, with a [TC] tag.
The TC has 2 modes of operation: a RFC one and an internal one.
If the TC thinks it needs the input from the larger community, the TC can call for a RFC. Else, it can decide by itself.
The decision to use a RFC process or an internal discussion is a discretionary decision of the TC.
The TC can also reject a seizure for a few reasons such as: the matter was not discussed enough previously; it lacks expertise to reach a beneficial decision on the matter; or the matter is too trivial.
@subsection RFC call
In the RFC mode, one person from the TC posts on the mailing list the technical question and will request input from the community.
The mail will have the following specification:
a precise title
a specific tag [TC RFC]
a top-level email
contain a precise question that does not exceed 100 words and that is answerable by developers
may have an extra description, or a link to a previous discussion, if deemed necessary,
contain a precise end date for the answers.
The answers from the community must be on the main mailing list and must have the following specification:
keep the tag and the title unchanged
limited to 400 words
a first-level, answering directly to the main email
answering to the question.
Further replies to answers are permitted, as long as they conform to the community standards of politeness, they are limited to 100 words, and are not nested more than once. (max-depth=2)
After the end-date, mails on the thread will be ignored.
Violations of those rules will be escalated through the Community Committee.
After all the emails are in, the TC has 96 hours to give its final decision. Exceptionally, the TC can request an extra delay, that will be notified on the mailing list.
@subsection Within TC
In the internal case, the TC has 96 hours to give its final decision. Exceptionally, the TC can request an extra delay.
@subsection Decisions
The decisions from the TC will be sent on the mailing list, with the [TC] tag.
Internally, the TC should take decisions with a majority, or using ranked-choice voting.
Each TC member must vote on such decision according to what is, in their view, best for the project.
If a TC member feels they are affected by a conflict of interest with regards to the case, they should announce it and recuse themselves from the TC
discussion and vote.
A conflict of interest is presumed to occur when a TC member has a personal interest (e.g. financial) in a specific outcome of the case.
The decision from the TC should be published with a summary of the reasons that lead to this decision.
The decisions from the TC are final, until the matters are reopened after no less than one year.
@anchor{Community Committee}
@chapter Community Committee
The Community Committee (CC) is here to arbitrage and make decisions when inter-personal conflicts occur in the project. It will decide quickly and take actions, for the sake of the project.
The CC can remove privileges of offending members, including removal of commit access and temporary ban from the community.
Decisions made by the CC can be re-opened after 1 year or by a majority vote of the General Assembly. Indefinite bans from the community must be confirmed by the General Assembly, in a majority vote.
The CC is elected by the General Assembly for a duration of 1 year, and is composed of 5 members. Members can be re-elected if they wish. A majority vote in the General Assembly can trigger a new election of the CC.
The members of the CC can be elected from outside of the GA. Candidates for election can either be suggested or self-nominated.
The CC is governed by and responsible for enforcing the Code of Conduct.
The CC can be contacted at <cc@@ffmpeg>.
@anchor{Code of Conduct}
@chapter Code of Conduct
Be friendly and respectful towards others and third parties.
Treat others the way you yourself want to be treated.
Be considerate. Not everyone shares the same viewpoint and priorities as you do.
Different opinions and interpretations help the project.
Looking at issues from a different perspective assists development.
Do not assume malice for things that can be attributed to incompetence. Even if
it is malice, it's rarely good to start with that as initial assumption.
Stay friendly even if someone acts contrarily. Everyone has a bad day
once in a while.
If you yourself have a bad day or are angry then try to take a break and reply
once you are calm and without anger if you have to.
Try to help other team members and cooperate if you can.
The goal of software development is to create technical excellence, not for any
individual to be better and "win" against the others. Large software projects
are only possible and successful through teamwork.
If someone struggles do not put them down. Give them a helping hand
instead and point them in the right direction.
Finally, keep in mind the immortal words of Bill and Ted,
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
