Compare commits

...

7 Commits

Author SHA1 Message Date
Michael Niedermayer
d1bc77d86c 0.8.2
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-08-10 13:48:30 +02:00
Michael Niedermayer
91d5da9321 cavs: fix oCERT #2011-002 FFmpeg/libavcodec insufficient boundary check
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-08-10 13:46:22 +02:00
Carl Eugen Hoyos
08ddfb77a1 Fix possible crash when decoding mpeg streams.
This reverts 2cf8355f98,
fixes ticket 329.
2011-08-04 11:49:52 +02:00
Reimar Döffinger
a0352d01e9 Bink: clip AC coefficients during dequantization.
Fixes artefacts with Neverwinter Nights WOTCLogo.bik
(http://drmccoy.de/zeugs/WOTCLogo.bik).
Fixes trac ticket #352.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit 47b71eea09)
2011-08-04 11:45:28 +02:00
Michael Niedermayer
2ff36ef521 ffmpeg: fix passlogfile regression
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-07-28 18:32:26 +02:00
Michael Niedermayer
7e33a66c0e Fix several security issues in matroskadec.c (MSVR-11-0080).
Whitespace of the patch cleaned up by Aurel
Some of the issues have been reported by Steve Manzuik / Microsoft Vulnerability Research (MSVR)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 956c901c68)
2011-07-28 15:29:43 +02:00
Baptiste Coudurier
893cf1b1ae ffmpeg: fix prototypes of functions after the removal of OPT_FUNC2.
(cherry picked from commit 90a40b226a)
2011-07-27 22:52:36 +02:00
7 changed files with 56 additions and 19 deletions

View File

@@ -31,7 +31,7 @@ PROJECT_NAME = FFmpeg
# This could be handy for archiving the generated documentation or
# if some version control system is used.
PROJECT_NUMBER = 0.8.1
PROJECT_NUMBER = 0.8.2
# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
# base path where the generated documentation will be put.

View File

@@ -1 +1 @@
0.8.1
0.8.2

View File

@@ -1 +1 @@
0.8.1
0.8.2

View File

@@ -343,6 +343,7 @@ typedef struct AVInputFile {
int eof_reached; /* true if eof reached */
int ist_index; /* index of first stream in ist_table */
int buffer_size; /* current total buffer size */
int nb_streams;
} AVInputFile;
#if HAVE_TERMIOS_H
@@ -2045,7 +2046,7 @@ static int transcode(AVFormatContext **output_files,
int si = stream_maps[i].stream_index;
if (fi < 0 || fi > nb_input_files - 1 ||
si < 0 || si > input_files[fi].ctx->nb_streams - 1) {
si < 0 || si > input_files[fi].nb_streams - 1) {
fprintf(stderr,"Could not find input stream #%d.%d\n", fi, si);
ret = AVERROR(EINVAL);
goto fail;
@@ -2731,7 +2732,7 @@ static int transcode(AVFormatContext **output_files,
}
/* the following test is needed in case new streams appear
dynamically in stream : we ignore them */
if (pkt.stream_index >= input_files[file_index].ctx->nb_streams)
if (pkt.stream_index >= input_files[file_index].nb_streams)
goto discard_packet;
ist_index = input_files[file_index].ist_index + pkt.stream_index;
ist = &input_streams[ist_index];
@@ -3468,6 +3469,7 @@ static int opt_input_file(const char *opt, const char *filename)
input_files = grow_array(input_files, sizeof(*input_files), &nb_input_files, nb_input_files + 1);
input_files[nb_input_files - 1].ctx = ic;
input_files[nb_input_files - 1].ist_index = nb_input_streams - ic->nb_streams;
input_files[nb_input_files - 1].nb_streams = ic->nb_streams;
top_field_first = -1;
video_channel = 0;
@@ -4074,13 +4076,13 @@ static void parse_matrix_coeffs(uint16_t *dest, const char *str)
}
}
static void opt_inter_matrix(const char *arg)
static void opt_inter_matrix(const char *opt, const char *arg)
{
inter_matrix = av_mallocz(sizeof(uint16_t) * 64);
parse_matrix_coeffs(inter_matrix, arg);
}
static void opt_intra_matrix(const char *arg)
static void opt_intra_matrix(const char *opt, const char *arg)
{
intra_matrix = av_mallocz(sizeof(uint16_t) * 64);
parse_matrix_coeffs(intra_matrix, arg);
@@ -4378,10 +4380,12 @@ static void log_callback_null(void* ptr, int level, const char* fmt, va_list vl)
{
}
static void opt_passlogfile(const char *arg)
static void opt_passlogfile(const char *opt, const char *arg)
{
pass_logfilename_prefix = arg;
#if CONFIG_LIBX264_ENCODER
opt_default("passlogfile", arg);
#endif
}
static const OptionDef options[] = {

View File

@@ -571,6 +571,22 @@ static inline int binkb_get_value(BinkContext *c, int bundle_num)
return ret;
}
static inline DCTELEM dequant(DCTELEM in, uint32_t quant, int dc)
{
/* Note: multiplication is unsigned but we want signed shift
* otherwise clipping breaks.
* TODO: The official decoder does not use clipping at all
* but instead uses the full 32-bit result.
* However clipping at least gets rid of the case that a
* half-black half-white intra block gets black and white swapped
* and should cause at most minor differences (except for DC). */
int32_t res = in * quant;
res >>= 11;
if (!dc)
res = av_clip_int16(res);
return res;
}
/**
* Read 8x8 block of DCT coefficients.
*
@@ -669,10 +685,10 @@ static int read_dct_coeffs(GetBitContext *gb, DCTELEM block[64], const uint8_t *
quant = quant_matrices[quant_idx];
block[0] = (block[0] * quant[0]) >> 11;
block[0] = dequant(block[0], quant[0], 1);
for (i = 0; i < coef_count; i++) {
int idx = coef_idx[i];
block[scan[idx]] = (block[scan[idx]] * quant[idx]) >> 11;
block[scan[idx]] = dequant(block[scan[idx]], quant[idx], 0);
}
return 0;

View File

@@ -115,7 +115,8 @@ static inline int get_ue_code(GetBitContext *gb, int order) {
static int decode_residual_block(AVSContext *h, GetBitContext *gb,
const struct dec_2dvlc *r, int esc_golomb_order,
int qp, uint8_t *dst, int stride) {
int i, level_code, esc_code, level, run, mask;
int i, esc_code, level, mask;
unsigned int level_code, run;
DCTELEM level_buf[65];
uint8_t run_buf[65];
DCTELEM *block = h->block;

View File

@@ -826,11 +826,15 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska,
uint32_t id = syntax->id;
uint64_t length;
int res;
void *newelem;
data = (char *)data + syntax->data_offset;
if (syntax->list_elem_size) {
EbmlList *list = data;
list->elem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
newelem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
if (!newelem)
return AVERROR(ENOMEM);
list->elem = newelem;
data = (char*)list->elem + list->nb_elem*syntax->list_elem_size;
memset(data, 0, syntax->list_elem_size);
list->nb_elem++;
@@ -992,7 +996,10 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
pkt_data = av_realloc(pkt_data, pkt_size);
zstream.avail_out = pkt_size - zstream.total_out;
zstream.next_out = pkt_data + zstream.total_out;
result = inflate(&zstream, Z_NO_FLUSH);
if (pkt_data) {
result = inflate(&zstream, Z_NO_FLUSH);
} else
result = Z_MEM_ERROR;
} while (result==Z_OK && pkt_size<10000000);
pkt_size = zstream.total_out;
inflateEnd(&zstream);
@@ -1013,7 +1020,10 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
pkt_data = av_realloc(pkt_data, pkt_size);
bzstream.avail_out = pkt_size - bzstream.total_out_lo32;
bzstream.next_out = pkt_data + bzstream.total_out_lo32;
result = BZ2_bzDecompress(&bzstream);
if (pkt_data) {
result = BZ2_bzDecompress(&bzstream);
} else
result = BZ_MEM_ERROR;
} while (result==BZ_OK && pkt_size<10000000);
pkt_size = bzstream.total_out_lo32;
BZ2_bzDecompressEnd(&bzstream);
@@ -1066,13 +1076,17 @@ static void matroska_fix_ass_packet(MatroskaDemuxContext *matroska,
}
}
static void matroska_merge_packets(AVPacket *out, AVPacket *in)
static int matroska_merge_packets(AVPacket *out, AVPacket *in)
{
out->data = av_realloc(out->data, out->size+in->size);
void *newdata = av_realloc(out->data, out->size+in->size);
if (!newdata)
return AVERROR(ENOMEM);
out->data = newdata;
memcpy(out->data+out->size, in->data, in->size);
out->size += in->size;
av_destruct_packet(in);
av_free(in);
return 0;
}
static void matroska_convert_tag(AVFormatContext *s, EbmlList *list,
@@ -1626,11 +1640,13 @@ static int matroska_deliver_packet(MatroskaDemuxContext *matroska,
memcpy(pkt, matroska->packets[0], sizeof(AVPacket));
av_free(matroska->packets[0]);
if (matroska->num_packets > 1) {
void *newpackets;
memmove(&matroska->packets[0], &matroska->packets[1],
(matroska->num_packets - 1) * sizeof(AVPacket *));
matroska->packets =
av_realloc(matroska->packets, (matroska->num_packets - 1) *
sizeof(AVPacket *));
newpackets = av_realloc(matroska->packets,
(matroska->num_packets - 1) * sizeof(AVPacket *));
if (newpackets)
matroska->packets = newpackets;
} else {
av_freep(&matroska->packets);
}