Compare commits

...

7 Commits

Author SHA1 Message Date
Michael Niedermayer
d1bc77d86c 0.8.2
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-08-10 13:48:30 +02:00
Michael Niedermayer
91d5da9321 cavs: fix oCERT #2011-002 FFmpeg/libavcodec insufficient boundary check
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-08-10 13:46:22 +02:00
Carl Eugen Hoyos
08ddfb77a1 Fix possible crash when decoding mpeg streams.
This reverts 2cf8355f98,
fixes ticket 329.
2011-08-04 11:49:52 +02:00
Reimar Döffinger
a0352d01e9 Bink: clip AC coefficients during dequantization.
Fixes artefacts with Neverwinter Nights WOTCLogo.bik
(http://drmccoy.de/zeugs/WOTCLogo.bik).
Fixes trac ticket #352.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit 47b71eea09)
2011-08-04 11:45:28 +02:00
Michael Niedermayer
2ff36ef521 ffmpeg: fix passlogfile regression
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-07-28 18:32:26 +02:00
Michael Niedermayer
7e33a66c0e Fix several security issues in matroskadec.c (MSVR-11-0080).
Whitespace of the patch cleaned up by Aurel
Some of the issues have been reported by Steve Manzuik / Microsoft Vulnerability Research (MSVR)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 956c901c68)
2011-07-28 15:29:43 +02:00
Baptiste Coudurier
893cf1b1ae ffmpeg: fix prototypes of functions after the removal of OPT_FUNC2.
(cherry picked from commit 90a40b226a)
2011-07-27 22:52:36 +02:00
7 changed files with 56 additions and 19 deletions

View File

@@ -31,7 +31,7 @@ PROJECT_NAME = FFmpeg
# This could be handy for archiving the generated documentation or # This could be handy for archiving the generated documentation or
# if some version control system is used. # if some version control system is used.
PROJECT_NUMBER = 0.8.1 PROJECT_NUMBER = 0.8.2
# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
# base path where the generated documentation will be put. # base path where the generated documentation will be put.

View File

@@ -1 +1 @@
0.8.1 0.8.2

View File

@@ -1 +1 @@
0.8.1 0.8.2

View File

@@ -343,6 +343,7 @@ typedef struct AVInputFile {
int eof_reached; /* true if eof reached */ int eof_reached; /* true if eof reached */
int ist_index; /* index of first stream in ist_table */ int ist_index; /* index of first stream in ist_table */
int buffer_size; /* current total buffer size */ int buffer_size; /* current total buffer size */
int nb_streams;
} AVInputFile; } AVInputFile;
#if HAVE_TERMIOS_H #if HAVE_TERMIOS_H
@@ -2045,7 +2046,7 @@ static int transcode(AVFormatContext **output_files,
int si = stream_maps[i].stream_index; int si = stream_maps[i].stream_index;
if (fi < 0 || fi > nb_input_files - 1 || if (fi < 0 || fi > nb_input_files - 1 ||
si < 0 || si > input_files[fi].ctx->nb_streams - 1) { si < 0 || si > input_files[fi].nb_streams - 1) {
fprintf(stderr,"Could not find input stream #%d.%d\n", fi, si); fprintf(stderr,"Could not find input stream #%d.%d\n", fi, si);
ret = AVERROR(EINVAL); ret = AVERROR(EINVAL);
goto fail; goto fail;
@@ -2731,7 +2732,7 @@ static int transcode(AVFormatContext **output_files,
} }
/* the following test is needed in case new streams appear /* the following test is needed in case new streams appear
dynamically in stream : we ignore them */ dynamically in stream : we ignore them */
if (pkt.stream_index >= input_files[file_index].ctx->nb_streams) if (pkt.stream_index >= input_files[file_index].nb_streams)
goto discard_packet; goto discard_packet;
ist_index = input_files[file_index].ist_index + pkt.stream_index; ist_index = input_files[file_index].ist_index + pkt.stream_index;
ist = &input_streams[ist_index]; ist = &input_streams[ist_index];
@@ -3468,6 +3469,7 @@ static int opt_input_file(const char *opt, const char *filename)
input_files = grow_array(input_files, sizeof(*input_files), &nb_input_files, nb_input_files + 1); input_files = grow_array(input_files, sizeof(*input_files), &nb_input_files, nb_input_files + 1);
input_files[nb_input_files - 1].ctx = ic; input_files[nb_input_files - 1].ctx = ic;
input_files[nb_input_files - 1].ist_index = nb_input_streams - ic->nb_streams; input_files[nb_input_files - 1].ist_index = nb_input_streams - ic->nb_streams;
input_files[nb_input_files - 1].nb_streams = ic->nb_streams;
top_field_first = -1; top_field_first = -1;
video_channel = 0; video_channel = 0;
@@ -4074,13 +4076,13 @@ static void parse_matrix_coeffs(uint16_t *dest, const char *str)
} }
} }
static void opt_inter_matrix(const char *arg) static void opt_inter_matrix(const char *opt, const char *arg)
{ {
inter_matrix = av_mallocz(sizeof(uint16_t) * 64); inter_matrix = av_mallocz(sizeof(uint16_t) * 64);
parse_matrix_coeffs(inter_matrix, arg); parse_matrix_coeffs(inter_matrix, arg);
} }
static void opt_intra_matrix(const char *arg) static void opt_intra_matrix(const char *opt, const char *arg)
{ {
intra_matrix = av_mallocz(sizeof(uint16_t) * 64); intra_matrix = av_mallocz(sizeof(uint16_t) * 64);
parse_matrix_coeffs(intra_matrix, arg); parse_matrix_coeffs(intra_matrix, arg);
@@ -4378,10 +4380,12 @@ static void log_callback_null(void* ptr, int level, const char* fmt, va_list vl)
{ {
} }
static void opt_passlogfile(const char *arg) static void opt_passlogfile(const char *opt, const char *arg)
{ {
pass_logfilename_prefix = arg; pass_logfilename_prefix = arg;
#if CONFIG_LIBX264_ENCODER
opt_default("passlogfile", arg); opt_default("passlogfile", arg);
#endif
} }
static const OptionDef options[] = { static const OptionDef options[] = {

View File

@@ -571,6 +571,22 @@ static inline int binkb_get_value(BinkContext *c, int bundle_num)
return ret; return ret;
} }
static inline DCTELEM dequant(DCTELEM in, uint32_t quant, int dc)
{
/* Note: multiplication is unsigned but we want signed shift
* otherwise clipping breaks.
* TODO: The official decoder does not use clipping at all
* but instead uses the full 32-bit result.
* However clipping at least gets rid of the case that a
* half-black half-white intra block gets black and white swapped
* and should cause at most minor differences (except for DC). */
int32_t res = in * quant;
res >>= 11;
if (!dc)
res = av_clip_int16(res);
return res;
}
/** /**
* Read 8x8 block of DCT coefficients. * Read 8x8 block of DCT coefficients.
* *
@@ -669,10 +685,10 @@ static int read_dct_coeffs(GetBitContext *gb, DCTELEM block[64], const uint8_t *
quant = quant_matrices[quant_idx]; quant = quant_matrices[quant_idx];
block[0] = (block[0] * quant[0]) >> 11; block[0] = dequant(block[0], quant[0], 1);
for (i = 0; i < coef_count; i++) { for (i = 0; i < coef_count; i++) {
int idx = coef_idx[i]; int idx = coef_idx[i];
block[scan[idx]] = (block[scan[idx]] * quant[idx]) >> 11; block[scan[idx]] = dequant(block[scan[idx]], quant[idx], 0);
} }
return 0; return 0;

View File

@@ -115,7 +115,8 @@ static inline int get_ue_code(GetBitContext *gb, int order) {
static int decode_residual_block(AVSContext *h, GetBitContext *gb, static int decode_residual_block(AVSContext *h, GetBitContext *gb,
const struct dec_2dvlc *r, int esc_golomb_order, const struct dec_2dvlc *r, int esc_golomb_order,
int qp, uint8_t *dst, int stride) { int qp, uint8_t *dst, int stride) {
int i, level_code, esc_code, level, run, mask; int i, esc_code, level, mask;
unsigned int level_code, run;
DCTELEM level_buf[65]; DCTELEM level_buf[65];
uint8_t run_buf[65]; uint8_t run_buf[65];
DCTELEM *block = h->block; DCTELEM *block = h->block;

View File

@@ -826,11 +826,15 @@ static int ebml_parse_elem(MatroskaDemuxContext *matroska,
uint32_t id = syntax->id; uint32_t id = syntax->id;
uint64_t length; uint64_t length;
int res; int res;
void *newelem;
data = (char *)data + syntax->data_offset; data = (char *)data + syntax->data_offset;
if (syntax->list_elem_size) { if (syntax->list_elem_size) {
EbmlList *list = data; EbmlList *list = data;
list->elem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size); newelem = av_realloc(list->elem, (list->nb_elem+1)*syntax->list_elem_size);
if (!newelem)
return AVERROR(ENOMEM);
list->elem = newelem;
data = (char*)list->elem + list->nb_elem*syntax->list_elem_size; data = (char*)list->elem + list->nb_elem*syntax->list_elem_size;
memset(data, 0, syntax->list_elem_size); memset(data, 0, syntax->list_elem_size);
list->nb_elem++; list->nb_elem++;
@@ -992,7 +996,10 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
pkt_data = av_realloc(pkt_data, pkt_size); pkt_data = av_realloc(pkt_data, pkt_size);
zstream.avail_out = pkt_size - zstream.total_out; zstream.avail_out = pkt_size - zstream.total_out;
zstream.next_out = pkt_data + zstream.total_out; zstream.next_out = pkt_data + zstream.total_out;
if (pkt_data) {
result = inflate(&zstream, Z_NO_FLUSH); result = inflate(&zstream, Z_NO_FLUSH);
} else
result = Z_MEM_ERROR;
} while (result==Z_OK && pkt_size<10000000); } while (result==Z_OK && pkt_size<10000000);
pkt_size = zstream.total_out; pkt_size = zstream.total_out;
inflateEnd(&zstream); inflateEnd(&zstream);
@@ -1013,7 +1020,10 @@ static int matroska_decode_buffer(uint8_t** buf, int* buf_size,
pkt_data = av_realloc(pkt_data, pkt_size); pkt_data = av_realloc(pkt_data, pkt_size);
bzstream.avail_out = pkt_size - bzstream.total_out_lo32; bzstream.avail_out = pkt_size - bzstream.total_out_lo32;
bzstream.next_out = pkt_data + bzstream.total_out_lo32; bzstream.next_out = pkt_data + bzstream.total_out_lo32;
if (pkt_data) {
result = BZ2_bzDecompress(&bzstream); result = BZ2_bzDecompress(&bzstream);
} else
result = BZ_MEM_ERROR;
} while (result==BZ_OK && pkt_size<10000000); } while (result==BZ_OK && pkt_size<10000000);
pkt_size = bzstream.total_out_lo32; pkt_size = bzstream.total_out_lo32;
BZ2_bzDecompressEnd(&bzstream); BZ2_bzDecompressEnd(&bzstream);
@@ -1066,13 +1076,17 @@ static void matroska_fix_ass_packet(MatroskaDemuxContext *matroska,
} }
} }
static void matroska_merge_packets(AVPacket *out, AVPacket *in) static int matroska_merge_packets(AVPacket *out, AVPacket *in)
{ {
out->data = av_realloc(out->data, out->size+in->size); void *newdata = av_realloc(out->data, out->size+in->size);
if (!newdata)
return AVERROR(ENOMEM);
out->data = newdata;
memcpy(out->data+out->size, in->data, in->size); memcpy(out->data+out->size, in->data, in->size);
out->size += in->size; out->size += in->size;
av_destruct_packet(in); av_destruct_packet(in);
av_free(in); av_free(in);
return 0;
} }
static void matroska_convert_tag(AVFormatContext *s, EbmlList *list, static void matroska_convert_tag(AVFormatContext *s, EbmlList *list,
@@ -1626,11 +1640,13 @@ static int matroska_deliver_packet(MatroskaDemuxContext *matroska,
memcpy(pkt, matroska->packets[0], sizeof(AVPacket)); memcpy(pkt, matroska->packets[0], sizeof(AVPacket));
av_free(matroska->packets[0]); av_free(matroska->packets[0]);
if (matroska->num_packets > 1) { if (matroska->num_packets > 1) {
void *newpackets;
memmove(&matroska->packets[0], &matroska->packets[1], memmove(&matroska->packets[0], &matroska->packets[1],
(matroska->num_packets - 1) * sizeof(AVPacket *)); (matroska->num_packets - 1) * sizeof(AVPacket *));
matroska->packets = newpackets = av_realloc(matroska->packets,
av_realloc(matroska->packets, (matroska->num_packets - 1) * (matroska->num_packets - 1) * sizeof(AVPacket *));
sizeof(AVPacket *)); if (newpackets)
matroska->packets = newpackets;
} else { } else {
av_freep(&matroska->packets); av_freep(&matroska->packets);
} }