6b01bcebb9
vorbis: An additional defense in the Vorbis codec.
Fixes Bug: #190
Chromium Bug: #100543
Related to CVE-2011-3893
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit afb2aa5379b0283ccb9ea5e0afe3c9
14 years ago
efd453d82d
vorbisdec: Fix decoding bug with channel handling
Fixes Bug: #191
Chromium Bug: #101458
CVE-2011-3895
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit e6d527ff7297f23c72a342f0a66968
14 years ago
329e816ed7
Check rangebits to avoid a possible crash.
Fixes issue 2548 (and Chrome issue 68115 and unknown CERT issues).
Originally committed as revision 26365 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit 13184036a6
15 years ago
d6860fb653
Fix crashes in vorbis decoding found by zzuf
Fixes issue 2322.
Originally committed as revision 25591 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit 3dde66752d
15 years ago
96ca078b22
Check validity of channels & samplerate.
This may be security relevant.
Based on 2 patches by chrome.
backport r19975 by michael
Originally committed as revision 22658 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
9e3935dfd8
Check submap indexes.
10_vorbis_submap_indexes.patch by chrome.
I am applying this even though Reimar had some comments to improve it as it fixes
a serious security issue and I do not want to leave such things unfixed.
backport r20001 by michael
Originally committed as revision 21730 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
4f5ee3f87b
Check begin/end/partition_size.
23_vorbis_sane_partition.patch by chrome.
Also this should be better documented but i prefer not to leave potential
security issues open due to missing documentation.
r19996 by michael
Originally committed as revision 21729 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
736d36b792
Check res_setup->books.
15_more_residue_book_indexes.patch by chrome.
r19992 by michael
Originally committed as revision 21728 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
dc5cc27d5a
Check masterbook index and subclass book index.
14_floor_masterbook_index.patch by chrome
r19991 by michael
Originally committed as revision 21727 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
eb70d77e1e
Add checks for per-packet mode indexes and per-header mode mapping indexes.
12_vorbis_mode_indexes.patch by chrome
maybe exploitable
r19990 by michael
Originally committed as revision 21726 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
b8ec4c49bd
Check classbook value.
11_vorbis_residue_book_index.patch by chrome.
r19989 by michael
Originally committed as revision 21725 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
49487dfd78
Fix book_idx check.
25_vorbis_floor0_index.patch by chrome.
backport r19984 by michael
Originally committed as revision 21724 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
0d3f25eb48
Sanity checks for magnitude and angle.
26_vorbis_mag_angle_index.patch by chrome
backport r19983 by michael
Originally committed as revision 21723 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
9ef13f70f4
= -> == typo.
27_vorbis_residue_loop_error.patch by chrome
backport r19982 by michael
Originally committed as revision 21722 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
beb0dc5f36
Check dimensions against 0 too.
39_vorbis_zero_dims.patch from chrome
backport r19976 by michael
Originally committed as revision 21721 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
16 years ago
bad5537e2c
Use full internal pathname in doxygen @file directives.
Otherwise doxygen complains about ambiguous filenames when files exist
under the same name in different subdirectories.
Originally committed as revision 16912 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
05dee1b7df
Rename all vorbis encoder related typedefs to not use _t for POSIX compatibility
Originally committed as revision 16076 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
c8562a6fda
Fix memleak for currupt input.
Originally committed as revision 15507 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
9d2b5cf2e0
Interleaved forward/backward channels processing in order to increase chances
of stepping on already cached data for the cores with extremely small data
cache.
Patch by Siarhei Siamashka: name dot surname at gmail
Originally committed as revision 15493 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
c541e668f6
Optimize vorbis_residue_decode() so that vr->type is a constant.
Based on a patch by Siarhei Siamashka.
Originally committed as revision 15134 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
d46ac5bfde
mdct wrapper function to match fft
Originally committed as revision 14703 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
46803f4f67
optimize imdct_half:
remove tmp buffer.
skip fft reinterleave pass, leaving data in a format more convenient for simd.
merge post-rotate with post-reorder.
Originally committed as revision 14700 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
fd76c37fd9
Modify all codecs to report their supported input and output sample format(s).
Originally committed as revision 14482 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
8a37920c9e
r14205 broke vorbis float_to_int on ppc
Originally committed as revision 14466 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
5eb0f2a425
float_to_int16_interleave: change src to an array of pointers instead of assuming it's contiguous.
this has no immediate effect, but will allow it to be used in more codecs.
Originally committed as revision 14252 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
633d9def9d
vorbis: reduce memory by reusing buffers
Originally committed as revision 14251 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
1a32536737
unroll another common case in vorbis_residue_decode
Originally committed as revision 14250 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
b9fa32082c
exploit mdct symmetry
2% faster vorbis on conroe, k8. 7% on celeron.
Originally committed as revision 14207 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
f27e1d645e
simplify vorbis windowing
Originally committed as revision 14205 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
da95f225fd
Set frame_size to the gcd of what the decoder can output.
Originally committed as revision 13971 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
fe4bf37455
Make AVCodec long_names definition conditional depending on CONFIG_SMALL.
Originally committed as revision 13759 to svn://svn.ffmpeg.org/ffmpeg/trunk
17 years ago
a5c0969a33
Remove one more set of useless parentheses from a return call.
Originally committed as revision 13070 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
d5202e4fda
Add long names to many AVCodec declarations.
patch by Stefano Sabatini, stefano.sabatini-lala poste it
Originally committed as revision 13005 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
98a6fff98c
Apply 'cold' attribute to init/uninit functions in libavcodec
Originally committed as revision 12525 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
8c4bd28bec
const
Originally committed as revision 11786 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
1234585fac
Initialize "saved" buffer to zero.
Patch by Vincent Penné vpenne wyplay com and Denes Balatoni
Originally committed as revision 11393 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
90901860c2
stupid code (casting of void*) found by checktree.sh
Originally committed as revision 11117 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
e14356c895
fix issue130
Originally committed as revision 10888 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
7ae7300ee3
use skip_bits where appropriate
Originally committed as revision 10004 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
5fc32c275e
use get_bits1(..) instead get_bits(.., 1)
Originally committed as revision 9999 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
975741e79c
Don't segfault if an empty codebook gets used.
Patch by Denes Balatoni: [ dbalatoni interware hu ]
Original thread: [Ffmpeg-devel] [PATCH/BUGREPORT] crash in vorbis decoder
date: 02/04/2007 11:08 PM
Originally committed as revision 9711 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
e5a389a1b7
license header consistency cosmetics
Originally committed as revision 9484 to svn://svn.ffmpeg.org/ffmpeg/trunk
18 years ago
07c55d8ea3
rename vorbis.c to vorbis_dec.c and vorbis_common.c to vorbis.c
Originally committed as revision 8981 to svn://svn.ffmpeg.org/ffmpeg/trunk
19 years ago
f6bd6eeffd
loosen vorbis_enc.c dependencies by spliting vorbis.c
Originally committed as revision 8980 to svn://svn.ffmpeg.org/ffmpeg/trunk
19 years ago
5bb127a98f
extract vorbis header spliting code into a reusable function
Original thread:
Date: Thu, 22 Mar 2007 20:23:08 -0400
Subject: [Ffmpeg-devel] [PATCH] Theora in MKV (GSoC '07 Qualification)
Originally committed as revision 8505 to svn://svn.ffmpeg.org/ffmpeg/trunk
19 years ago
36cd306907
rename inverse -> ff_inverse
Originally committed as revision 6990 to svn://svn.ffmpeg.org/ffmpeg/trunk
19 years ago
c26abfa541
Rename ABS macro to FFABS.
Originally committed as revision 6666 to svn://svn.ffmpeg.org/ffmpeg/trunk
19 years ago
b78e7197a8
Change license headers to say 'FFmpeg' instead of 'this program/this library'
and fix GPL/LGPL version mismatches.
Originally committed as revision 6577 to svn://svn.ffmpeg.org/ffmpeg/trunk
19 years ago
7f09a56091
remove render_line from vorbis.h, add ff_vorbis_floor1_render_list instead
Originally committed as revision 6409 to svn://svn.ffmpeg.org/ffmpeg/trunk
19 years ago
6c29d7c8f3
make some more functions global so they can be shared with vorbis_enc.c
Originally committed as revision 6402 to svn://svn.ffmpeg.org/ffmpeg/trunk
19 years ago
Chris Evans
Reinhard Tartler
Frank Barchard
Jason Garrett-Glaser
Google Chrome
Diego Biurrun
Oded Shimon
Carl Eugen Hoyos
Siarhei Siamashka
Michael Niedermayer
Loren Merritt
Peter Ross
Stefano Sabatini
Zuxy Meng
Benoit Fouet
Alex Beregszaszi
Denes Balatoni
Aurelien Jacobs
Måns Rullgård