998fc04bcf
apedec: use unsigned int for 'nblocks' and make sure that it's within int range
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
14 years ago
43fa5bf55e
apedec: check for data buffer realloc failure
(cherry picked from commit 11ca8b2d74
14 years ago
f19b8d9533
apedec: check for filter buffer allocation failure
(cherry picked from commit 7500781313
14 years ago
4a66fe2107
mpegaudiodec: check output data size based on avctx->frame_size
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
14 years ago
edf3c5a3eb
resample: Fix array size
Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3e7db0a9ee
14 years ago
a39b5e8b32
resample2: fix potential overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
14 years ago
6ae93d0304
resample: Fix overflow
Found-by: Jim Radford
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
14 years ago
241f15f1c9
tta: check for extradata allocation failure in tta demuxer
(cherry picked from commit f540ca22c5
14 years ago
2137d99086
vorbisdec: check output buffer size before writing output
(cherry picked from commit 60aa1a358d
14 years ago
e9de2d98a9
twinvq: check output buffer size before decoding
(cherry picked from commit e53eecd0e7
14 years ago
93f1159af5
vp6: Fix illegal read.
(cherry picked from commit 2a6eb06254
14 years ago
b08001e00a
shorten: check output buffer size before decoding
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
14 years ago
e1ea35fb52
shorten: check for realloc failure
(cherry picked from commit 9e5e2c2d01
14 years ago
cbfd34246c
mpegts: do not return from ff_mpegts_parse_packet() after having seen the first PMT
It prevents leaving the AVPacket uninitialized.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bc38e83793
14 years ago
feef77ec3a
mpegts: fix return value when enough ts packets have been parsed or when the first PMT has been seen.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 49ec0c818d
14 years ago
f531193690
Fixes avpicture_layout to not write past buffer end.
avpicture_get_size() returns the size of buffer required for avpicture_layout.
For pseudo-paletted formats (gray8...) this size does not include the palette.
However, avpicture_layout doesn't know this and still writes the palette. Consequently,
avpicture_layout writes passed the length of the buffer. This fixes it
by fixing avpicture_layout so that it doesn't write the palette for these formats.
Signed-off-by: Matthew Einhorn <moiein2000@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e662b263d9
14 years ago
e86e9f8b7a
avio: Check for invalid buffer length.
(cherry picked from commit ab2940691b
14 years ago
15a7fe106c
pthread: copy coded frame dimensions in update_context_from_thread
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit feadcd1bdc
14 years ago
d32f509de1
vp8: prevent read from uninitialized memory in decode_mvs
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 0f0b5d6434
14 years ago
5f5f36b52e
vp8: force reallocation in update_thread_context after frame size change
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 5653579381
14 years ago
d1166f03be
vp8: fix return value if update_dimensions fails
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit f05c2fb6eb
14 years ago
d51c7b4cbe
matroskadec: fix out of bounds write
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 723229c11f
14 years ago
e58870a587
mov: 10l: Terminate string with 0 not '0'
(cherry picked from commit 7ad06beb2c
14 years ago
5c18bcfd9c
mov: Prevent illegal writes when chapter titles are very short.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
14 years ago
62cf52c860
truespeech: check to make sure channels == 1
(cherry picked from commit 3e7a176759
14 years ago
7e95a12d51
mlpdec: validate that the reported channel count matches the actual output
channel count
(cherry picked from commit caa845851d
14 years ago
2c0cddf255
rtpdec: Read the packet length for all RTCP packet types
This allows skipping past unsupported RTCP packet types, as
RFC 3550 section 6.1 mandates.
Currently this only has any practical effect if a sender puts
an unrecognized type before RTCP_BYE in a compounded packet, or
(incorrectly) does not put RTCP_SR first.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 07b77fe387
14 years ago
d398d042c1
rtpdec: Fix the minimum packet length for RTCP SR packets
We actually read 20 bytes of these packets.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d6ecf5345
14 years ago
5ae87280e2
mem: fix memalign hack av_realloc()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc11927890
14 years ago
7d02df7036
arm: fix av_clipl_int32() asm
Note, the other arm asm code is likely affected too and should be changed as well.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 96bc6485bc
14 years ago
1c3d46a924
h264: fix HRD parameters parsing
The bit_rate_value_minus1 and cpb_size_value_minus1 elements
allow a wider range than get_ue_golomb() supports. This
adds a get_ue_golomb_long() function supporting up to 31
leading zeros, which is the maximum for these syntax
elements, and uses it in decode_hrd_parameters().
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit fdba370f8a
14 years ago
800ab099e3
smacker: validate channels and sample format.
(cherry picked from commit ff1f89de2d
14 years ago
e6b2255329
smacker: check buffer size before reading output size
(cherry picked from commit cf044f8bff
14 years ago
7f7b2e89e2
smacker: validate number of channels
(cherry picked from commit e190e453bd
14 years ago
73f85eae68
sipr: fix get_bits(0) calls
Zero-length get_bits() is undefined, must check before calling.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit c79d2a20ba
14 years ago
9b6080f685
mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions.
(cherry picked from commit 0c46e958d1
14 years ago
190807a56c
4xm: fix signed overflow
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 84dda40762
14 years ago
33029d7353
wmavoice: fix a signed overflow
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit ba3f07d061
14 years ago
c41950099d
mpegvideo_enc: fix a signed overflow
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 05795f35be
14 years ago
f65e396aa1
crc: fix signed overflow
This fixes a signed overflow from i << 24 when i == 255 by
making i unsigned. The result of the shift is already
assigned to an variable of unsigned type.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 8b19ae0761
14 years ago
115d88c4b2
h264pred: use unsigned types for pixel values, fix signed overflows
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 60f10e0ad3
14 years ago
a65045915f
qtrle: check for out of bound writes.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7fb92be7e5
14 years ago
adb12c4deb
xxan: check for out of bound accesses
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a68a6a4fb1
14 years ago
ca58b215ab
txd: check for out of bound reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e182de9a98
14 years ago
67c46b9b30
qtrle: check for invalid line offset
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3fe9
14 years ago
7ab0b6b7ed
vqavideo: check for out of bound reads.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6d45702f7f
14 years ago
b832e539c0
vqa: fix double free on corrupted streams
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e3123856c7
14 years ago
2fdbc1d553
vqavideo: check for invalid/unsupported version
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b226af3910
14 years ago
5415c488f9
eamad: release the reference frame on video size changes
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6c1fb3e763
14 years ago
79bafbb0dd
eamad: check for out of bound reads when doing MC
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit da35797359
14 years ago
Justin Ruggles
Michael Niedermayer
Alex Converse
Laurent Aimar
Matthew Einhorn
Ronald S. Bultje
John Brooks
Mans Rullgard
Laurent Aimar