A negative `size' will bypass FFMIN(). In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.
Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Sanity checks like `data + size >= data_end || data + size < data' are
broken, because `data + size < data' assumes pointer overflow, which is
undefined behavior in C. Many compilers such as gcc/clang optimize such
checks away.
Use `size < 0 || size >= data_end - data' instead.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The check `start + res < start' is broken since pointer overflow is
undefined behavior in C. Many compilers such as gcc/clang optimize
away this check.
Use `res > end - start' instead. Also change `res' to unsigned int
to avoid signed left-shift overflow.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes use of uninitialized and half initialized values, which
can occur on several error pathes
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Avoids integer overflows and out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
outpicref is not always in synch with showwaves->outpicref, which is
changed as a side effect of the call to functions.
Fix regression introduced in 5f634480d1c4ed7711a15d1be07e49177cf351c1,
+10l to me.
The function is known to be missing in at least one target (MSVC).
Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
proresdec: support mixed interlaced/non-interlaced content
vp3/5: move put_no_rnd_pixels_l2 from dsputil to VP3DSPContext.
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '4f56e773fe8a554b8c2662650aaf799c2ece2721':
x86: ac3: Fix HAVE_MMXEXT condition to only refer to external assembly
rtpenc: Start the sequence numbers from a random offset
Conflicts:
libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Documentation copied from asyncts, the options are supposed to do
the same thing. If not please submit a testcase where they differ
so we can fix it.
Disscussed-with: saste on IRC
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Expose the current sequence number via an AVOption - this can
be used both for setting the initial sequence number, or for
querying the current number.
Signed-off-by: Martin Storsjö <martin@martin.st>
Paul B Mahol
Xi Wang
Michael Niedermayer
Stefano Sabatini
Carl Eugen Hoyos
Matthieu Bouron
James Almer
Michael Smith
Ronald S. Bultje
Diego Biurrun
Martin Storsjö
Luca Barbato