Fixes: null pointer dereference
Fixes: 27730/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-6212402236096512

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Also in cdg demuxer do not skip packets data, and remove
private context which is not really needed.

Some decoders may not need a writable buffer in some specific cases, but only
a reference to the existing buffer with updated frame properties instead, for
the purpose of returning duplicate frames. For this, the
FF_REGET_BUFFER_FLAG_READONLY flag is added, which will prevent potential
allocations and buffer copies when they are not needed.

Signed-off-by: James Almer <jamrial@gmail.com>

Fixes: Timeout (17 sec -> 65 milli sec)
Fixes: 13264/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-5711167941509120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

frame_number will not increase if nothing is output

Fixes: Timeout
Fixes: 9057/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CDGRAPHICS_fuzzer-4844661498707968

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Express bitfields more simply.

Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>

0 means no data consumed, so it can trigger an infinite loop in the
caller.

CC:libav-stable@libav.org

Fixes possible invalid memory accesses on corrupted data.

CC:libav-stable@libav.org
Bug-ID: CVE-2013-3674

Prevent use of uninitialized memory

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Coccinelle profile used:

  @@
  expression r, ctx, f, loglevel, str, flags;
  @@

  -if ((r = ff_get_buffer(ctx, f, flags)) < 0) {
  -    av_log(ctx, loglevel, str);
  -    return r;
  -}
  +if ((r = ff_get_buffer(ctx, f, flags)) < 0)
  +    return r;

  @@
  expression r, ctx, f, loglevel, str;
  @@

  -if ((r = ff_reget_buffer(ctx, f)) < 0) {
  -    av_log(ctx, loglevel, str);
  -    return r;
  -}
  +if ((r = ff_reget_buffer(ctx, f)) < 0)
  +    return r;

  @@
  expression r, ctx, f, loglevel, str, flags;
  @@

  -if ((r = ff_thread_get_buffer(ctx, f, flags)) < 0) {
  -    av_log(ctx, loglevel, str);
  -    return r;
  -}
  +if ((r = ff_thread_get_buffer(ctx, f, flags)) < 0)
  +    return r;

...along with some manual patches for the remaining ones.

Signed-off-by: Paul B Mahol <onemda@gmail.com>

Setting it to zero (instead of 128, as the default get_buffer() does)
also produces more correctly-looking output.

It's got_frame, not data size

It will be useful in the upcoming transition to refcounted AVFrames.

The vertical offset mask 0x07 is suspicious.

    v_off = FFMIN(data[2] & 0x07, CDG_BORDER_HEIGHT - 1);

Note that v_off is up to 11 (CDG_BORDER_HEIGHT - 1), the correct mask
should be 0x0F.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Fixes Ticket1359

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Also break some long lines, remove codec function placeholder comments
and add spaces in sample/pixel format lists.

Signed-off-by: Martin Storsjö <martin@martin.st>

It's more readable and less prone to breakage.

Signed-off-by: Mans Rullgard <mans@mansr.com>

The lowres support doesn't work correctly (crops the video), so let's remove it.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Mans Rullgard <mans@mansr.com>

None of these symbols should be accessed directly, so declare them as
hidden.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit d36beb3f69)

None of these symbols should be accessed directly, so declare them as
hidden.

Signed-off-by: Mans Rullgard <mans@mansr.com>

Originally committed as revision 24098 to svn://svn.ffmpeg.org/ffmpeg/trunk

Passing an explicit filename to this command is only necessary if the
documentation in the @file block refers to a file different from the
one the block resides in.

Originally committed as revision 22921 to svn://svn.ffmpeg.org/ffmpeg/trunk

is deprecated and will be dropped at the next major bump.

Originally committed as revision 22735 to svn://svn.ffmpeg.org/ffmpeg/trunk

reference must be 3 because both "fields" are used as reference,
and buffer_hints must include readable since we might memcpy from the old frame.

Originally committed as revision 20923 to svn://svn.ffmpeg.org/ffmpeg/trunk

Patch by Michael Tison (gmail address: blackspike@....)

Originally committed as revision 20890 to svn://svn.ffmpeg.org/ffmpeg/trunk