URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=af79d964a73ffb941570768d352cfe8a4e56a763 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Jun 10 00:47:43 2015 +0200
avdevice/lavfi: do not rescale AV_NOPTS_VALUE in lavfi_read_packet() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 913685f55208efd78bfc34d82b261bd449e69774) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8320aa7dc74309df8eba2e39e50844ab59a47ed4 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Jun 9 05:11:09 2015 +0200 avcodec/x86/h264_weight: handle weight1=128 Fix ticket4596 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e1009665759d4a3938dd2dd07b7e84d8bc9c5290) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7a9f4f2816be98fee348dec2a63177b431366e9e Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Jun 9 00:37:26 2015 +0200 avcodec/jpeg2000dec: Check that coords match before applying ICT This avoid potential out of array accesses Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 12ba1b2b4d5592c0e27b0fcc83db929e8d6a8eee) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1fe67c9472adba37b0ac7c9b30cd9b8fa5c3ef3d Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Jun 7 14:55:10 2015 +0200 avformat/ffmdec: Check ffio_set_buf_size() return value Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit dc55477a64cefebf8dcc611f026be71382814ae2) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6fd4b2b84f603a0b5721ec1bc965abadb89095e8 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Jun 4 22:34:12 2015 +0200 avcodec/adpcm: Check for overreads See: vlc ticket 14649 Reported-by: carl Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 3c803ed9cb23e5a8d76b6c31d8a8c71cac27e769) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a3740b6a8644198d9c61f9080f4fa407d37531b8 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Jun 4 22:59:34 2015 +0200 avcodec/alsdec: Check for overread Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit c2657633187e325a439e3297fd9ccd0522ab2e39) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ff0e9060a53fc3c8fdcb40c4314e61b381a1b269 Author: Michael Niedermayer <michae...@gmx.at> Date: Mon Jun 1 21:35:02 2015 +0200 avformat/mxfenc: Accept MXF D-10 with 49.999840 Mbit/sec This is the maximum rate possible based on the frame size limit of MXF D-10 Previous version reviewed by tim nicholson <nicho...@yahoo.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit d7a762553c6f6c422adb6632354bcc4ff577b701) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6d7384bd735b9e75f15af4639a102bdc9bdc2891 Author: Ganesh Ajjanagadde <gajjanaga...@gmail.com> Date: Tue Jun 2 23:17:48 2015 -0400 swresample/dither: check memory allocation check memory allocation in swri_get_dither() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 196b885a5f0aa3ca022c1fa99509f47341239784) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9db97584ca5b1664f44f43f18546f78afd4db686 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Jun 3 00:48:29 2015 +0200 swresample: Check the return value of resampler->init() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 02915602d9313aa4b108342a3081244b9d2422bf) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=04bb8cc842125381a966e064fcee3e7fe8ee6386 Author: Luca Barbato <lu_z...@gentoo.org> Date: Mon May 25 22:30:10 2015 +0200 h264: Make sure reinit failures mark the context as not initialized (cherry picked from commit 3b69f245dbe6e2016659a45c4bfe284f6c5ac57e) Signed-off-by: Reinhard Tartler <siret...@tauware.de> Conflicts: libavcodec/h264_slice.c (cherry picked from commit 964fef3f3ced60e67831549df223bc177e1537c9) Signed-off-by: Michael Niedermayer <michae...@gmx.at> Conflicts: libavcodec/h264.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=03c80a740043bd8cf35dc18db84ed1ffd4c08ddc Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Aug 21 16:33:03 2014 +0200 avcodec/h264_slice: More complete cleanup in h264_slice_header_init() Fixes null pointer dereference Fixes Ticket3873 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 1fa35e4352cc39894987e14de464e3d72b55739f) Conflicts: libavcodec/h264_slice.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b6ae28c2e9cb1b667a4fd51feb9ad63987c0c9c2 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Wed May 20 00:31:24 2015 +0200 nutdec: stop skipping bytes at EOF This can unnecessarily waste a lot of time. Reviewed-by: Michael Niedermayer <michae...@gmx.at> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> (cherry picked from commit fa7dec8cb00d2d0dd96ff9863ccda38428610a21) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5123c8aa0bf35c0340f0562986440b654ed7bb8c Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Wed May 20 00:06:05 2015 +0200 nutdec: fix infinite resync loops nut->last_syncpoint_pos doesn't necessarily change between resync attempts, so find_any_startcode can return the same startcode again. Thus remember where the last resync happened and don't try to resync before that. This can't be done locally in nut_read_packet, because this wouldn't prevent infinite resync loops, where after the resync a packet is returned and while reading a following packet the resync happens again. Reviewed-by: Michael Niedermayer <michae...@gmx.at> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> (cherry picked from commit 37e679881d364b6da817d829d35869d657218ab3) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6cb8599bab1b16331a4fd0423782de67718aa78a Author: Michael Niedermayer <michae...@gmx.at> Date: Sat May 23 00:23:05 2015 +0200 avformat/nutdec: Check X in 2nd branch of index reading Prevents read of uninitialized variable Based on patch by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit ebb0ca3d70465ab6d369a66b2ef43bb059705db8) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=00b8a9dd8d996f8a033aea2598ccc0e44b239b7b Author: Michael Niedermayer <michae...@gmx.at> Date: Wed May 20 17:32:48 2015 +0200 avformat/nutdec: Fix recovery when immedeately after seeking a failure happens Found-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit b3496b4a33e806b7afdcbbf6f468b0332b676d7c) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9dd9090b89d57451740fe8d2d49082b1152d2928 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed May 20 17:13:15 2015 +0200 avformat/nutdec: Return error on EOF from get_str() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 6bbb2f8f4da67af374d62403742482cc5962aa21) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fd1be2bd874c1979d45f471165b1b76af2cde45f Author: Martin Storsjö <mar...@martin.st> Date: Fri Apr 24 12:38:09 2015 +0300 rtsp: Make sure we don't write too many transport entries into a fixed-size array (cherry picked from commit b90adb0aba073f9c1b4abca852119947393ced4c) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ced57c6ef3e5510e7d07525d1b04f0b011834fdf Author: Andrey Utkin <andrey.krieger.ut...@gmail.com> Date: Sat Apr 11 00:54:10 2015 +0300 rtpenc_jpeg: handle case of picture dimensions not dividing by 8 This fixes the calculation of the number of needed blocks to make sure that ALL pixels are represented by the result. Reviewed-by: Thomas Volkert <si...@gmx.net> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 7f64a7503b19b39f1251e4380987034c569bebf5) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=13b22617c185e69f3d1ada5544f1512acb0777bd Author: Michael Niedermayer <michae...@gmx.at> Date: Fri May 15 22:02:12 2015 +0200 avcodec/libtheoraenc: Check for av_malloc failure Fixes CID1257799 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit c64b2d480b4a35d4face9928b4265a0fda3f3dd9) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c01f5517280c389cd823e9e1b5d1cf979040bd61 Author: Michael Niedermayer <michae...@gmx.at> Date: Fri May 15 18:29:40 2015 +0200 avcodec/dcadec: Check active_bands Fixes CID1297594 part2 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit fc624ec9ba7e5c4e8d905ac10f605a43d123f95a) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a3d05bf6be2e97092ce2ded0a849d9150aac82f2 Author: Michael Niedermayer <michae...@gmx.at> Date: Fri May 15 18:04:12 2015 +0200 avcodec/dcadec: Check scale table index Fixes CID1297594 part 1 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 0f3e6959bfa67d12cd5a173b86eb15abd7d9e4d5) Conflicts: libavcodec/dcadec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=025b38f3a6147aff2f143a930a50b377ad4a60f8 Author: Michael Niedermayer <michae...@gmx.at> Date: Fri May 15 17:31:58 2015 +0200 avcodec/sonic: More completely check sample_rate_index and channels Fixes CID1271783 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit ade8a46154cb45c88b1cb5c616eaa6320c941187) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=41c81556a70cd32fc153a614a2088a926b779b39 Author: Michael Niedermayer <michae...@gmx.at> Date: Fri May 15 17:21:10 2015 +0200 avcodec/smvjpegdec: check avcodec_decode_video2() return code Fixes CID1271810 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit cdd25f9a3df3905543a5546cf6076d2eaf895736) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f58c9746c3972873e80b385846a451c479d69d6e Author: Michael Niedermayer <michae...@gmx.at> Date: Fri May 15 17:02:28 2015 +0200 avcodec/shorten: More complete pred_order check Fixes CID1239055 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 294469416d8193a28710d802bb0c46e5fa09fad7) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a7c8dc67e773d8591cd29cbfb8b4ab586c3ba160 Author: Michael Niedermayer <michae...@gmx.at> Date: Fri May 15 16:48:31 2015 +0200 avcodec/shorten: Check skip_bytes() Fixes CID1210526 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit d201becfc0d89c6a5dfe44e96f1044fbc2aadb70) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0888e7110e7ac23cb884d5dcdebe9090f02548ea Author: Michael Niedermayer <michae...@gmx.at> Date: Fri May 15 16:58:51 2015 +0200 avcodec/shorten: Fix code depending on signed overflow behavior Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 2d15588124ab1d4c0612cab66f02a716f1509211) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=990c2ee3bd950f3b7d447cd71fa5efc979d1c98a Author: Michael Niedermayer <michae...@gmx.at> Date: Fri May 15 15:23:32 2015 +0200 avcodec/proresdec2: Reset slice_count on deallocation Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit c4c6aea397f62421bf8ef0449b2b465a53e4ab4d) Conflicts: libavcodec/proresdec2.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ffd894917fd5aaab9bb462ddc85ddb71b02b7346 Author: Michael Niedermayer <michae...@gmx.at> Date: Sat May 9 13:07:00 2015 +0200 ffmpeg_opt: Fix -timestamp parsing Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 107e4da47644fe615ea821d6a19682d73789aca7) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3fedff39852553692b5cb6222ff5d9f492f3d559 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu May 14 21:29:19 2015 +0200 avcodec/dcadec: Check subsubframes Fixes: CID1239152 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit a9bf628bfdad142763880a3d1ccb6058040dda57) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c532c56e7b77ee30b86d218d6407d17575fc66a0 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu May 14 20:49:25 2015 +0200 avcodec/dcadec: Check nchans Fixes CID1239110 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit a6a45774d045007f8262cd7c614804390e53122e) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=36bc9519b6a62456129d1fed92e93e8fd3330933 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu May 14 17:54:40 2015 +0200 avcodec/cavsdec: Check esc_code Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 139e1c8009df7729a53eaaae7036ca01071aced5) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=136bd71f690fa78954475904e54e702925cca866 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu May 14 00:09:56 2015 +0200 avcodec/mpeg4audio: add some padding/alignment to MAX_PCE_SIZE This avoids potential accesses over the end Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 93cfa7d1692c25cff045f99ba1af2c9e5772c45e) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c0726da9339f9dffdb4eee59fbc551292adf893f Author: Michael Niedermayer <michae...@gmx.at> Date: Wed May 13 18:36:19 2015 +0200 avcodec/mjpegdec: fix len computation in ff_mjpeg_decode_dqt() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 81cf9108563510dee24f73b2c5d94a7bd07ff747) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=32f568f82c46cd8cf897b118b146c15271c0081f Author: Michael Niedermayer <michae...@gmx.at> Date: Wed May 13 15:15:55 2015 +0200 avcodec/jpeg2000dec: fix boolean operator Fixes CID1271791 #7-6 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit f8f155a18ac454e7ff3312e0e0c3a70eb4359143) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0bf455c0543dca474088e3ef004904a747555bec Author: Michael Niedermayer <michae...@gmx.at> Date: Wed May 13 00:41:38 2015 +0200 avcodec/vqavideo: Check chunk size Fixes CID1239154 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 8a62b80ce6c8e87e7937f9a5d68f83882c1c8da2) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e553282860c805679349af521af96e1e7886e713 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue May 12 18:32:12 2015 +0200 avformat/matroskadec: Cleanup error handling for bz2 & zlib Fixes CID703652 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 171af59d58fc67d82dce8ff7ed11fa671108baa5) Conflicts: libavformat/matroskadec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8ad873ed4e99380958e6a60016554876d96716a1 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue May 12 18:20:23 2015 +0200 avformat/nutdec: Fix use of uinitialized value Fixes CID1041175 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 56abf35151c635caa3eb04bbb90454bae5463a09) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b470e21d61558be80c40dd47bfae85e7fe4a99e5 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue May 12 17:55:40 2015 +0200 avformat/rtpenc_jpeg: Check remaining buffer size for SOS Fixes CID1238818 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 81198a68370e88f7d02f16de58db36713c2a50b6) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4a9ce87ef334e4ae2f21bfa9dc392e7203d2316a Author: Michael Niedermayer <michae...@gmx.at> Date: Tue May 12 18:03:55 2015 +0200 avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet() Larger packets are not supported and would cause problems later Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit aa5169935e160551fb1c290d1397da2f04325817) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1dad249ae66ce0cc77f610dbed11d21676f09b07 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue May 12 03:59:30 2015 +0200 tools/graph2dot: use larger data types than int for array/string sizes Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit acf4925f444636a828534ab47d0f86c21a7a9b4e) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5399107682ae7cab7c38ef18ff636dca9e3ff1e8 Author: Michael Niedermayer <michae...@gmx.at> Date: Sun May 10 15:38:40 2015 +0200 avformat/subtitles: Use size_t for len string length could theoretically be larger than int Reviewed-by: Clément Bœsch <u...@pkh.me> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit a633928d47057426a9c328da594407d1c7da8a5c) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c7b089b1ac804b4a29124404add1b5cfbccbdb4c Author: Michael Niedermayer <michae...@gmx.at> Date: Mon May 11 03:50:01 2015 +0200 avformat/url: Use size_t for len from strlen() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 95efc651294b3cf3e5ec4b3ed36e79d7261545ff) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=93a04473fc09b6283f3d8322f862ce882a47e0d9 Author: Michael Niedermayer <michae...@gmx.at> Date: Mon May 11 20:01:15 2015 +0200 avutil/avstring: Use size_t in av_strlcatf() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit ae4eea8be45a0b212fd57ceaac1f11089ab81d98) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=db0c4d2e3c7079c2d854e258b494b39a55b84a90 Author: Michael Niedermayer <michae...@gmx.at> Date: Mon May 11 15:23:51 2015 +0200 avformat/vorbiscomment: Check entry length in ff_vorbiscomment_write() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit eca38864a6ce5053e463b8d3fc22b22bc9a49578) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fdc62caf3075d02c0a65368cd43c98dde04e4185 Author: Michael Niedermayer <michae...@gmx.at> Date: Sun May 10 16:09:07 2015 +0200 avutil/dict: Use size_t for appending strings the string length is not constrained to INT_MAX Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 4c128ea1629116fc4936edc5f96bbd18f3ef1647) Conflicts: libavutil/dict.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=998d943cce73ac186cc002786f79db6fd46e4b75 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Wed Apr 22 15:23:24 2015 +0200 aacsbr: break infinite loop in sbr_hf_calc_npatches Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 584cc1ade10a3297ef9c107ef3a2081c04024156) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bf665557691571632ff22f5457e79d44a3045dfe Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Wed May 6 15:34:53 2015 +0200 diracdec: check that block length is valid In init_planes p->xblen and p->yblen are set to: p->xblen = s->plane[0].xblen >> s->chroma_x_shift; p->yblen = s->plane[0].yblen >> s->chroma_y_shift; These are later used as block_w and block_h arguments of s->vdsp.emulated_edge_mc. If one of them is 0 it triggers an av_assert2 in emulated_edge_mc: av_assert2(start_x < end_x && block_w > 0); av_assert2(start_y < end_y && block_h > 0); Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 75fc81c8318505aa7946e05a9bee08d47241fc66) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=994538281645e1f12a0e238b5b7225566e51a98c Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Tue May 5 23:51:48 2015 +0200 diracdec: check if reference could not be allocated s->ref_pics[i] is later used as ref argument of interpolate_refplane, where it is dereferenced. If it is NULL, it causes a segmentation fault. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit d93181ef3eacdb862d93448f31c97765a523d1db) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ebc768cfa1c928ca38580e17bbf8f1b164731eb6 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Tue May 5 22:10:44 2015 +0200 diracdec: avoid overflow of bytes*8 in decode_lowdelay If bytes is large enough, bytes*8 can overflow and become negative. In that case 'bufsize -= bytes*8' causes bufsize to increase instead of decrease. This leads to a segmentation fault. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 9e66b39aa87eb653a6e5d15f70b792ccbf719de7) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=869613728cea6c26aa1428f099abbb6f100046db Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Tue May 5 21:33:08 2015 +0200 diracdec: prevent overflow in data_unit_size check buf_idx + data_unit_size can overflow, causing the '> buf_size' check to wrongly fail. This causes a segmentation fault. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 984f50deb2d48f6844d65e10991b996a6d29e87c) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4d27d864a653c47b76da2ad994799e994720dbf6 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Mon May 4 23:01:45 2015 +0200 avidec: avoid infinite loop due to negative ast->sample_size If max in clean_index is set to a negative ast->sample_size, the following loop never ends: while (max < 1024) max += max; Thus set ast->sample_size to 0 if it would otherwise be negative. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit ca234639ac49a0dc073ac1f10977979acdb94f97) Conflicts: libavformat/avidec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=35eabb85b2a68ea5620c5cbd21fb478291bc7b51 Author: Michael Niedermayer <michae...@gmx.at> Date: Mon May 4 15:47:54 2015 +0200 avformat/matroskadec: Use tracks[k]->stream instead of s->streams[k] The later is not correct Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 5d309d309108684f742bbf5fc2393f1c519cda72) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=68e1c80c67daeb29bd7e8d8d104faf9439b70b74 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Sun May 3 23:55:20 2015 +0200 matroskadec: check s->streams[k] before using it This fixes a segmentation fault. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e54540655f229d06667dc7fa7005f2a20e101e80) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d2142c3b3a98ecf5abf80afac0abf2798d4806ed Author: Michael Niedermayer <michae...@gmx.at> Date: Mon May 4 13:37:26 2015 +0200 avcodec/ffv1dec: Check chroma shift parameters Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit d43cd6b08ed555c303478e3133717fbb2236be6e) Conflicts: libavcodec/ffv1dec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ac7a211b3be16946acc1832d54b5e3a39dde80ce Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Sun May 3 23:07:20 2015 +0200 matroskadec: use uint64_t instead of int for index_scale index_scale is set to matroska->time_scale of type uint64_t. When index_scale is int, the assignment can overflow and e.g. result in index_scale = 0. This causes a floating point exception due to the division by index_scale. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit eb9fb508b0e09d85d234fe694333b2005e1d7a7e) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9ac72b1dde34bd17ac6b8bdf57c82a4f609a917b Author: Michael Niedermayer <michae...@gmx.at> Date: Sun May 3 15:54:21 2015 +0200 avcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and undefined behavior in fate Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 042260cde4ecf716438c5fc92d15ad5f037ee2e1) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9d5362a45cbd8777751e8a98e7cb8c26f180868c Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Tue Apr 28 22:37:19 2015 +0200 nutdec: fix illegal count check in decode_main_header The existing check has two problems: 1) i + count can overflow, so that the check '< 256' returns true. 2) In the (i == 'N') case occurs a j-- so that the loop runs once more. This can trigger the assertion 'nut->header_len[0] == 0' or cause segmentation faults or infinite hangs. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 7c24ca1bda2d4df1dc9b2b982941be532d60da21) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0691554e68e36833586f5d5a9ada0f7cdbf88fb2 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Tue Apr 28 20:57:59 2015 +0200 nutdec: check chapter creation in decode_info_header This fixes a segmentation fault when accessing the metadata. Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 3ff1af2b0db7132d5717be6395227a94c8abab07) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7f2b3c3bee6f6ca57d7074cf272685c2c0e3f03c Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Tue Apr 28 20:31:56 2015 +0200 nutdec: check for negative frame rate in decode_info_header A negative frame rate triggers an av_assert2 in av_rescale_rnd. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 6621105877ce0d65724a8ab60b3a50160adbe65d) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=35ca5eb11f19faf86dbd0c604594091d5ff182ac Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Apr 23 14:29:47 2015 +0200 ffmpeg: remove incorrect network deinit Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e2877bdf3862325c2982c3237d9bf28f1bbf793f) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e6cc6a08d9938c9c8dd2efa682112d7ca91a5512 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Tue Apr 28 11:13:43 2015 +0200 apedec: prevent out of array writes in decode_array_0000 s->decoded_buffer is allocated with a min_size of: 2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer) Then it is assigned to s->decoded[0] (and s->decoded_buffer + FFALIGN(blockstodecode, 8) to s->decoded[1]) and passed as out buffer to decode_array_0000. In this function 64 elements of the out buffer are written unconditionally and outside the array if blockstodecode is too small. This causes memory corruption, leading to segmentation faults or other crashes. Thus change decode_array_0000 to write at most blockstodecode elements of the out buffer. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 699341d647f7af785fb8ceed67604467b0b9ab12) Conflicts: libavcodec/apedec.c Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=57208a0999a0cc7377187bd7f6e23904133b5d59 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Tue Apr 28 00:30:51 2015 +0200 apedec: set s->samples only when init_frame_decoder succeeded Otherwise range_start_decoding is not necessarily run and thus ctx->rc.range still 0 in range_dec_normalize leading to an infinite loop. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 464c49155ce7ffc88ed39eb2511e7a75565c24be) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9f665b0d6a12b4b351f93dd4ae33448223b3afb1 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Apr 23 04:27:56 2015 +0200 tests/fate-run: do not attempt to parse tiny_psnrs output if it failed This avoids confusing syntax errors with awk later Likely fixes awk errors at: http://buildd.debian-ports.org/status/fetch.php?pkg=ffmpeg&arch=sparc64&ver=7%3A2.6.2-1&stamp=1428928967 Reviewed-by: Timothy Gu <timothyg...@gmail.com> Thanks-to: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> for the link Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit c0d847e457c1ef72843a63853f1135d52b74131e) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2d204f313bd00e7d4ab29239833aeb0a5ab39c29 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Fri Apr 24 00:01:43 2015 +0200 alac: reject rice_limit 0 if compression is used If rice_limit is 0, k can be 0 in decode_scalar, which calls show_bits(gb, k). Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 4b657a1b1eedcf38bcf36e89a2f4be6f76b5ce09) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c7e56b8b9cc21fac33177f7a790f8dbaede69db9 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Wed Apr 22 16:03:41 2015 +0200 alsdec: only adapt order for positive max_order For max_order = 0 the clipping range is invalid. (amin = 2, amax = 1) Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 58d605ee9b3277289278dc40e022311f8e083833) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cf13885622c33302d1d7fcfda0d47cf32256732e Author: Vittorio Giovara <vittorio.giov...@gmail.com> Date: Wed Apr 22 14:59:56 2015 +0100 lavf: Reset global flag on deinit Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 32da94fa7f73ac749e0a1e2f20499fad2f6f57fe) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cee951b596f1b844cfdbc9289febae689bc944ff Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Wed Apr 22 16:32:42 2015 +0200 mpeg4videodec: only allow a positive length Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit b3408ae4c64cb674b1d5f0f30171759113ce722a) Conflicts: libavcodec/mpeg4videodec.c (cherry picked from commit 3339bae2197a2a02b090e74a8720282b5b87598e) URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1303d8a204d181e5a2db595a74a2fce1d08f22ac Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Tue Apr 21 19:25:50 2015 +0200 alsdec: check sample pointer range in revert_channel_correlation Also change the type of begin, end and smp to ptrdiff_t to make the comparison well-defined. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Reviewed-by: Thilo Borgmann <thilo.borgm...@mail.de> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit afc7748d1f6abc4b3b1cc957b0fa6941837db3d0) Conflicts: libavcodec/alsdec.c (cherry picked from commit 0b5405c443ec8adc3c114e508b71ce2012c83f0d) URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1a87782c2e55753a3b34dc8f1064dc267401cae8 Author: Michael Niedermayer <michae...@gmx.at> Date: Mon Apr 20 22:22:31 2015 +0200 avformat/utils: Ensure that AVFMT_FLAG_CUSTOM_IO is set before use Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit ba631b791435c395361e2026fc7419b341e57813) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a1f0c1b6fe10c7341679678c959a2784a8e885d0 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Sat Apr 18 20:09:28 2015 +0200 alsdec: validate time diff index If begin is smaller than t, the subtraction 'begin -= t' wraps around, because begin is unsigned. The same applies for end < t. This causes segmentation faults. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit faf9fe2c224ea81a98afd53e2f0be0a2e13aeca9) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=baa58c19c48fa34a3782cd93264b7b0b1c7091e7 Author: Michael Niedermayer <michae...@gmx.at> Date: Sat Apr 18 20:50:23 2015 +0200 avcodec/alsdec: Use av_mallocz_array() for chan_data to ensure the arrays never contain random data Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 7e104647a3556fc61a139483cee1cb7dfa2dc5bd) Conflicts: libavcodec/alsdec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=82e24ec792fcaa2bb4c5ca61121cb35024c3bfaa Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Sat Apr 18 18:31:36 2015 +0200 alsdec: ensure channel reordering is reversible If the same idx is used for more than one i, at least one entry in sconf->chan_pos remains uninitialized. This can cause segmentation faults. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit ef16501aebed43e34a3721336e8bee732eca2877) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=997a997465b5848bfa8437345fef67c81ccfd387 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Thu Apr 16 21:25:26 2015 +0200 ac3: validate end in ff_ac3_bit_alloc_calc_mask This fixes an invalid read if end is 0: band_end = ff_ac3_bin_to_band_tab[end-1] + 1; Depending on what is before the array, this can cause stack smashing, when band_end becomes too large. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit bc4fee7f2a51635fa3c0f61d1e5164da1efeded3) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c962405c1968c0bfb3271f225df3ccabcb683c0e Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Thu Apr 16 20:04:54 2015 +0200 aacpsy: avoid psy_band->threshold becoming NaN If band->thr is 0.0f, the division is undefined, making norm_fac not a number or infinity, which causes psy_band->threshold to become NaN. This is passed on to other variables until it finally reaches sce->sf_idx and is converted to an integer (-2147483648). This causes a segmentation fault when it is used as array index. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Reviewed-by: Claudio Freire <klaussfre...@gmail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e224aa41917454e7b5c23d9f2541425743ce595a) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=743973f56f94e12c9153c06b17fb59cac7ccda39 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Thu Apr 16 19:12:02 2015 +0200 aasc: return correct buffer size from aasc_decode_frame Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 0be54ad280cf114c02306b7063147e8379f8ed1e) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=97b137a64071354f527926ac7d131ebf130fc987 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Thu Apr 16 14:49:08 2015 +0200 msrledec: use signed pixel_ptr in msrle_decode_pal4 This fixes segmentation faults, when pic->linesize[0] is negative. In that case 'line * pic->linesize[0] + pixel_ptr' is treated as unsigned and wraps around. This reverts commit 7d78a964. The problem was introduced in commit f7e1367f, which should obsolete that commit. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit ae6fd7300b4e9f81d3b5ba201096ffe7cccf26fb) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a5e2f793170bc9daaf270a3ad1914cc05af45b7a Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Apr 9 00:04:44 2015 +0200 avcodec/aacdec: Fix storing state before PCE decode Fixes Ticket4460 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e88b3852aefaa39b2170ef185ad03dda18732821) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=feb869b6829ca608f2f0c879728618f11271d695 Author: Timothy Gu <timothyg...@gmail.com> Date: Sun Nov 9 21:37:18 2014 -0800 tests: Fix test name for pixfmts tests(cherry picked from commit e1ee0521a698809ed216e9e5c11bd2bbb466ed04) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b73e47a413ae7ed7bdfd1a5ae388f919e7dece30 Author: Timothy Gu <timothyg...@gmail.com> Date: Mon Jun 9 21:46:37 2014 -0700 tests/fate.sh: report different status for different errors The order of error codes will be useful in my future fateserver patches. Signed-off-by: Timothy Gu <timothyg...@gmail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit cc0057a31c7097839f9c4e4da61e2933b5b0e055) Signed-off-by: Timothy Gu <timothyg...@gmail.com> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2f51865751778ffccb08ddee2afb71b09ead74ab Author: Michael Niedermayer <michae...@gmx.at> Date: Sat Apr 4 18:08:23 2015 +0200 avcodec/h264_refs: Do not set reference to things which dont exist Fixes deadlock Fixes Ticket4428 Fixes Ticket4429 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 429de043202286a2b5bcc082cc02de860b734db2) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=50e17cdc984ec9ec30a59da355c061bb013cd710 Author: Michael Niedermayer <michae...@gmx.at> Date: Mon Mar 30 04:37:42 2015 +0200 avutil/pca: Check for av_malloc* failures Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit dadc43eee4d9036aa532665a04720238cc15e922) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=936554f1d7388cd9e46add774345b138e55acf47 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Mar 24 15:50:12 2015 +0100 avcodec/msrledec: restructure msrle_decode_pal4() based on the line number instead of the pixel pointer Fixes out of array access Fixes: da14e86d8462be6493eab16bc2d40f88/asan_heap-oob_204cfd2_528_cov_340150052_COMPRESS.BMP Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit f7e1367f58263593e6cee3c282f7277d7ee9d553) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=81ba3b1b916692e24d00aed6b673f43ebe13d639 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Mar 19 23:28:39 2015 +0100 avcodec/dnxhddec: Check that the frame is interlaced before using cur_field Fixes Ticket4227 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 2c660e34cf3c2b77cd2bef6f292920334dfd9192) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9c10ef55b0aa97894b841076c3b893f42235b89a Author: Michael Niedermayer <michae...@gmx.at> Date: Sat Mar 14 21:32:35 2015 +0100 avformat/mov: Disallow ".." in dref unless use_absolute_path is set as this kind of allows to circumvent it to some extend. We also could add a separate parameter or value to choose this Found-by: ramiro Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 1e4d0498df6621143da1a550006ddc3526ad51cb) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dece653d0de93ab4b362e6e888a98045e929f7fe Author: Michael Niedermayer <michae...@gmx.at> Date: Sat Mar 14 21:24:54 2015 +0100 avformat/mov: Check for string truncation in mov_open_dref() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 8003816e1619e77d8de051883264aa090e0d78cc) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a26a200b3f134882f08ee6982cbfc8a2f6867871 Author: Michael Niedermayer <michae...@gmx.at> Date: Sat Mar 14 21:23:32 2015 +0100 avformat/mov: Use sizeof(filename) instead of a literal number Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 21a53dd08dce7cc5b3fdf9c4826b4b74d8300ea0) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=572cfee405d93b2a6e195fcc0d91790331381841 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Sun Mar 8 23:12:59 2015 +0100 ffmdec: make sure the time base is valid A negative time base can trigger assertions. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 4c91d81be23ffacfa3897b2bcfa77445bb0c2f89) Conflicts: libavformat/ffmdec.c (cherry picked from commit 9678ceb6976ca8194848b24535785a298521211f) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e5f7aeb46f55fc3134a55e435a1bee8f5ac8b974 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Mar 10 19:18:34 2015 +0100 avcodec/012v: redesign main loop Fixes out of array accesses Fixes: ffmpeg_012v_crash.ts Found-by: Thomas Lindroth <thomas.lindr...@gmail.com> Reviewed-by: Thomas Lindroth <thomas.lindr...@gmail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 48df30d36c3ca360c407d84f96749888d1fbe853) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ae14a444f282ce67bfcc876c678e60e37964b36c Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Mar 10 20:21:14 2015 +0100 avcodec/012v: Check dimensions more completely Fixes division by 0 Found-by: Thomas Lindroth <thomas.lindr...@gmail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit d3b25383daffac154846daeb4e4fb46569e728db) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b13cba308253cb76c500c0425f7569f4a43131b1 Author: Martin Storsjö <mar...@martin.st> Date: Thu Mar 5 23:38:00 2015 +0200 arm: Suppress tags about used cpu arch and extensions When all the codepaths using manually set .arch/.fpu code is behind runtime detection, the elf attributes should be suppressed. This allows tools to know that the final built binary doesn't strictly require these extensions. Signed-off-by: Martin Storsjö <mar...@martin.st> (cherry picked from commit dcae2e32f7d8a1ca5fb8c1e4aa81313be854dd73 and b77e335e441040a40fc6156b8e4a134745d10233) Signed-off-by: Martin Storsjö <mar...@martin.st> (cherry picked from commit 9841654c158c80e9d525ba03754135d3f34e306e) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=46ee330d3a1e84034aadbaede606c1722210a8ff Author: Xiaohan Wang <xhw...@chromium.org> Date: Thu Nov 6 12:59:54 2014 -0800 Fix read-after-free in matroska_read_seek(). In matroska_read_seek(), |tracks| is assigned at the begining of the function. However, functions like matroska_parse_cues() could reallocate the tracks so that |tracks| can get invalidated. This CL assigns |tracks| only before we use it so that it won't be invalidated. BUG=427266 TEST=Test case in associated bug passes now. Change-Id: I9c7065fe8f4311ca846076281df2282d190ed344 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 33301f001747d7a542073c634cc81da5eff051cf) Conflicts: libavformat/matroskadec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c9edf502cd8bf2cff80a26fd368bdbc59c94c5b9 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Mon Mar 9 19:24:09 2015 +0100 roqvideoenc: set enc->avctx in roq_encode_init So far it is only set in roq_encode_frame, but it is used in roq_encode_end to free the coded_frame. This currently segfaults if roq_encode_frame is not called between roq_encode_init and roq_encode_end. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit cf82c426fadf90105e1fb9d5ecd267cc3aa2b288) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1c1574e3777aea8bf9255122c63c423f34ef6d15 Author: Michael Niedermayer <michae...@gmx.at> Date: Mon Mar 9 03:42:00 2015 +0100 avcodec/options_table: remove extradata_size from the AVOptions table allowing access to the size but not the extradata itself is not useful and could lead to potential problems if writing happens through this field Reviewed-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Reviewed-by: Lukasz Marek <lukasz.m.lu...@gmail.com> Reviewed-by: Nicolas George <geo...@nsup.org> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 1f4088b28540080ce1d42345c5614be3e1a6a197) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0f2401e3cb440af4e278315b0df535de3c702ccb Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Mon Mar 9 14:59:44 2015 +0100 ffmdec: limit the backward seek to the last resync position If resyncing leads to the same position as previously, it will again lead to a resync attempt, resulting in an infinite loop. Thus don't seek back beyond the last syncpoint. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 6b8263b03ab3d16d70525ae1893cb106be7852f1) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9be586e166472eca4ce2770f00a6c72d33c26f33 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Sun Mar 8 23:31:48 2015 +0100 ffmdec: fix infinite loop at EOF If EOF is reached, while skipping bytes, avio_tell(pb) won't change anymore, resulting in an infinite loop. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 6fa98822eba501a4898fdec5b75acd3026201005) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3d11279745a64e7eb65f63b76dbc9d561651fcfc Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Mon Mar 2 15:46:44 2015 +0100 avformat/rm: limit packet size The chunk size is limited to 0xFFFF (written by avio_wb16), so make sure that the packet size is not too large. Such large frames need to be split into slices smaller than 64 kB, but that is currently supported neither by the rv10/rv20 encoders nor the rm muxer. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> See Ticket244 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 08728f400b8367dc8c983036cb2eff3a2891322b) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=63efad67ee56565c6376e8233a83d8b1837fef3a Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Mon Mar 2 20:27:26 2015 +0100 avcodec/rv10: check size of s->mb_width * s->mb_height If it doesn't fit into 12 bits it triggers an assertion. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 2578a546183da09d49d5bba8ab5e982dece1dede) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=27432f259d50e9ade1c962a9a797d6a339b389bf Author: Federico Tomassetti <ftomasse...@groupon.com> Date: Wed Feb 18 12:11:43 2015 +0000 mdec: check for out of bounds read Bug-Id: CID 1257501 CC: libav-sta...@libav.org Signed-off-by: Luca Barbato <lu_z...@gentoo.org> (cherry picked from commit 2c63081b48d98f3a0d0bed7b0ec3c0347b99144c) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e69c43035363bd3b7420b5718e7951049fc771a0 Author: Vittorio Giovara <vittorio.giov...@gmail.com> Date: Fri Feb 27 19:00:25 2015 +0000 aic: Fix decoding files with odd dimensions Normally the aic decoder finds the proper slice combination (multiple of some number less than 32) but in case of odd width, it resorts to the default values, which were actually swapped. The number of slices is modified to account for such odd width cases. CC: libav-sta...@libav.org (cherry picked from commit e878ec0d47cd6228c367b2f3128b76d7523f7255) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ff0985347c2c127870d693bffc063102934dedca Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Mar 8 23:27:43 2015 +0100 avcodec/tiff: move bpp check to after "end:" This ensures that all current and future code-pathes get bpp checked Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit d5e9fc782150d4596c72440a0aa02b7f4f1254b1) Conflicts: libavcodec/tiff.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5f92a0d1e94c7cde4a6dec7bb11abf200a59f3ca Author: Michael Niedermayer <michae...@gmx.at> Date: Sat Mar 7 14:30:34 2015 +0100 avcodec/utils: Align YUV411 by as much as the other YUV variants Fixes out of array accesses Fixes: ffmpeg_mjpeg_crash2.avi Found-by: Thomas Lindroth <thomas.lindr...@gmail.com> Tested-by: Thomas Lindroth <thomas.lindr...@gmail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e3201c38d53d2b8b24d0bc95d726b2cb1752dc12) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3bfaadfadaba9a1035f87d276d3a0ab64d571cb5 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Sat Feb 28 20:58:31 2015 +0100 avformat/flvenc: check that the codec_tag fits in the available bits flags is later written with avio_w8 and if it doesn't fit in one byte it triggers an av_assert2. Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e8565d21c276ab9ac5ce785549420321fbd0b093) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=852ef62b85c04eb37dbe337ff0d8a59d459a7d29 Author: Michael Niedermayer <michae...@gmx.at> Date: Fri Feb 27 03:12:23 2015 +0100 swscale/utils: clear formatConvBuffer on allocation Fixes use of uninitialized memory Fixes: asan_heap-oob_35ca682_1474_cov_3230122439_aletrek_tga_16bit.mov Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 007498fc1a639ecee2cda1892cbcff66c7c8c951) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=45432879ff415ec3e91d66ef5a19219ba7563ab9 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Thu Feb 26 21:42:02 2015 +0100 avformat/bit: only accept the g729 codec and 1 channel Other codecs/channel numbers are not supported by this muxer. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit d0b8640f75ff7569c98d6fdb03d83451104e088c) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=77955dcabfce95b32f696d521f260d53b1ac3709 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Thu Feb 26 21:38:50 2015 +0100 avformat/bit: check that pkt->size is 10 in write_packet Ohter packet sizes are not supported by this muxer. This avoids a null pointer dereference of pkt->data. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit eeda2c3de8a8484d9e7d1e47ac836bec850b31fc) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=15fc5263f9d474cc1107d77246106824df3ddfcc Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Wed Feb 25 22:55:44 2015 +0100 avformat/adxdec: check avctx->channels for invalid values This avoids a null pointer dereference of pkt->data. Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 7faa40af982960608b117e20fec999b48011e5e0) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5ae61395afe63f4f5e24f6f1e7bc6f38f0e49c24 Author: Dyami Caliri <dy...@dragonframe.com> Date: Thu Feb 26 10:17:01 2015 -0800 Fix buffer_size argument to init_put_bits() in multiple encoders. Several encoders were multiplying the buffer size by 8, in order to get a bit size. However, the buffer_size argument is for the byte size of the buffer. We had experienced crashes encoding prores (Anatoliy) at size 4096x4096. (cherry picked from commit 50833c9f7b4e1922197a8955669f8ab3589c8cef) Conflicts: libavcodec/proresenc_kostya.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1697813db84aa16fcf5c56af674aa5b6c77e7b3a Author: James Cowgill <james...@cowgill.org.uk> Date: Thu Feb 26 13:42:52 2015 +0000 mips/acelp_filters: fix incorrect register constraint Change register constraint on the v variable from = to +. This was causing GCC to think that the v variable was never read and therefore not initialize it. This fixes about 20 fate failures on mips64el. Signed-off-by: James Cowgill <james...@cowgill.org.uk> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit b9de1303a6414174ab2f3bccefa801bfabcf0f88) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=22dc1fd166eb403d6e1d1b6b8c602922f37520a0 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Feb 25 12:29:10 2015 +0100 avcodec/zmbv: Check len before reading in decode_frame() Fixes out of array read Fixes: asan_heap-oob_4d4eb0_3994_cov_3169972261_zmbv_15bit.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 1f5c7781e63d6519192ada59c1e36bcecc92791d) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bc0bf39e4ccfb0a85ddb2b072d42bad2a8e8b1be Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Feb 24 03:12:22 2015 +0100 avcodec/snowdec: Fix ref value check Fixes integer overflow and out of array read. Fixes: signal_sigsegv_24169e6_3445_cov_3778346427_snow_chroma_bug.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 8f4cbf940212079a34753c7f4d6c6b5a43586d30) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3cca4c770ea6c9b946067df7b0f46716fc864414 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Feb 24 00:32:39 2015 +0100 swscale/utils: More carefully merge and clear coefficients outside the input Fixes out of array read Fixes: asan_heap-oob_35ca682_1474_cov_3230122439_aletrek_tga_16bit.mov Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 1895d414aaacece3b57d7bf19502305e9a064fae) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1cba89a135ba28bb80c2b7ea451331512827ac10 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Sun Feb 22 20:48:38 2015 +0100 avcodec/a64multienc: fix use of uninitialized values in to_meta_with_crop Averaging over 2 pixels doesn't work correctly for the last pixel, because the rest of the buffer is not initialized. Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 87513d654546a99f8ddb045ca4fa5d33778a617e) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ffdfa80147f3f534185e2b9dd9327b9bd48417ec Author: Michael Niedermayer <michae...@gmx.at> Date: Mon Feb 23 01:21:30 2015 +0100 avcodec/a64multienc: don't set incorrect packet size This fixes invalid reads of the packet buffer in av_dup_packet Based on patch by Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit d96142e9af92ded84f2580620c571ab96c4bb657) Conflicts: libavcodec/a64multienc.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c4353d7ee2039296b2a9ecb2907db7805c6ab1d3 Author: Andreas Cadhalpun <andreas.cadhal...@googlemail.com> Date: Sun Feb 22 20:43:30 2015 +0100 avcodec/a64multienc: use av_frame_ref instead of copying the frame This fixes freeing the frame buffer twice on cleanup leading to a crash. Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 39e4ed7c1d8d840be47f6d604704d47a59a9ae5d) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=24bb746194153181a3ff67afd6075fb25b380887 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Feb 19 16:25:29 2015 +0100 avcodec/x86/mlpdsp_init: Simplify mlp_filter_channel_x86() Based on patch by Francisco Blas Izquierdo Riera Commit message partly taken from carl fixes a compilation error in mlpdsp_init.c with -fstack-check and some gcc compilers (I reproduced the issue with gcc 4.7.3) by simplifying the code. See also https://bugs.gentoo.org/show_bug.cgi?id=471756 $ make libavcodec/x86/mlpdsp_init.o libavcodec/x86/mlpdsp_init.c: In function ‘mlp_filter_channel_x86’: libavcodec/x86/mlpdsp_init.c:142:5: error: can’t find a register in class ‘GENERAL_REGS’ while reloading ‘asm’ libavcodec/x86/mlpdsp_init.c:142:5: error: ‘asm’ operand has impossible constraints 4551 -> 4509 dezicycles Reviewed-by: Ramiro Polla <ramiro.po...@gmail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 03f39fbb2a558153a3c464edec1378d637a755fe) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e201e753688cad5bf6d7e6189ce2aba2b1e4951a Author: Anton Khirnov <an...@khirnov.net> Date: Thu Feb 12 13:06:49 2015 +0100 h264: initialize H264Context.avctx in init_thread_copy This prevents using a wrong (first thread's) AVCodecContext if decoding a frame in the first pass over all threads fails. (cherry picked from commit a06b0b1295c51d100101e0ca0434e199ad6de6b5) Conflicts: libavcodec/h264.c Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=79460c552f8d93dc8fb71f5fb3b4131b437aad70 Author: Michael Niedermayer <michae...@gmx.at> Date: Fri Feb 20 21:00:57 2015 +0100 avformat/vqf: Use 64bit for ret to avoid overflow Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit cb08687180683a755d0fe9d425280d0e4d1e6db2) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fc0d183729c2fbaed88e4b62155646400978052d Author: Michael Niedermayer <michae...@gmx.at> Date: Fri Feb 20 20:41:35 2015 +0100 avformat/mvdec: Use 64bit for ret to avoid overflow Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 26c0cc154e06cb0064b3a3da49447ac44d82444f) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=052cd9e5523008506bdc37cfe3ea2c85b5135793 Author: Michael Niedermayer <michae...@gmx.at> Date: Fri Feb 20 20:14:56 2015 +0100 avformat/gxf: Use 64bit for res to avoid overflow Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 12987f89007ee82b9d3a6090085dfaef8461ab8b) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d20c761782c6e9db49fbeef2321803638af9ca50 Author: Michael Niedermayer <michae...@gmx.at> Date: Fri Feb 20 20:13:06 2015 +0100 avformat/idcin: Use 64bit for ret to avoid overflow Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit d1923d15a3544cbb94563a59e7169291db76b312) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b4e4a5cbaa57dc857f1dabdc44ad4dedeeed1b3e Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Feb 11 03:33:53 2015 +0100 avcodec/mjpegdec: Skip blocks which are outside the visible area Fixes out of array accesses Fixes: ffmpeg_mjpeg_crash.avi Found-by: Thomas Lindroth <thomas.lindr...@gmail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 08509c8f86626815a3e9e68d600d1aacbb8df4bf) Conflicts: libavcodec/mjpegdec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1081c9decc63931e30438c8f2490837c7eb7e26a Author: Michael Niedermayer <michae...@gmx.at> Date: Sat Feb 7 03:34:48 2015 +0100 avcodec/h264_slice: ignore SAR changes in slices after the first Fixes race condition and null pointer dereference Fixes: signal_sigsegv_1472ac3_468_cov_2915641226_CABACI3_Sony_B.jsv Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 38d5241b7f36c1571a88517a0650caade16dd5f4) Signed-off-by: Michael Niedermayer <michae...@gmx.at> Conflicts: libavcodec/h264_slice.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a22da15b0cace003b445b8c232338f70eb90451a Author: Michael Niedermayer <michae...@gmx.at> Date: Fri Feb 6 04:11:56 2015 +0100 avcodec/h264_ps: More completely check the bit depths Fixes out of array read Fixes: asan_static-oob_30328b6_719_cov_3325483287_H264_artifacts_motion.h264 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 69aa79365c1e8e1cb597d33e77bf1062c2ef47d4) Conflicts: libavcodec/h264_ps.c Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=11afd2e2dd15a6c4639c7dbcc90835460bf6cfa5 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Feb 5 03:45:21 2015 +0100 avformat/thp: Check av_get_packet() for failure not only for partial output Fixes null pointer dereference Fixes: signal_sigsegv_db2c1f_3108_cov_163322880_pikmin2_opening1_partial.thp Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit f2579dbb4b31e6ae731e7f5555680528ef3020ab) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0d728ed7926e9bb5e3f3c10f3689652b88814f8b Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Feb 5 00:12:08 2015 +0100 swscale/utils: Limit filter shifting so as not to read from prior the array Fixes out of array read Fixes: asan_heap-oob_1fb2f9b_3780_cov_3984375136_usf.mkv Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 692b22626ec9a9585f667c124a186b1a9796e432) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fe618beccf10566e834d6a81e6e432263331553b Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Feb 4 20:48:30 2015 +0100 avcodec/mjpegdec: Check number of components for JPEG-LS Fixes out of array accesses Fixes: asan_heap-oob_1c1a4ea_1242_cov_2274415971_TESTcmyk.jpg Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit fabbfaa095660982cc0bc63242c459561fa37037) Conflicts: libavcodec/mjpegdec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c6ef9ca9710a96bf42697bd446d3eb0a10da7184 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Feb 4 20:13:18 2015 +0100 avcodec/mjpegdec: Check escape sequence validity Fixes assertion failure Fixes: asan_heap-oob_1c1a4ea_1242_cov_2274415971_TESTcmyk.jpg Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2acdf29838323afe93636bbb73ce01b2b9669f60 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Feb 4 14:47:41 2015 +0100 avformat/mpc8: Use uint64_t in *_get_v() to avoid undefined behavior Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 05e161952954acf247e0fd1fdef00559675c4d4d) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=76d18b6e095bac40b72bf79e880058efcb2aa0e4 Author: wm4 <nfx...@googlemail.com> Date: Tue Feb 3 19:04:11 2015 +0100 avformat/mpc8: fix broken pointer math This could overflow and crash at least on 32 bit systems. Reviewed-by: Reimar Döffinger <reimar.doeffin...@gmx.de> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit b737a2c52857b214be246ff615c6293730033cfa) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2e6b1915cb32af835129f78856cb7e7b382338db Author: wm4 <nfx...@googlemail.com> Date: Tue Feb 3 19:04:12 2015 +0100 avformat/mpc8: fix hang with fuzzed file This can lead to an endless loop by seeking back a few bytes after each attempted chunk read. Assuming negative sizes are always invalid, this is easy to fix. Other code in this demuxer treats negative sizes as invalid as well. Fixes ticket #4262. Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 56cc024220886927350cfc26ee695062ca7ecaf4) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=64857ecd68b7aad7dc6cf4e9a26d46250315ebb0 Author: wm4 <nfx...@googlemail.com> Date: Tue Feb 3 14:41:10 2015 +0100 avformat/tta: fix crash with corrupted files av_add_index_entry() can fail, for example because the parameters are invalid, or because memory allocation fails. Check this; it can actually happen with corrupted files. The second hunk is just for robustness. Just in case functions like ff_reduce_index() remove entries. (Not sure if this can actually happen.) Fixes ticket #4294. Reviewed-by: Paul B Mahol <one...@gmail.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 6a0cd529a35190d9374b0b26504e71857cd67b83) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=904f75d3c46ba4359aecdf77a206a194882b9810 Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Feb 1 19:40:13 2015 +0100 avcodec/mpegvideo_enc: Fix number suffixes in rc_buffer_size calculation Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 4531e2c489d279bfc90d54ca26ed898c5b265a7f) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=89e08520fc611b55f3ab6f513c29fa06103dffff Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Feb 1 19:39:22 2015 +0100 avcodec/h264_cabac: use int instead of long for mbb_xy The mb address fits in int Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 592ba6ec106206f97133c9345313010c76361e12) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6e4e32e7590c0b4fabd4248a54c30a9898ed530a Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Feb 1 19:36:13 2015 +0100 avformat/smacker: Fix number suffix Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 465f3705b1ef832fd6904750d018f81f9044f3ab) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5c36d0e1cdb861df3958b05133d917e3b81a9d6f Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Feb 1 19:34:52 2015 +0100 avformat/matroskadec: Fix number suffixes Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit fc3cdb00d084222a107e61e7168903bf3d3d0b47) Conflicts: libavformat/matroskadec.c (cherry picked from commit 201d626bb90ea3ca22f0168b8e2085bbd16ac984) URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c21604b5e72d8481d24853332bc5b04b904c474d Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Feb 1 19:27:00 2015 +0100 swresample/dither: Cleanup number suffixes The <<31 case needs LL Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit c77cc2c1766666cdb5f14daee0f75e397bf7a194) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1a8f5c9e2dbd276d9106a8116e08df40b9e1a538 Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Feb 1 19:19:25 2015 +0100 avformat/utils: Fix number suffixes in tb_unreliable() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 4b15bba2aec93776bfdc69a1bca42a4795a7d191) Conflicts: libavformat/utils.c (cherry picked from commit e651a2f88c219e74c9851563e74100f7652a6005) URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2324c670763ce3b78c87ee3e74a52fd681388885 Author: Michael Niedermayer <michae...@gmx.at> Date: Sat Dec 6 00:18:29 2014 +0100 avformat/rmdec: Check for overflow in ff_rm_read_mdpr_codecdata() Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 03abf55f252945c70f4a79eaf4d609cee4d98710) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3d5c48937bebaafdd2ff855393632351321f0276 Author: Vittorio Giovara <vittorio.giov...@gmail.com> Date: Wed Dec 17 16:02:07 2014 +0100 swscale: check memory allocations Bug-Id: CID 1257779 (cherry picked from commit 1dd797e3c9f179f957316a0becbec048b42df8aa) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=61b31c69391874d4f8dc4a82f2b9bd0fe5f2e7bf Author: Michael Niedermayer <michae...@gmx.at> Date: Sat Jan 17 01:56:03 2015 +0100 avcodec/flac_parser: fix handling EOF if no headers are found Fixes assertion failure Fixes Ticket4269 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit c4d85fc23c100f7a27d9bad710eb153214868e27) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c2439cad51015dc34c9b2c56e779ec46acde9ae9 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Jan 8 23:02:30 2015 +0100 ffmpeg: Clear error message array at init. This avoids printing uninitialized bytes if no error message is set Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 6d1a2efb8ac399a003ea7d3b6f8c641d192567ee) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=59fc55b29738a6436489d1b9de112e35ad12a23d Author: wm4 <nfx...@googlemail.com> Date: Wed Jan 7 23:57:50 2015 +0100 avcodec/dvdsubdec: error on bitmaps with size 0 Attemtping to decode them could lead to invalid writes with some fuzzed samples. Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit bcaa9099b3648b47060e1724a97dc98b63c83702) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bda7aa7cb39a8098e14fda9400fd42f059b70f4d Author: Johan Andersson <j...@i19.se> Date: Sat Jan 3 17:31:36 2015 +0100 cmdutils: update copyright year to 2015. (cherry picked from commit 3e160652219ff4da433f5672ae1e5f4956abb815) Conflicts: cmdutils.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=04e28b3b257f02370aeb1e4c7b0836d7ea9f21f4 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Jan 6 19:51:38 2015 +0100 avformat/mov: Fix mixed declaration and statement warning Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit db27f50e0658e91758e8a17fdcf390e6bc93c1d2) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=81a766e57a34b6a5525c731024ce304b1bf4af21 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Jan 6 12:48:38 2015 +0100 avformat/matroskadec: Use av_freep() to avoid leaving stale pointers in memory Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 6e70e4aca50696040cc9256ec96e5c31d9641432) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e148369df93d48878e01f0ccc291a3304434b754 Author: Paul B Mahol <one...@gmail.com> Date: Tue Jan 6 09:42:59 2015 +0000 lavfi: check av_strdup() return value Signed-off-by: Paul B Mahol <one...@gmail.com> (cherry picked from commit 145a84717b62e086cdb5f26649ad9f1b51ef38d0) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3e11a186facfd4f17ce23f462734658d88899b55 Author: Dale Curtis <dalecur...@chromium.org> Date: Mon Jan 5 16:34:17 2015 -0800 mov: Fix negative size calculation in mov_read_default(). The previous code assumed if an atom was marked with a 64-bit size extension, it actually had that data available. The new code verfies there's enough data in the atom for this to be done. Failure to verify causes total_size > atom.size which will result in negative size calculations later on. Found-by: Paul Mehta <p...@paulmehta.com> Signed-off-by: Dale Curtis <dalecur...@chromium.org> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 3ebd76a9c57558e284e94da367dd23b435e6a6d0) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=227a26cd404c8f9e782d43b0becb33ad980051f7 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Jan 6 04:29:10 2015 +0100 avformat/mov: fix integer overflow in mov_read_udta_string() Found-by: Paul Mehta <p...@paulmehta.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 3859868c75313e318ebc5d0d33baada62d45dd75) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=da29aadeb7f2ecb5fd84be2631386a4e3838a9de Author: Dale Curtis <dalecur...@chromium.org> Date: Mon Jan 5 16:19:09 2015 -0800 mov: Avoid overflow with mov_metadata_raw() The code previously added 1 to len without checking its size, resulting in an overflow which can corrupt value[-1] -- which may be used to store unaligned ptr information for certain allocators. Found-by: Paul Mehta <p...@paulmehta.com> Signed-off-by: Dale Curtis <dalecur...@chromium.org> Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=776c481eb902afa6f8fbb32582154b3f19feefb3 Author: wm4 <nfx...@googlemail.com> Date: Mon Jan 5 04:45:26 2015 +0100 avcodec/dvdsubdec: fix out of bounds accesses The code blindly trusted buffer offsets read from the file in the RLE decoder. Explicitly check the offset. Also error out on other RLE decoding errors. Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit c9151de7c42553bb145be608df8513c1287f1f24) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9ac17454a92b1be3362c9a5e7868fddc7a77b062 Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Jan 4 01:03:26 2015 +0100 avfilter/vf_sab: fix filtering tiny images Fixes out of array reads Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 9bff052b51f27f6cce04e8d7d8b405c710d7ad67) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b0369f33693dc166dd60f0003ac44280d444bcb5 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Jan 1 18:15:16 2015 +0100 avformat/flvdec: Increase string array size Fixes parsing httphostheader of Scarlatti\,\ Pieter-Jan\ Belder\ -\ Sonata\ K113\ in\ A\ major\ -\ Alle.flv Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit eb767a276bfdb9a0493bdb0b38203638230b7ccb) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5426a36300f3c31e0e06db01e1c87abe26a4d320 Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Jan 1 18:07:24 2015 +0100 avformat/flvdec: do not inject dts=0 metadata packets which failed to be parsed into a new data stream Such data streams (which then contain no other packets except the faulty one) confuse some user applications, like VLC Works around vlcticket 12389 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 322f0f5960a743cac47252d90a0f1ea7a025feff) Conflicts: libavformat/flvdec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5ba020d6481008a2a42401fb753cd9bd1482cca0 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Dec 31 21:41:46 2014 +0100 avformat/cdxl: Fix integer overflow of image_size Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 3eb5cbe0c50d0a0bbe10bcabbd6b16d73d93c128) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=43b601d36ffcdc944d9b5f16ca340f03667c9f14 Author: Stefano Sabatini <stefa...@gmail.com> Date: Tue Jan 21 19:58:41 2014 +0100 lavf/segment: remove duplicated and inconsistent cleanup code in seg_write_packet() In particular, avoid to leave around the seg->avf pointer to freed structure, and fix crash with: ffmpeg -f lavfi -i testsrc -c:v h264 -map 0 -f segment foo-%d.ts (cherry picked from commit 169065fbfb3da1ab776379c333aebc54bb1f1bc4) Found-by: Qinghao Tang Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ca39fbe14da397bb3ce065c37c238eb9e9978e94 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Nov 26 18:16:15 2014 +0100 avformat/mov: Fix memleaks for duplicate STCO/CO64/STSC atoms Also see [FFmpeg-devel] [PATCH] avformat/mov: strengthen some table allocations which contains more fixes but is unfinished Fixes: signal_sigabrt_7ffff6ac7bb9_3484_cov_1830000177_starfox2.mov Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 1b5d11240692025f036e945bc37968735679320a) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=932e5c374a252fa73270ec66925c1ff8f640a43c Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Dec 18 18:57:27 2014 +0100 avcodec/indeo3: ensure offsets are non negative Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 368642361f3a589d7b0c23ea327d988edb434e3f) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1fa9b7feb66d952355ad4a27374c5a5b6532918b Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Dec 18 03:16:39 2014 +0100 avcodec/h264: Check *log2_weight_denom Fixes undefined behavior Fixes: signal_sigsegv_14768d2_2248_cov_3629497219_h264_h264___pi_20070614T182942.h264 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 61296d41e2de3b41304339e4631dd44c2e15f805) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ae19e19678a15df311f4c1fd8d2054134e6a6ef3 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Dec 17 21:27:37 2014 +0100 avcodec/h264: Clear delayed_pic on deallocation Fixes use of freed memory Fixes: case5_av_frame_copy_props.mp4 Found-by: Michal Zalewski <lcam...@coredump.cx> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e8714f6f93d1a32f4e4655209960afcf4c185214) Conflicts: libavcodec/h264.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=53dc6f66430e516f5a2bdeee034d1cdb6ca7e316 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Dec 17 03:14:21 2014 +0100 avcodec/indeo3: use signed variables to avoid underflow Fixes out of array read Fixes: signal_sigsegv_1b0a4da_1865_cov_2167818389_computer_anger.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 3305acdc92fa37869f160a11a87741c8a0de0454) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=587cd92bd729902fc6f0753a0e4c88fe385101ef Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Dec 17 01:31:48 2014 +0100 avcodec/h264: make the first field of H264Context an AVClass Fixes use of freed memory Fixes: asan_heap-uaf_3660f67_757_cov_1257014655_Hi422FR1_SONY_A.jsv Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit f3b5b139ad853b6f69c6a0b036815a60e7b3f261) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8b130c4aab8590a5ee08e72db46a63312832cc99 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Dec 16 22:21:21 2014 +0100 swscale: increase yuv2rgb table headroom Fixes out of array access Fixes: case2_bad_read_yuv2rgbx32.mp4 Found-by: Michal Zalewski <lcam...@coredump.cx> Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=22f8dfafa86b48153492daa0259cec5441f1e5ac Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Dec 16 21:14:40 2014 +0100 avformat/mov: check atom nesting depth Fixes call stack overflow Fixes: case1_call_stack_overflow.mp4 Found-by: Michal Zalewski <lcam...@coredump.cx> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit caa7a3914f499f74b3ee346f26d598ebdc0ec210) Conflicts: libavformat/isom.h Conflicts: libavformat/isom.h URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9a15f326828c7fba847be401248a087ccb6ad0c1 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Dec 16 20:45:31 2014 +0100 avcodec/utvideodec: Fix handling of slice_height=0 Fixes out of array accesses Fixes: asan_heap-oob_25bcd7e_3783_cov_3553517262_utvideo_rgba_median.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 3881606240953b9275a247a1c98a567f3c44890f) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=87af5b3877a398885389c5aa0345978ce8e6c72e Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Dec 16 16:24:55 2014 +0100 avcodec/vmdvideo: Check len before using it in method 3 Fixes out of array access Fixes: asan_heap-oob_4d23ba_91_cov_3853393937_128.vmd Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 3030fb7e0d41836f8add6399e9a7c7b740b48bfd) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=47b82e51be67497502df6c42a3a7651aea5703b0 Author: Michael Niedermayer <michae...@gmx.at> Date: Mon Dec 15 04:32:23 2014 +0100 configure: create the tests directory like the doc directory This fixes an issue where the tests directory is not created for out of tree builds before its needed Tested-by: Dave Yeo <daver...@telus.net> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e631872f13b6be0583603d45a11e53319754bc8d) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a54aaa822ae7aefd3efb983c186a55c304222a18 Author: wm4 <nfx...@googlemail.com> Date: Mon Dec 15 04:32:58 2014 +0100 lavu/frame: fix malloc error path in av_frame_copy_props() The error path frees all side data, but forgets to reset the side data count. This can blow up later in av_frame_unref() and free_side_data(). Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit a400edbb6d00c0211de38e4f1b4f593681db91d8) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4e6706f851d388163a7cfe53529810ec8888d95d Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Dec 14 17:26:11 2014 +0100 avformat/aviobuf: Check that avio_seek() target is non negative Fixes out of array access Suggested-by: Andrew Scherkus <scher...@google.com> Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit ed86dbd05d61363dc1c0d33f3267e2177c985fdd) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=32d24c8c05a9e12bc71412831b2a430b7e3f66e2 Author: Rob Sykes <aqu...@yahoo.co.uk> Date: Sat Dec 13 21:12:56 2014 +0100 swresample/soxr_resample: fix error handling Fixes CID1257659 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 4b6f2253741f3023928e61ae5105ccd4b1c515fb) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b9ab59a82907eb557a2323b968708b57539861d5 Author: wm4 <nfx...@googlemail.com> Date: Sat Dec 6 16:53:30 2014 +0100 avformat/matroskadec: fix handling of recursive SeekHead elements When matroska_execute_seekhead() is called, it goes through the list of seekhead entries and attempts to read elements not read yet. When doing this, the parser can find further SeekHead elements, and will extend the matroska->seekhead list. This can lead to a (practically) infinite loop with certain broken files. (Maybe it can happen even with valid files. The demuxer doesn't seem to check correctly whether an element has already been read.) Fix this by ignoring elements that were added to the seekhead field during executing seekhead entries. This does not fix the possible situation when multiple SeekHead elements after the file header (i.e. occur after the "before_pos" file position) point to the same elements. These elements will probably be parsed multiple times, likely leading to bugs. Fixes ticket #4162. Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 6551acab6877addae815decd02aeca33ba4990c8) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a0976c15e69459438fa8796df435b8cda8bacb59 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Dec 3 20:21:56 2014 +0100 swscale/x86/rgb2rgb_template: fix crash with tiny size and nv12 output Fixes Ticket4151 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 8524558858b7e14bc50afa10233e0194f591ab9d) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f43127a51602aec8fdcd7fe4b56f5aab77a9e1df Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Dec 3 20:01:18 2014 +0100 avformat/rmdec: Check codec_data_size Fixes infinite loop Fixes Ticket4154 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit a6f730730b82645a9d31aad0968487cb77d6946c) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0c50e41d63f0e3a5580a6ded4cb7ff8d28538dc5 Author: Michael Niedermayer <michae...@gmx.at> Date: Mon Dec 1 13:23:24 2014 +0100 avcodec/motion_est: use 2x8x8 for interlaced qpel Fixes out of array read Fixes Ticket4121 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit b50e003e1cb6a215df44ffa3354603bf600b4aa3) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=eeff4bdbb86800f791d2033fdc4cb1eb0478dd44 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Nov 26 18:56:39 2014 +0100 avcodec/rawdec: Check the return code of avpicture_get_size() Fixes out of array access Fixes: asan_heap-oob_22388d0_3435_cov_3297128910_small_roll5_FlashCine1.cine Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 1d3a3b9f8907625b361420d48fe05716859620ff) Conflicts: libavcodec/rawdec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a0f1da9baab02f7452248d3e5bb9f7924523d8c0 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Nov 26 15:45:47 2014 +0100 avcodec/pngdec: Check IHDR/IDAT order Fixes out of array access Fixes: asan_heap-oob_20a6c26_2690_cov_3434532168_mail.png Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 79ceaf827be0b070675d4cd0a55c3386542defd8) Conflicts: libavcodec/pngdec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=71ad971244a75ff6ea633003b8482f816ca1d160 Author: Michael Niedermayer <michae...@gmx.at> Date: Wed Nov 26 03:29:03 2014 +0100 avcodec/flacdec: Call ff_flacdsp_init() unconditionally Fixes out of array access Fixes: signal_sigsegv_324b135_3398_cov_246853371_short.flac Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit e5c01ccdf5a9a330d4c51a9b9ea721fd8f1fb70b) Conflicts: libavcodec/flacdec.c URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=42b0ef9056e7b47b5931e6f3f7313a830c160086 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Nov 25 14:45:30 2014 +0100 avcodec/utils: Check that the data is complete in avpriv_bprint_to_extradata() Fixes out of array read Fixes: asan_heap-oob_4d2250_814_cov_2745172097_JACOsub_capability_tester.jss Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 3d5d95db3f5d8e2093e9e19d0c46e86f54ed2a5d) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1e18ed781f8befcb72f94a1bd4d5392c2e7e6267 Author: Michael Niedermayer <michae...@gmx.at> Date: Tue Nov 25 13:53:06 2014 +0100 avcodec/mjpegdec: Fix context fields becoming inconsistent Fixes out of array access Fixes: asan_heap-oob_1ca4f85_2760_cov_144449187_miss_congeniality_pegasus_ljpg.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 0eecf40935b22644e6cd74c586057237ecfd6844) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ff6ee4571ceb16e728b4facbc49509840f49b74b Author: Michael Niedermayer <michae...@gmx.at> Date: Thu Nov 20 00:43:45 2014 +0100 swscale/x86/rgb2rgb_template: handle the first 2 lines with C in rgb24toyv12_*() This avoids out of array accesses Should fix Ticket3451 Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 4388e78a0f022c8572996f9ab568a39b5f716f9d) Signed-off-by: Michael Niedermayer <michae...@gmx.at> URL: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3190acae6fd2c2dbf7c703b607cefe17286d013c Author: Michael Niedermayer <michae...@gmx.at> Date: Sun Nov 16 04:02:56 2014 +0100 avformat/hlsenc: Free context after hls_append_segment Fixes reading uninitialized memory Signed-off-by: Michael Niedermayer <michae...@gmx.at> (cherry picked from commit 530eb6acf8ee867bf00728bf7efaf505da107e17) Conflicts: libavformat/hlsenc.c (cherry picked from commit 0ac22f043bee2f1c4daf5e1044b014326325d929) Conflicts: libavformat/hlsenc.c (cherry picked from commit 134d3e1c0331462ea94c78a5e13a63b20d283653) Signed-off-by: Michael Niedermayer <michae...@gmx.at> _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog