[FFmpeg-cvslog] avformat/hls: More strict url checks

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer  | Fri 
Jan 15 13:29:38 2016 +0100| [6ba42b6482c725a59eb468391544dc0c75b8c6f0] | 
committer: Michael Niedermayer

avformat/hls: More strict url checks

No case is known where these are needed

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6ba42b6482c725a59eb468391544dc0c75b8c6f0
---

 libavformat/hls.c |4 
 1 file changed, 4 insertions(+)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 8063afc..e4b5de5 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -614,6 +614,10 @@ static int open_url(HLSContext *c, URLContext **uc, const 
char *url, AVDictionar
 // only http(s) & file are allowed
 if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL))
 return AVERROR_INVALIDDATA;
+if (!strncmp(proto_name, url, strlen(proto_name)) && 
url[strlen(proto_name)] == ':')
+;
+else if (strcmp(proto_name, "file") || !strcmp(url, "file,"))
+return AVERROR_INVALIDDATA;
 
 av_dict_copy(&tmp, c->avio_opts, 0);
 av_dict_copy(&tmp, opts, 0);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/hls: Even stricter URL checks

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer  | Fri 
Jan 15 15:29:22 2016 +0100| [cfda1bea4c18ec1edbc11ecc465f788b02851488] | 
committer: Michael Niedermayer

avformat/hls: Even stricter URL checks

This fixes a null pointer dereference at least

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cfda1bea4c18ec1edbc11ecc465f788b02851488
---

 libavformat/hls.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index e4b5de5..7a8610c 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -611,12 +611,16 @@ static int open_url(HLSContext *c, URLContext **uc, const 
char *url, AVDictionar
 AVDictionary *tmp = NULL;
 int ret;
 const char *proto_name = avio_find_protocol_name(url);
+
+if (!proto_name)
+return AVERROR_INVALIDDATA;
+
 // only http(s) & file are allowed
 if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL))
 return AVERROR_INVALIDDATA;
 if (!strncmp(proto_name, url, strlen(proto_name)) && 
url[strlen(proto_name)] == ':')
 ;
-else if (strcmp(proto_name, "file") || !strcmp(url, "file,"))
+else if (strcmp(proto_name, "file") || !strncmp(url, "file,", 5))
 return AVERROR_INVALIDDATA;
 
 av_dict_copy(&tmp, c->avio_opts, 0);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/mov: Update handbrake_version threshold for full mp3 parsing

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Tue Dec 22 16:19:44 2015 +0100| [2f65366c112d27c8c6078a3288c58cb202c65bd3] | 
committer: Michael Niedermayer

avformat/mov: Update handbrake_version threshold for full mp3 parsing

Fixes: Endangered\ Species\ 1x01\ Collecting\ Merl.mp4

Signed-off-by: Michael Niedermayer 
(cherry picked from commit d3b6a9abacc9df124388ca2c38bf9456570f5d59)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2f65366c112d27c8c6078a3288c58cb202c65bd3
---

 libavformat/mov.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 4ce4e2d..3668f2a 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -4535,7 +4535,7 @@ static int mov_read_header(AVFormatContext *s)
 }
 }
 if (mov->handbrake_version &&
-mov->handbrake_version <= 100*0 + 1000*10 + 0 &&  // 0.10.0
+mov->handbrake_version <= 100*0 + 1000*10 + 2 &&  // 0.10.2
 st->codec->codec_id == AV_CODEC_ID_MP3
 ) {
 av_log(s, AV_LOG_VERBOSE, "Forcing full parsing for mp3 stream\n");

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Fix intermediate format for cascaded alpha downscaling

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Thu Dec 24 21:46:15 2015 +0100| [0a6324fe9315e2a7dc5a5fe377f54ff17056f74c] | 
committer: Michael Niedermayer

swscale/utils: Fix intermediate format for cascaded alpha downscaling

Fixes Ticket4926

Signed-off-by: Michael Niedermayer 
(cherry picked from commit b83d8be6bff7d645469a623aee0b380541da15cf)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0a6324fe9315e2a7dc5a5fe377f54ff17056f74c
---

 libswscale/utils.c |3 +++
 1 file changed, 3 insertions(+)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index 2a88dc9..5610701 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -1786,6 +1786,9 @@ fail: // FIXME replace things by appropriate error codes
 int tmpH = sqrt(srcH * (int64_t)dstH);
 enum AVPixelFormat tmpFormat = AV_PIX_FMT_YUV420P;
 
+if (isALPHA(srcFormat))
+tmpFormat = AV_PIX_FMT_YUVA420P;
+
 if (srcW*(int64_t)srcH <= 4LL*dstW*dstH)
 return AVERROR(EINVAL);
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mpeg4video: Check time_incr

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Tue Jan 12 03:03:01 2016 +0100| [d408261b651477dfe9e9be14b1b09aa622dd4a34] | 
committer: Michael Niedermayer

avcodec/mpeg4video: Check time_incr

Fixes assertion failure
Fixes out of memory access

Fixes: test_casex.ivf

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7c97946d6131b31340954a3f603b6bf92590a9a5)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d408261b651477dfe9e9be14b1b09aa622dd4a34
---

 libavcodec/mpeg4video.h|2 +-
 libavcodec/mpeg4videoenc.c |   10 +-
 libavcodec/mpegvideo_enc.c |8 +---
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/libavcodec/mpeg4video.h b/libavcodec/mpeg4video.h
index 49bc13f..5998c71 100644
--- a/libavcodec/mpeg4video.h
+++ b/libavcodec/mpeg4video.h
@@ -140,7 +140,7 @@ void ff_mpeg4_encode_mb(MpegEncContext *s,
 void ff_mpeg4_pred_ac(MpegEncContext *s, int16_t *block, int n,
   int dir);
 void ff_set_mpeg4_time(MpegEncContext *s);
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);
 
 int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb);
 void ff_mpeg4_encode_video_packet_header(MpegEncContext *s);
diff --git a/libavcodec/mpeg4videoenc.c b/libavcodec/mpeg4videoenc.c
index ffa08be..b3ad4f9 100644
--- a/libavcodec/mpeg4videoenc.c
+++ b/libavcodec/mpeg4videoenc.c
@@ -1086,7 +1086,7 @@ static void mpeg4_encode_vol_header(MpegEncContext *s,
 }
 
 /* write mpeg4 VOP header */
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
 {
 int time_incr;
 int time_div, time_mod;
@@ -1112,6 +1112,12 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, 
int picture_number)
 time_mod  = FFUMOD(s->time, s->avctx->time_base.den);
 time_incr = time_div - s->last_time_base;
 av_assert0(time_incr >= 0);
+
+// This limits the frame duration to max 1 hour
+if (time_incr > 3600) {
+av_log(s->avctx, AV_LOG_ERROR, "time_incr %d too large\n", time_incr);
+return AVERROR(EINVAL);
+}
 while (time_incr--)
 put_bits(&s->pb, 1, 1);
 
@@ -1137,6 +1143,8 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, 
int picture_number)
 put_bits(&s->pb, 3, s->f_code);  /* fcode_for */
 if (s->pict_type == AV_PICTURE_TYPE_B)
 put_bits(&s->pb, 3, s->b_code);  /* fcode_back */
+
+return 0;
 }
 
 static av_cold void init_uni_dc_tab(void)
diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index 5f1143b..ebd5abb 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -3766,9 +3766,11 @@ static int encode_picture(MpegEncContext *s, int 
picture_number)
 ff_wmv2_encode_picture_header(s, picture_number);
 else if (CONFIG_MSMPEG4_ENCODER && s->msmpeg4_version)
 ff_msmpeg4_encode_picture_header(s, picture_number);
-else if (CONFIG_MPEG4_ENCODER && s->h263_pred)
-ff_mpeg4_encode_picture_header(s, picture_number);
-else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
+else if (CONFIG_MPEG4_ENCODER && s->h263_pred) {
+ret = ff_mpeg4_encode_picture_header(s, picture_number);
+if (ret < 0)
+return ret;
+} else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
 ret = ff_rv10_encode_picture_header(s, picture_number);
 if (ret < 0)
 return ret;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/h264_slice: Fix integer overflow in implicit weight computation

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Tue Jan  5 01:06:18 2016 +0100| [aee9aa92161f9e5eb385277b47ddc273e7a62133] | 
committer: Michael Niedermayer

avcodec/h264_slice: Fix integer overflow in implicit weight computation

Fixes mozilla bug 1230423

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7cc01c25727a96eaaa0c177234b626e47c8ea491)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=aee9aa92161f9e5eb385277b47ddc273e7a62133
---

 libavcodec/h264_slice.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index 8be803b..63eb463 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -783,7 +783,7 @@ static void implicit_weight_table(const H264Context *h, 
H264SliceContext *sl, in
 cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1];
 }
 if (sl->ref_count[0] == 1 && sl->ref_count[1] == 1 && !FRAME_MBAFF(h) 
&&
-sl->ref_list[0][0].poc + sl->ref_list[1][0].poc == 2 * cur_poc) {
+sl->ref_list[0][0].poc + (int64_t)sl->ref_list[1][0].poc == 2 * 
cur_poc) {
 sl->use_weight= 0;
 sl->use_weight_chroma = 0;
 return;
@@ -804,7 +804,7 @@ static void implicit_weight_table(const H264Context *h, 
H264SliceContext *sl, in
 sl->chroma_log2_weight_denom = 5;
 
 for (ref0 = ref_start; ref0 < ref_count0; ref0++) {
-int poc0 = sl->ref_list[0][ref0].poc;
+int64_t poc0 = sl->ref_list[0][ref0].poc;
 for (ref1 = ref_start; ref1 < ref_count1; ref1++) {
 int w = 32;
 if (!sl->ref_list[0][ref0].parent->long_ref && 
!sl->ref_list[1][ref1].parent->long_ref) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat: Add integer fps from 31 to 60 to get_std_framerate()

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Sat Jan  9 10:49:23 2016 +0100| [cb4ba7456a7901c08887ee20e8591753bf906bdd] | 
committer: Michael Niedermayer

avformat: Add integer fps from 31 to 60 to get_std_framerate()

Fixes Ticket 5106

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 2039b3e7511ef183dae206575114e15b6d99c134)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cb4ba7456a7901c08887ee20e8591753bf906bdd
---

 libavformat/avformat.h |2 +-
 libavformat/utils.c|   10 +++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/libavformat/avformat.h b/libavformat/avformat.h
index 4068ab6..487f5b4 100644
--- a/libavformat/avformat.h
+++ b/libavformat/avformat.h
@@ -968,7 +968,7 @@ typedef struct AVStream {
 /**
  * Stream information used internally by av_find_stream_info()
  */
-#define MAX_STD_TIMEBASES (30*12+7+6)
+#define MAX_STD_TIMEBASES (30*12+30+3+6)
 struct {
 int64_t last_dts;
 int64_t duration_gcd;
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 30567fa..28c3bdf 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2892,10 +2892,14 @@ static int get_std_framerate(int i)
 return (i + 1) * 1001;
 i -= 30*12;
 
-if (i < 7)
-return ((const int[]) { 40, 48, 50, 60, 80, 120, 240})[i] * 1001 * 12;
+if (i < 30)
+return (i + 31) * 1001 * 12;
+i -= 30;
 
-i -= 7;
+if (i < 3)
+return ((const int[]) { 80, 120, 240})[i] * 1001 * 12;
+
+i -= 3;
 
 return ((const int[]) { 24, 30, 60, 12, 15, 48 })[i] * 1000 * 12;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/ivfenc: fix division by zero

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Fri Jan  8 23:01:30 2016 +0100| [d79b6dd9f9f7786e7b21f3b8ccdb7c40daa1a147] | 
committer: Michael Niedermayer

avformat/ivfenc: fix division by zero

Fixes Ticket 5115

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5c8467a07c654f6acd9e8e3a436cd5b746bb2f44)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d79b6dd9f9f7786e7b21f3b8ccdb7c40daa1a147
---

 libavformat/ivfenc.c |5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavformat/ivfenc.c b/libavformat/ivfenc.c
index 2053c50..484d87d 100644
--- a/libavformat/ivfenc.c
+++ b/libavformat/ivfenc.c
@@ -72,8 +72,9 @@ static int ivf_write_packet(AVFormatContext *s, AVPacket *pkt)
 static int ivf_write_trailer(AVFormatContext *s)
 {
 AVIOContext *pb = s->pb;
-if (pb->seekable) {
-IVFEncContext *ctx = s->priv_data;
+IVFEncContext *ctx = s->priv_data;
+
+if (pb->seekable && ctx->frame_cnt > 1) {
 size_t end = avio_tell(pb);
 
 avio_seek(pb, 24, SEEK_SET);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny dimensions

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Mon Jan  4 23:22:25 2016 +0100| [14c63dc9b0d8ca0f99e4b73b8b9329012917da46] | 
committer: Michael Niedermayer

swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny 
dimensions

Fixes Ticket4960

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 1edf129cbc897447a289ca8b045853df5df1bab3)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=14c63dc9b0d8ca0f99e4b73b8b9329012917da46
---

 libswscale/utils.c |6 ++
 1 file changed, 6 insertions(+)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index 5610701..a108d99 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -1193,6 +1193,12 @@ av_cold int sws_init_context(SwsContext *c, SwsFilter 
*srcFilter,
srcW, srcH, dstW, dstH);
 return AVERROR(EINVAL);
 }
+if (flags & SWS_FAST_BILINEAR) {
+if (srcW < 8 || dstW < 8) {
+flags ^= SWS_FAST_BILINEAR | SWS_BILINEAR;
+c->flags = flags;
+}
+}
 
 if (!dstFilter)
 dstFilter = &dummyFilter;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/hls: forbid all protocols except http(s) & file

[Maxim Andreev]

ffmpeg | branch: release/2.8 | Maxim Andreev  | Wed Jan 
13 11:51:12 2016 +0300| [b7d54d6e072690a62d5ea5ade66ffce6944a5ff4] | committer: 
Michael Niedermayer

avformat/hls: forbid all protocols except http(s) & file

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7145e80b4f78cff5ed5fee04d4c4d53daaa0e077)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b7d54d6e072690a62d5ea5ade66ffce6944a5ff4
---

 libavformat/hls.c |4 
 1 file changed, 4 insertions(+)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index d3cb14b..44b656d 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -618,6 +618,10 @@ static int open_url(HLSContext *c, URLContext **uc, const 
char *url, AVDictionar
 {
 AVDictionary *tmp = NULL;
 int ret;
+const char *proto_name = avio_find_protocol_name(url);
+// only http(s) & file are allowed
+if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL))
+return AVERROR_INVALIDDATA;
 
 av_dict_copy(&tmp, c->avio_opts, 0);
 av_dict_copy(&tmp, opts, 0);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Thu Jan 14 12:36:41 2016 +0100| [c781a1e14b68d3b7ee4cb27bac607f81f52c0d4c] | 
committer: Michael Niedermayer

swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5e5f82a28737fba4402259617500911cc37e3674)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c781a1e14b68d3b7ee4cb27bac607f81f52c0d4c
---

 libswscale/swscale_internal.h |1 +
 libswscale/yuv2rgb.c  |   89 +
 2 files changed, 46 insertions(+), 44 deletions(-)

diff --git a/libswscale/swscale_internal.h b/libswscale/swscale_internal.h
index 5dd23ef..1c94805 100644
--- a/libswscale/swscale_internal.h
+++ b/libswscale/swscale_internal.h
@@ -40,6 +40,7 @@
 #define STR(s) AV_TOSTRING(s) // AV_STRINGIFY is too long
 
 #define YUVRGB_TABLE_HEADROOM 256
+#define YUVRGB_TABLE_LUMA_HEADROOM 0
 
 #define MAX_FILTER_SIZE SWS_MAX_FILTER_SIZE
 
diff --git a/libswscale/yuv2rgb.c b/libswscale/yuv2rgb.c
index 1d682ba..e81f3f6 100644
--- a/libswscale/yuv2rgb.c
+++ b/libswscale/yuv2rgb.c
@@ -776,7 +776,8 @@ av_cold int ff_yuv2rgb_c_init_tables(SwsContext *c, const 
int inv_table[4],
 uint16_t *y_table16;
 uint32_t *y_table32;
 int i, base, rbase, gbase, bbase, av_uninit(abase), needAlpha;
-const int yoffs = fullRange ? 384 : 326;
+const int yoffs = (fullRange ? 384 : 326) + YUVRGB_TABLE_LUMA_HEADROOM;
+const int table_plane_size = 1024 + 2*YUVRGB_TABLE_LUMA_HEADROOM;
 
 int64_t crv =  inv_table[0];
 int64_t cbu =  inv_table[1];
@@ -833,10 +834,10 @@ av_cold int ff_yuv2rgb_c_init_tables(SwsContext *c, const 
int inv_table[4],
 return AVERROR(ENOMEM);
 switch (bpp) {
 case 1:
-ALLOC_YUV_TABLE(1024);
+ALLOC_YUV_TABLE(table_plane_size);
 y_table = c->yuvTable;
-yb = -(384 << 16) - oy;
-for (i = 0; i < 1024 - 110; i++) {
+yb = -(384 << 16) - YUVRGB_TABLE_LUMA_HEADROOM*cy - oy;
+for (i = 0; i < table_plane_size - 110; i++) {
 y_table[i + 110]  = av_clip_uint8((yb + 0x8000) >> 16) >> 7;
 yb   += cy;
 }
@@ -848,60 +849,60 @@ av_cold int ff_yuv2rgb_c_init_tables(SwsContext *c, const 
int inv_table[4],
 rbase   = isRgb ? 3 : 0;
 gbase   = 1;
 bbase   = isRgb ? 0 : 3;
-ALLOC_YUV_TABLE(1024 * 3);
+ALLOC_YUV_TABLE(table_plane_size * 3);
 y_table = c->yuvTable;
-yb = -(384 << 16) - oy;
-for (i = 0; i < 1024 - 110; i++) {
+yb = -(384 << 16) - YUVRGB_TABLE_LUMA_HEADROOM*cy - oy;
+for (i = 0; i < table_plane_size - 110; i++) {
 int yval= av_clip_uint8((yb + 0x8000) >> 16);
 y_table[i + 110]= (yval >> 7)<< rbase;
-y_table[i +  37 + 1024] = ((yval + 43) / 85) << gbase;
-y_table[i + 110 + 2048] = (yval >> 7)<< bbase;
+y_table[i +  37 +   table_plane_size] = ((yval + 43) / 85) << 
gbase;
+y_table[i + 110 + 2*table_plane_size] = (yval >> 7)<< 
bbase;
 yb += cy;
 }
 fill_table(c->table_rV, 1, crv, y_table + yoffs);
-fill_table(c->table_gU, 1, cgu, y_table + yoffs + 1024);
-fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2048);
+fill_table(c->table_gU, 1, cgu, y_table + yoffs +   table_plane_size);
+fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2*table_plane_size);
 fill_gv_table(c->table_gV, 1, cgv);
 break;
 case 8:
 rbase   = isRgb ? 5 : 0;
 gbase   = isRgb ? 2 : 3;
 bbase   = isRgb ? 0 : 6;
-ALLOC_YUV_TABLE(1024 * 3);
+ALLOC_YUV_TABLE(table_plane_size * 3);
 y_table = c->yuvTable;
-yb = -(384 << 16) - oy;
-for (i = 0; i < 1024 - 38; i++) {
+yb = -(384 << 16) - YUVRGB_TABLE_LUMA_HEADROOM*cy - oy;
+for (i = 0; i < table_plane_size - 38; i++) {
 int yval   = av_clip_uint8((yb + 0x8000) >> 16);
 y_table[i + 16]= ((yval + 18) / 36) << rbase;
-y_table[i + 16 + 1024] = ((yval + 18) / 36) << gbase;
-y_table[i + 37 + 2048] = ((yval + 43) / 85) << bbase;
+y_table[i + 16 +   table_plane_size] = ((yval + 18) / 36) << gbase;
+y_table[i + 37 + 2*table_plane_size] = ((yval + 43) / 85) << bbase;
 yb += cy;
 }
 fill_table(c->table_rV, 1, crv, y_table + yoffs);
-fill_table(c->table_gU, 1, cgu, y_table + yoffs + 1024);
-fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2048);
+fill_table(c->table_gU, 1, cgu, y_table + yoffs +   table_plane_size);
+fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2*table_plane_size);
 fill_gv_table(c->table_gV, 1, cgv);
 break;
 case 12:
 

[FFmpeg-cvslog] avformat/aviobuf: Fix end check in put_str16()

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Wed Jan 13 02:31:59 2016 +0100| [90c2256ee52ca69ff16bf1d2f831a2ef8d6064eb] | 
committer: Michael Niedermayer

avformat/aviobuf: Fix end check in put_str16()

Fixes out of array read
Fixes: 
03c406ec9530e594a074ce2979f8a1f0/asan_heap-oob_7dec26_4664_37c52495b2870a2eaac65f53958e76c1.flac

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 115fb6d03ef6310732b42258d8c3cd1839cfb74b)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=90c2256ee52ca69ff16bf1d2f831a2ef8d6064eb
---

 libavformat/aviobuf.c |2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 1b3d5f5..4e79e3f 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -360,6 +360,8 @@ static inline int put_str16(AVIOContext *s, const char 
*str, const int be)
 invalid:
 av_log(s, AV_LOG_ERROR, "Invaid UTF8 sequence in avio_put_str16%s\n", 
be ? "be" : "le");
 err = AVERROR(EINVAL);
+if (!*(q-1))
+break;
 }
 if (be)
 avio_wb16(s, 0);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale: Move VScalerContext into vscale.c

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Thu Jan 14 16:49:33 2016 +0100| [be9b89314f32a882d6cee30b78a2972931c89772] | 
committer: Michael Niedermayer

swscale: Move VScalerContext into vscale.c

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7b6e6895f2cbfa90a39874d03e2fac392bcbd33b)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=be9b89314f32a882d6cee30b78a2972931c89772
---

 libswscale/swscale_internal.h |9 -
 libswscale/vscale.c   |   10 ++
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/libswscale/swscale_internal.h b/libswscale/swscale_internal.h
index 63c9fdd..57cd7c7 100644
--- a/libswscale/swscale_internal.h
+++ b/libswscale/swscale_internal.h
@@ -1003,15 +1003,6 @@ typedef struct FilterContext
 int xInc;
 } FilterContext;
 
-typedef struct VScalerContext
-{
-uint16_t *filter[2];
-int32_t  *filter_pos;
-int filter_size;
-int isMMX;
-void *pfn;
-} VScalerContext;
-
 // warp input lines in the form (src + width*i + j) to slice format 
(line[i][j])
 // relative=true means first line src[x][0] otherwise first line is 
src[x][lum/crh Y]
 int ff_init_slice_from_src(SwsSlice * s, uint8_t *src[4], int stride[4], int 
srcW, int lumY, int lumH, int chrY, int chrH, int relative);
diff --git a/libswscale/vscale.c b/libswscale/vscale.c
index 3d6e81a..f4b0b67 100644
--- a/libswscale/vscale.c
+++ b/libswscale/vscale.c
@@ -19,6 +19,16 @@
  */
 #include "swscale_internal.h"
 
+typedef struct VScalerContext
+{
+uint16_t *filter[2];
+int32_t  *filter_pos;
+int filter_size;
+int isMMX;
+void *pfn;
+} VScalerContext;
+
+
 static int lum_planar_vscale(SwsContext *c, SwsFilterDescriptor *desc, int 
sliceY, int sliceH)
 {
 VScalerContext *inst = desc->instance;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/g2meet: Check for ff_els_decode_bit() failure in epic_decode_run_length()

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Sun Jan 10 16:59:42 2016 +0100| [9cad20822370222dee2a73210b287c56d8f0f125] | 
committer: Michael Niedermayer

avcodec/g2meet: Check for ff_els_decode_bit() failure in 
epic_decode_run_length()

Fixes invalid shift
Fixes: g2m_left_shift_2.wmv

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 030c7f0309ec0e3cadb990408b4bb9b7fd739425)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9cad20822370222dee2a73210b287c56d8f0f125
---

 libavcodec/g2meet.c |7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index ba83c67..7d05222 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -631,6 +631,8 @@ static int epic_decode_run_length(ePICContext *dc, int x, 
int y, int tile_width,
   (NN  != N)  << 1 |
   (NNW != NW);
 WWneW = ff_els_decode_bit(&dc->els_ctx, &dc->W_ctx_rung[idx]);
+if (WWneW < 0)
+return WWneW;
 }
 
 if (WWneW)
@@ -837,10 +839,13 @@ static int epic_decode_tile(ePICContext *dc, uint8_t 
*out, int tile_height,
 if (y < 2 || x < 2 || x == tile_width - 1) {
 run   = 1;
 got_pixel = epic_handle_edges(dc, x, y, curr_row, 
above_row, &pix);
-} else
+} else {
 got_pixel = epic_decode_run_length(dc, x, y, tile_width,
curr_row, above_row,
above2_row, &pix, &run);
+if (got_pixel < 0)
+return got_pixel;
+}
 
 if (!got_pixel && !epic_predict_from_NW_NE(dc, x, y, run,
tile_width, 
curr_row,

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/wavpackenc: Check the number of channels

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Mon Jan 11 18:58:08 2016 +0100| [d7f7586c3fcc9a58873a65d0497b5184e49b4d65] | 
committer: Michael Niedermayer

avcodec/wavpackenc: Check the number of channels

They are stored in a byte, thus more than 255 is not possible

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 59c915a403af32c4ff5126625b0cc7e38f4beff9)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d7f7586c3fcc9a58873a65d0497b5184e49b4d65
---

 libavcodec/wavpackenc.c |5 +
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/wavpackenc.c b/libavcodec/wavpackenc.c
index 321f6d3..ce41db8 100644
--- a/libavcodec/wavpackenc.c
+++ b/libavcodec/wavpackenc.c
@@ -128,6 +128,11 @@ static av_cold int wavpack_encode_init(AVCodecContext 
*avctx)
 
 s->avctx = avctx;
 
+if (avctx->channels > 255) {
+av_log(avctx, AV_LOG_ERROR, "Too many channels\n", avctx->channels);
+return AVERROR(EINVAL);
+}
+
 if (!avctx->frame_size) {
 int block_samples;
 if (!(avctx->sample_rate & 1))

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] mjpegdec: extend check for incompatible values of s->rgb and s->ls

[Andreas Cadhalpun]

ffmpeg | branch: release/2.8 | Andreas Cadhalpun 
 | Thu Dec 31 16:55:43 2015 +0100| 
[83c0df90b0a011fcdcec031433b1d2da97d45ae8] | committer: Michael Niedermayer

mjpegdec: extend check for incompatible values of s->rgb and s->ls

This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.

In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.

This fixes an out-of-bounds read in ls_decode_line.

Reviewed-by: Michael Niedermayer 
Signed-off-by: Andreas Cadhalpun 
(cherry picked from commit 7ea2db6eafa0a8a9497aab20be2cfc8742a59072)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=83c0df90b0a011fcdcec031433b1d2da97d45ae8
---

 libavcodec/mjpegdec.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 3f81fdf..6d674b6 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -632,7 +632,8 @@ unk_pixfmt:
 av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) 
mismatch\n", len);
 }
 
-if (s->rgb && !s->lossless && !s->ls) {
+if ((s->rgb && !s->lossless && !s->ls) ||
+(!s->rgb && s->ls && s->nb_components > 1)) {
 av_log(s->avctx, AV_LOG_ERROR, "Unsupported coding and pixel format 
combination\n");
 return AVERROR_PATCHWELCOME;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/dvdec: Fix "left shift of negative value -254"

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Sun Jan 10 17:43:56 2016 +0100| [b8382a1faeb24662eb9197d32b1bae434a803daa] | 
committer: Michael Niedermayer

avcodec/dvdec: Fix "left shift of negative value -254"

Fixes: dvdec_left_shift.avi

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 93ac72a98dff592ffc174cfb36a8975dfbf145ae)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b8382a1faeb24662eb9197d32b1bae434a803daa
---

 libavcodec/dvdec.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/dvdec.c b/libavcodec/dvdec.c
index 679075e..1a3983b 100644
--- a/libavcodec/dvdec.c
+++ b/libavcodec/dvdec.c
@@ -347,7 +347,7 @@ retry:
 dct_mode* 22 * 64 +
 (quant + ff_dv_quant_offset[class1]) * 64];
 }
-dc = dc << 2;
+dc = dc * 4;
 /* convert to unsigned because 128 is not added in the
  * standard IDCT */
 dc   += 1024;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Thu Jan 14 15:11:48 2016 +0100| [cdac68fbab6923a71431709c2109bd60d0f90bbd] | 
committer: Michael Niedermayer

swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls

This avoids running various table inits unnecessarily

Signed-off-by: Michael Niedermayer 
(cherry picked from commit cc538e9dbd14b61d1ac8c9fa687d83289673fe90)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cdac68fbab6923a71431709c2109bd60d0f90bbd
---

 libswscale/utils.c |   22 ++
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index a108d99..37820f6 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -830,8 +830,6 @@ int sws_setColorspaceDetails(struct SwsContext *c, const 
int inv_table[4],
 const AVPixFmtDescriptor *desc_dst;
 const AVPixFmtDescriptor *desc_src;
 int need_reinit = 0;
-memmove(c->srcColorspaceTable, inv_table, sizeof(int) * 4);
-memmove(c->dstColorspaceTable, table, sizeof(int) * 4);
 
 handle_formats(c);
 desc_dst = av_pix_fmt_desc_get(c->dstFormat);
@@ -842,11 +840,24 @@ int sws_setColorspaceDetails(struct SwsContext *c, const 
int inv_table[4],
 if(!isYUV(c->srcFormat) && !isGray(c->srcFormat))
 srcRange = 0;
 
+if (c->srcRange != srcRange ||
+c->dstRange != dstRange ||
+c->brightness != brightness ||
+c->contrast   != contrast ||
+c->saturation != saturation ||
+memcmp(c->srcColorspaceTable, inv_table, sizeof(int) * 4) ||
+memcmp(c->dstColorspaceTable, table, sizeof(int) * 4)
+)
+need_reinit = 1;
+
+memmove(c->srcColorspaceTable, inv_table, sizeof(int) * 4);
+memmove(c->dstColorspaceTable, table, sizeof(int) * 4);
+
+
+
 c->brightness = brightness;
 c->contrast   = contrast;
 c->saturation = saturation;
-if (c->srcRange != srcRange || c->dstRange != dstRange)
-need_reinit = 1;
 c->srcRange   = srcRange;
 c->dstRange   = dstRange;
 
@@ -861,6 +872,9 @@ int sws_setColorspaceDetails(struct SwsContext *c, const 
int inv_table[4],
 if (c->cascaded_context[0])
 return sws_setColorspaceDetails(c->cascaded_context[0],inv_table, 
srcRange,table, dstRange, brightness,  contrast, saturation);
 
+if (!need_reinit)
+return 0;
+
 if ((isYUV(c->dstFormat) || isGray(c->dstFormat)) && (isYUV(c->srcFormat) 
|| isGray(c->srcFormat))) {
 if (!c->cascaded_context[0] &&
 memcmp(c->dstColorspaceTable, c->srcColorspaceTable, sizeof(int) * 
4) &&

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/asfenc: Check pts

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Tue Jan 12 18:49:20 2016 +0100| [f459afdd7247b2803c615ec58cf7e642778245ed] | 
committer: Michael Niedermayer

avformat/asfenc: Check pts

Fixes integer overflow
Fixes: 
0063df8be3aaa30dd6d76f59c8f818c8/signal_sigsegv_7b7b59_3634_bf418b6822bbfa68734411d96b667be3.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7c0b84d89911b2035161f5ef51aafbfcc84aa9e2)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f459afdd7247b2803c615ec58cf7e642778245ed
---

 libavformat/asfenc.c |5 +
 1 file changed, 5 insertions(+)

diff --git a/libavformat/asfenc.c b/libavformat/asfenc.c
index 32b726b..94f96b4 100644
--- a/libavformat/asfenc.c
+++ b/libavformat/asfenc.c
@@ -959,6 +959,11 @@ static int asf_write_packet(AVFormatContext *s, AVPacket 
*pkt)
 
 pts = (pkt->pts != AV_NOPTS_VALUE) ? pkt->pts : pkt->dts;
 av_assert0(pts != AV_NOPTS_VALUE);
+if (   pts < - PREROLL_TIME
+|| pts > (INT_MAX-3)/1LL * ASF_INDEXED_INTERVAL - PREROLL_TIME) {
+av_log(s, AV_LOG_ERROR, "input pts %"PRId64" is invalid\n", pts);
+return AVERROR(EINVAL);
+}
 pts *= 1;
 asf->duration = FFMAX(asf->duration, pts + pkt->duration * 1);
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mjpegdec: Fix negative shift

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Sun Jan 10 15:52:09 2016 +0100| [34e06ce309c9621b35be6d5100caab05525c76b7] | 
committer: Michael Niedermayer

avcodec/mjpegdec: Fix negative shift

Fixes: mjpeg_left_shift.avi

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit d86d7b2486cd5c31db8e820d8a89554abf19567e)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=34e06ce309c9621b35be6d5100caab05525c76b7
---

 libavcodec/mjpegdec.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 6d674b6..ba77994 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -999,7 +999,7 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int 
nb_components, int p
 return -1;
 
 left[i] = buffer[mb_x][i] =
-mask & (pred + (dc << point_transform));
+mask & (pred + (dc * (1 << point_transform)));
 }
 
 if (s->restart_interval && !--s->restart_count) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mss2: Check for repeat overflow

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Sun Jan 10 12:19:48 2016 +0100| [df4ee166f1a3a9b52a9df3b3720b056430619fc5] | 
committer: Michael Niedermayer

avcodec/mss2: Check for repeat overflow

Fixes: mss2_left_shift.wmv

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit e273dade78943e22b71d0ddb67cd0d737fc26edf)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=df4ee166f1a3a9b52a9df3b3720b056430619fc5
---

 libavcodec/mss2.c |7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c
index 74e52af6..c640934 100644
--- a/libavcodec/mss2.c
+++ b/libavcodec/mss2.c
@@ -210,8 +210,13 @@ static int decode_555(GetByteContext *gB, uint16_t *dst, 
int stride,
 last_symbol = b << 8 | bytestream2_get_byte(gB);
 else if (b > 129) {
 repeat = 0;
-while (b-- > 130)
+while (b-- > 130) {
+if (repeat >= (INT_MAX >> 8) - 1) {
+av_log(NULL, AV_LOG_ERROR, "repeat overflow\n");
+return AVERROR_INVALIDDATA;
+}
 repeat = (repeat << 8) + bytestream2_get_byte(gB) + 1;
+}
 if (last_symbol == -2) {
 int skip = FFMIN((unsigned)repeat, dst + w - p);
 repeat -= skip;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/hls: Even stricter URL checks

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Fri Jan 15 15:29:22 2016 +0100| [28f89bc439be1de9a61ac404ce79f9bc4cac5ec8] | 
committer: Michael Niedermayer

avformat/hls: Even stricter URL checks

This fixes a null pointer dereference at least

Signed-off-by: Michael Niedermayer 
(cherry picked from commit cfda1bea4c18ec1edbc11ecc465f788b02851488)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=28f89bc439be1de9a61ac404ce79f9bc4cac5ec8
---

 libavformat/hls.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 6e9832f..c32ecb1 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -619,12 +619,16 @@ static int open_url(HLSContext *c, URLContext **uc, const 
char *url, AVDictionar
 AVDictionary *tmp = NULL;
 int ret;
 const char *proto_name = avio_find_protocol_name(url);
+
+if (!proto_name)
+return AVERROR_INVALIDDATA;
+
 // only http(s) & file are allowed
 if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL))
 return AVERROR_INVALIDDATA;
 if (!strncmp(proto_name, url, strlen(proto_name)) && 
url[strlen(proto_name)] == ':')
 ;
-else if (strcmp(proto_name, "file") || !strcmp(url, "file,"))
+else if (strcmp(proto_name, "file") || !strncmp(url, "file,", 5))
 return AVERROR_INVALIDDATA;
 
 av_dict_copy(&tmp, c->avio_opts, 0);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/wavpackenc: Headers are per channel

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Mon Jan 11 18:32:32 2016 +0100| [f05e0e76d6574b72cbc048557b039a713ca30be4] | 
committer: Michael Niedermayer

avcodec/wavpackenc: Headers are per channel

Fixes: 
1b8b83a53bfa751f01b1daa65a4758db/signal_sigabrt_76ae7cb7_7488_403f71d1a2565b598d01b6cb110fac8f.aiff
Fixes: assertion failure

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 26757b0279b4b93c6066c2151d4d3dbd2ec266bf)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f05e0e76d6574b72cbc048557b039a713ca30be4
---

 libavcodec/wavpackenc.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/wavpackenc.c b/libavcodec/wavpackenc.c
index 6091e3f..321f6d3 100644
--- a/libavcodec/wavpackenc.c
+++ b/libavcodec/wavpackenc.c
@@ -2878,7 +2878,7 @@ static int wavpack_encode_frame(AVCodecContext *avctx, 
AVPacket *avpkt,
 }
 
 buf_size = s->block_samples * avctx->channels * 8
- + 200 /* for headers */;
+ + 200 * avctx->channels /* for headers */;
 if ((ret = ff_alloc_packet2(avctx, avpkt, buf_size, 0)) < 0)
 return ret;
 buf = avpkt->data;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/motion_est: Fix mv_penalty table size

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Tue Jan  5 14:41:04 2016 +0100| [6457cd17be8af2a31d325e8d2d0fa672a3d5336a] | 
committer: Michael Niedermayer

avcodec/motion_est: Fix mv_penalty table size

Fixes out of array read

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5b4da8a38a5ed211df9504c85ce401c30af86b97)

Conflicts:

libavcodec/motion_est.h

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6457cd17be8af2a31d325e8d2d0fa672a3d5336a
---

 libavcodec/ituh263enc.c|6 +++---
 libavcodec/motion_est.c|   16 
 libavcodec/motion_est.h|3 ++-
 libavcodec/mpeg12enc.c |6 +++---
 libavcodec/mpegvideo_enc.c |2 +-
 libavcodec/snowenc.c   |2 +-
 6 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/libavcodec/ituh263enc.c b/libavcodec/ituh263enc.c
index 03f4011..d9596c9 100644
--- a/libavcodec/ituh263enc.c
+++ b/libavcodec/ituh263enc.c
@@ -45,7 +45,7 @@
 /**
  * Table of number of bits a motion vector component needs.
  */
-static uint8_t mv_penalty[MAX_FCODE+1][MAX_MV*2+1];
+static uint8_t mv_penalty[MAX_FCODE+1][MAX_DMV*2+1];
 
 /**
  * Minimal fcode that a motion vector component would need.
@@ -678,7 +678,7 @@ static av_cold void 
init_mv_penalty_and_fcode(MpegEncContext *s)
 int mv;
 
 for(f_code=1; f_code<=MAX_FCODE; f_code++){
-for(mv=-MAX_MV; mv<=MAX_MV; mv++){
+for(mv=-MAX_DMV; mv<=MAX_DMV; mv++){
 int len;
 
 if(mv==0) len= ff_mvtab[0][1];
@@ -699,7 +699,7 @@ static av_cold void 
init_mv_penalty_and_fcode(MpegEncContext *s)
 }
 }
 
-mv_penalty[f_code][mv+MAX_MV]= len;
+mv_penalty[f_code][mv+MAX_DMV]= len;
 }
 }
 
diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c
index 9f71568..3df8276 100644
--- a/libavcodec/motion_est.c
+++ b/libavcodec/motion_est.c
@@ -923,7 +923,7 @@ void ff_estimate_p_frame_motion(MpegEncContext * s,
 c->penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_cmp);
 c->sub_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_sub_cmp);
 c->mb_penalty_factor = get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->mb_cmp);
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 
 get_limits(s, 16*mb_x, 16*mb_y);
 c->skip=0;
@@ -1090,7 +1090,7 @@ int ff_pre_estimate_p_frame_motion(MpegEncContext * s,
 av_assert0(s->quarter_sample==0 || s->quarter_sample==1);
 
 c->pre_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_pre_cmp);
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 
 get_limits(s, 16*mb_x, 16*mb_y);
 c->skip=0;
@@ -1139,7 +1139,7 @@ static int estimate_motion_b(MpegEncContext *s, int mb_x, 
int mb_y,
 const int shift= 1+s->quarter_sample;
 const int mot_stride = s->mb_stride;
 const int mot_xy = mb_y*mot_stride + mb_x;
-uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_MV;
+uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_DMV;
 int mv_scale;
 
 c->penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_cmp);
@@ -1203,8 +1203,8 @@ static inline int check_bidir_mv(MpegEncContext * s,
 //FIXME better f_code prediction (max mv & distance)
 //FIXME pointers
 MotionEstContext * const c= &s->me;
-uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_MV; // f_code 
of the prev frame
-uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_MV; // f_code 
of the prev frame
+uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_DMV; // 
f_code of the prev frame
+uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_DMV; // 
f_code of the prev frame
 int stride= c->stride;
 uint8_t *dest_y = c->scratchpad;
 uint8_t *ptr;
@@ -1417,7 +1417,7 @@ static inline int direct_search(MpegEncContext * s, int 
mb_x, int mb_y)
 int mx, my, xmin, xmax, ymin, ymax;
 int16_t (*mv_table)[2]= s->b_direct_mv_table;
 
-c->current_mv_penalty= c->mv_penalty[1] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[1] + MAX_DMV;
 ymin= xmin=(-32)>>shift;
 ymax= xmax=   31>>shift;
 
@@ -1553,11 +1553,11 @@ void ff_estimate_b_frame_motion(MpegEncContext * s,
 if (s->avctx->flags & AV_CODEC_FLAG_INTERLACED_ME) {
 //FIXME mb type penalty
 c->skip=0;
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 fimin= interlaced_search(s, 0,
  s->b_field_mv_table[0], 
s->b_field_select_table[0],
  s->b_forw_mv_table[xy][0], 
s->b_forw_mv_table[xy][1], 0);
-c->current_mv_penalty= c->mv_penalty[s->b_code] + MAX_MV;

[FFmpeg-cvslog] swscale/yuv2rgb: Increase YUV2RGB table headroom

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Thu Jan 14 03:05:11 2016 +0100| [1fd955606216e0b05bdf2f345d9e5c9b5455118c] | 
committer: Michael Niedermayer

swscale/yuv2rgb: Increase YUV2RGB table headroom

This makes SWS more robust
Fixes: 
07650a772d98aa63b0fed6370dc89037/asan_heap-oob_27ddeaf_2657_2c81ff264dee5d9712cb3251fb9c3bbb.264
Fixes: out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 8f3a9a8c278acf886f70a1d743bc07b6f9c7b51a)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1fd955606216e0b05bdf2f345d9e5c9b5455118c
---

 libswscale/swscale_internal.h |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libswscale/swscale_internal.h b/libswscale/swscale_internal.h
index 1c94805..63c9fdd 100644
--- a/libswscale/swscale_internal.h
+++ b/libswscale/swscale_internal.h
@@ -39,8 +39,8 @@
 
 #define STR(s) AV_TOSTRING(s) // AV_STRINGIFY is too long
 
-#define YUVRGB_TABLE_HEADROOM 256
-#define YUVRGB_TABLE_LUMA_HEADROOM 0
+#define YUVRGB_TABLE_HEADROOM 512
+#define YUVRGB_TABLE_LUMA_HEADROOM 512
 
 #define MAX_FILTER_SIZE SWS_MAX_FILTER_SIZE
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/put_bits: Always check buffer end before writing

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Fri Jan  1 02:41:06 2016 +0100| [709abc74f5ef5459e93faec227ec9c4a0b5ff954] | 
committer: Michael Niedermayer

avcodec/put_bits: Always check buffer end before writing

This causes a overall slowdown of 0.1 % (tested with mpeg4 single thread 
encoding of matrixbench at QP=3)

Signed-off-by: Michael Niedermayer 
(cherry picked from commit cccb0ffccc3723acc7aab3a859b24743596dd9c0)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=709abc74f5ef5459e93faec227ec9c4a0b5ff954
---

 libavcodec/put_bits.h |   20 ++--
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/libavcodec/put_bits.h b/libavcodec/put_bits.h
index 5b1bc8b..0db8a03 100644
--- a/libavcodec/put_bits.h
+++ b/libavcodec/put_bits.h
@@ -163,9 +163,13 @@ static inline void put_bits(PutBitContext *s, int n, 
unsigned int value)
 #ifdef BITSTREAM_WRITER_LE
 bit_buf |= value << (32 - bit_left);
 if (n >= bit_left) {
-av_assert2(s->buf_ptr+3buf_end);
-AV_WL32(s->buf_ptr, bit_buf);
-s->buf_ptr += 4;
+if (3 < s->buf_end - s->buf_ptr) {
+AV_WL32(s->buf_ptr, bit_buf);
+s->buf_ptr += 4;
+} else {
+av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too 
small\n");
+av_assert2(0);
+}
 bit_buf = value >> bit_left;
 bit_left   += 32;
 }
@@ -177,9 +181,13 @@ static inline void put_bits(PutBitContext *s, int n, 
unsigned int value)
 } else {
 bit_buf   <<= bit_left;
 bit_buf|= value >> (n - bit_left);
-av_assert2(s->buf_ptr+3buf_end);
-AV_WB32(s->buf_ptr, bit_buf);
-s->buf_ptr += 4;
+if (3 < s->buf_end - s->buf_ptr) {
+AV_WB32(s->buf_ptr, bit_buf);
+s->buf_ptr += 4;
+} else {
+av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too 
small\n");
+av_assert2(0);
+}
 bit_left   += 32 - n;
 bit_buf = value;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/pngenc: Fix mixed up linesizes

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Fri Jan 15 00:57:00 2016 +0100| [4676e20a9da6add1886a9ae11389f9b9471cbacc] | 
committer: Michael Niedermayer

avcodec/pngenc: Fix mixed up linesizes

Fixes out of array accesses
Fixes: 
0cf176e6d3ab9fe924f39738e513f547/asan_generic_4a54aa_3431_aaa28be1cb32e307a9890cad06f84fba.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 8f4c3e4b92212d98f5b9ca2dee13e076effe9589)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4676e20a9da6add1886a9ae11389f9b9471cbacc
---

 libavcodec/pngenc.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/pngenc.c b/libavcodec/pngenc.c
index ef78d76..edc9011 100644
--- a/libavcodec/pngenc.c
+++ b/libavcodec/pngenc.c
@@ -751,7 +751,7 @@ static int apng_encode_frame(AVCodecContext *avctx, const 
AVFrame *pict,
 
 if (last_fctl_chunk.dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
 for (y = last_fctl_chunk.y_offset; y < 
last_fctl_chunk.y_offset + last_fctl_chunk.height; ++y) {
-size_t row_start = s->last_frame->linesize[0] * y + 
bpp * last_fctl_chunk.x_offset;
+size_t row_start = diffFrame->linesize[0] * y + bpp * 
last_fctl_chunk.x_offset;
 memset(diffFrame->data[0] + row_start, 0, bpp * 
last_fctl_chunk.width);
 }
 }
@@ -926,7 +926,7 @@ static int encode_apng(AVCodecContext *avctx, AVPacket *pkt,
 uint32_t y;
 uint8_t bpp = (s->bits_per_pixel + 7) >> 3;
 for (y = s->last_frame_fctl.y_offset; y < 
s->last_frame_fctl.y_offset + s->last_frame_fctl.height; ++y) {
-size_t row_start = s->last_frame->linesize[0] * y + bpp * 
s->last_frame_fctl.x_offset;
+size_t row_start = s->prev_frame->linesize[0] * y + bpp * 
s->last_frame_fctl.x_offset;
 memset(s->prev_frame->data[0] + row_start, 0, bpp * 
s->last_frame_fctl.width);
 }
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/pngenc: Replace memcpy by av_image_copy()

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Fri Jan 15 00:35:57 2016 +0100| [0c5a71fececbfd98e4cf3d3ae4a64660eba8c2b9] | 
committer: Michael Niedermayer

avcodec/pngenc: Replace memcpy by av_image_copy()

Fixes out of array access
Fixes: 
0cf176e6d3ab9fe924f39738e513f547/asan_generic_4a54aa_3431_aaa28be1cb32e307a9890cad06f84fba.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7ec9c5ce8a753175244da971fed9f1e25aef7971)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0c5a71fececbfd98e4cf3d3ae4a64660eba8c2b9
---

 libavcodec/pngenc.c |9 +++--
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/libavcodec/pngenc.c b/libavcodec/pngenc.c
index f6ad830..ef78d76 100644
--- a/libavcodec/pngenc.c
+++ b/libavcodec/pngenc.c
@@ -747,8 +747,7 @@ static int apng_encode_frame(AVCodecContext *avctx, const 
AVFrame *pict,
 
 // Do disposal
 if (last_fctl_chunk.dispose_op != APNG_DISPOSE_OP_PREVIOUS) {
-memcpy(diffFrame->data[0], s->last_frame->data[0],
-   s->last_frame->linesize[0] * s->last_frame->height);
+av_frame_copy(diffFrame, s->last_frame);
 
 if (last_fctl_chunk.dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
 for (y = last_fctl_chunk.y_offset; y < 
last_fctl_chunk.y_offset + last_fctl_chunk.height; ++y) {
@@ -760,8 +759,7 @@ static int apng_encode_frame(AVCodecContext *avctx, const 
AVFrame *pict,
 if (!s->prev_frame)
 continue;
 
-memcpy(diffFrame->data[0], s->prev_frame->data[0],
-   s->prev_frame->linesize[0] * s->prev_frame->height);
+av_frame_copy(diffFrame, s->prev_frame);
 }
 
 // Do inverse blending
@@ -923,8 +921,7 @@ static int encode_apng(AVCodecContext *avctx, AVPacket *pkt,
 }
 
 // Do disposal, but not blending
-memcpy(s->prev_frame->data[0], s->last_frame->data[0],
-   s->last_frame->linesize[0] * s->last_frame->height);
+av_frame_copy(s->prev_frame, s->last_frame);
 if (s->last_frame_fctl.dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
 uint32_t y;
 uint8_t bpp = (s->bits_per_pixel + 7) >> 3;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Thu Jan  7 00:22:56 2016 +0100| [36861557a7a68233c1c2f1569c5d34d6f6bf3966] | 
committer: Michael Niedermayer

avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range

Fixes out of array read
Fixes: test_case-mdc.264 (b47be15a120979f5a1a945c938cbef33)

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 13f266b50cc7554028d22480b7e4383968e64a63)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=36861557a7a68233c1c2f1569c5d34d6f6bf3966
---

 libavcodec/mpegvideo_enc.c |1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index 8108093..5f1143b 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -342,6 +342,7 @@ av_cold int ff_mpv_encode_init(AVCodecContext *avctx)
 break;
 }
 
+avctx->bits_per_raw_sample = av_clip(avctx->bits_per_raw_sample, 0, 8);
 s->bit_rate = avctx->bit_rate;
 s->width= avctx->width;
 s->height   = avctx->height;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/vscale: Check that 2 tap filters are bilinear before using bilinear code

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Thu Jan 14 21:33:53 2016 +0100| [07da25548f79356b75713c1ded3290eebec75d1c] | 
committer: Michael Niedermayer

swscale/vscale: Check that 2 tap filters are bilinear before using bilinear code

Fixes: out of array reads
Fixes: 
07e8b9c5d348ccdf7add0f37de20cf6c/asan_heap-oob_27e8df7_6849_e56653f768070ec8cb52f587048444c2.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit eb7802afefb7af4da50bc56818cdab9da07de7d0)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=07da25548f79356b75713c1ded3290eebec75d1c
---

 libswscale/swscale_internal.h |1 +
 libswscale/vscale.c   |   32 +---
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/libswscale/swscale_internal.h b/libswscale/swscale_internal.h
index 57cd7c7..11f49ea 100644
--- a/libswscale/swscale_internal.h
+++ b/libswscale/swscale_internal.h
@@ -397,6 +397,7 @@ typedef struct SwsContext {
 uint8_t *chrMmxextFilterCode; ///< Runtime-generated MMXEXT horizontal 
fast bilinear scaler code for chroma planes.
 
 int canMMXEXTBeUsed;
+int warned_unuseable_bilinear;
 
 int dstY; ///< Last destination vertical line output 
from last slice.
 int flags;///< Flags passed by the user to select 
scaler algorithm, optimizations, subsampling, etc...
diff --git a/libswscale/vscale.c b/libswscale/vscale.c
index f4b0b67..14109d8 100644
--- a/libswscale/vscale.c
+++ b/libswscale/vscale.c
@@ -26,6 +26,7 @@ typedef struct VScalerContext
 int filter_size;
 int isMMX;
 void *pfn;
+yuv2packedX_fn yuv2packedX;
 } VScalerContext;
 
 
@@ -123,10 +124,21 @@ static int packed_vscale(SwsContext *c, 
SwsFilterDescriptor *desc, int sliceY, i
 uint8_t **dst = desc->dst->plane[0].line + dp;
 
 
-if (c->yuv2packed1 && lum_fsize == 1 && chr_fsize <= 2) { // unscaled RGB
-int chrAlpha = chr_fsize == 1 ? 0 : chr_filter[2 * sliceY + 1];
-((yuv2packed1_fn)inst->pfn)(c, (const int16_t*)*src0, (const 
int16_t**)src1, (const int16_t**)src2, (const int16_t*)(desc->alpha ? *src3 : 
NULL),  *dst, dstW, chrAlpha, sliceY);
-} else if (c->yuv2packed2 && lum_fsize == 2 && chr_fsize == 2) { // 
bilinear upscale RGB
+if (c->yuv2packed1 && lum_fsize == 1 && chr_fsize == 1) { // unscaled RGB
+((yuv2packed1_fn)inst->pfn)(c, (const int16_t*)*src0, (const 
int16_t**)src1, (const int16_t**)src2,
+(const int16_t*)(desc->alpha ? *src3 : 
NULL),  *dst, dstW, 0, sliceY);
+} else if (c->yuv2packed1 && lum_fsize == 1 && chr_fsize == 2 &&
+   chr_filter[2 * sliceY + 1] + chr_filter[2 * chrSliceY] == 4096 
&&
+   chr_filter[2 * sliceY + 1] <= 4096U) { // unscaled RGB
+int chrAlpha = chr_filter[2 * sliceY + 1];
+((yuv2packed1_fn)inst->pfn)(c, (const int16_t*)*src0, (const 
int16_t**)src1, (const int16_t**)src2,
+(const int16_t*)(desc->alpha ? *src3 : 
NULL),  *dst, dstW, chrAlpha, sliceY);
+} else if (c->yuv2packed2 && lum_fsize == 2 && chr_fsize == 2 &&
+   lum_filter[2 * sliceY + 1] + lum_filter[2 * sliceY] == 4096 &&
+   lum_filter[2 * sliceY + 1] <= 4096U &&
+   chr_filter[2 * chrSliceY + 1] + chr_filter[2 * chrSliceY] == 
4096 &&
+   chr_filter[2 * chrSliceY + 1] <= 4096U
+) { // bilinear upscale RGB
 int lumAlpha = lum_filter[2 * sliceY + 1];
 int chrAlpha = chr_filter[2 * sliceY + 1];
 c->lumMmxFilter[2] =
@@ -136,7 +148,14 @@ static int packed_vscale(SwsContext *c, 
SwsFilterDescriptor *desc, int sliceY, i
 ((yuv2packed2_fn)inst->pfn)(c, (const int16_t**)src0, (const 
int16_t**)src1, (const int16_t**)src2, (const int16_t**)src3,
 *dst, dstW, lumAlpha, chrAlpha, sliceY);
 } else { // general RGB
-((yuv2packedX_fn)inst->pfn)(c, lum_filter + sliceY * lum_fsize,
+if ((c->yuv2packed1 && lum_fsize == 1 && chr_fsize == 2) ||
+(c->yuv2packed2 && lum_fsize == 2 && chr_fsize == 2)) {
+if (!c->warned_unuseable_bilinear)
+av_log(c, AV_LOG_INFO, "Optimized 2 tap filter code cannot be 
used\n");
+c->warned_unuseable_bilinear = 1;
+}
+
+inst->yuv2packedX(c, lum_filter + sliceY * lum_fsize,
 (const int16_t**)src0, lum_fsize, chr_filter + sliceY * 
chr_fsize,
 (const int16_t**)src1, (const int16_t**)src2, chr_fsize, 
(const int16_t**)src3, *dst, dstW, sliceY);
 }
@@ -287,8 +306,7 @@ void ff_init_vscale_pfn(SwsContext *c,
 lumCtx->pfn = yuv2packed1;
 else if (c->yuv2packed2 && c->vLumFilterSize == 2 && 
c->vChrFilterSize == 2)
 lumCtx->pfn = yuv2packed2;
-else
-lumCtx->pfn = yuv2pac

[FFmpeg-cvslog] avformat/hls: More strict url checks

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Fri Jan 15 13:29:38 2016 +0100| [23b903aaf4eefb1ce1396a32525c8e5501d5cec8] | 
committer: Michael Niedermayer

avformat/hls: More strict url checks

No case is known where these are needed

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 6ba42b6482c725a59eb468391544dc0c75b8c6f0)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=23b903aaf4eefb1ce1396a32525c8e5501d5cec8
---

 libavformat/hls.c |4 
 1 file changed, 4 insertions(+)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 44b656d..6e9832f 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -622,6 +622,10 @@ static int open_url(HLSContext *c, URLContext **uc, const 
char *url, AVDictionar
 // only http(s) & file are allowed
 if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL))
 return AVERROR_INVALIDDATA;
+if (!strncmp(proto_name, url, strlen(proto_name)) && 
url[strlen(proto_name)] == ':')
+;
+else if (strcmp(proto_name, "file") || !strcmp(url, "file,"))
+return AVERROR_INVALIDDATA;
 
 av_dict_copy(&tmp, c->avio_opts, 0);
 av_dict_copy(&tmp, opts, 0);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] Update for 2.8.5

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Fri Jan 15 16:25:51 2016 +0100| [e303ca3ac94f7815ca9f64471ffba8fbb6584303] | 
committer: Michael Niedermayer

Update for 2.8.5

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e303ca3ac94f7815ca9f64471ffba8fbb6584303
---

 Changelog|   43 +++
 RELEASE  |2 +-
 doc/Doxyfile |2 +-
 3 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/Changelog b/Changelog
index b7f32b1..a967eeb 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,49 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+
+version 2.8.5
+- avformat/hls: Even stricter URL checks
+- avformat/hls: More strict url checks
+- avcodec/pngenc: Fix mixed up linesizes
+- avcodec/pngenc: Replace memcpy by av_image_copy()
+- swscale/vscale: Check that 2 tap filters are bilinear before using bilinear 
code
+- swscale: Move VScalerContext into vscale.c
+- swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls
+- swscale/yuv2rgb: Increase YUV2RGB table headroom
+- swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out
+- avformat/hls: forbid all protocols except http(s) & file
+- avformat/aviobuf: Fix end check in put_str16()
+- avformat/asfenc: Check pts
+- avcodec/mpeg4video: Check time_incr
+- avcodec/wavpackenc: Check the number of channels
+- avcodec/wavpackenc: Headers are per channel
+- avcodec/aacdec_template: Check id_map
+- avcodec/dvdec: Fix "left shift of negative value -254"
+- avcodec/g2meet: Check for ff_els_decode_bit() failure in 
epic_decode_run_length()
+- avcodec/mjpegdec: Fix negative shift
+- avcodec/mss2: Check for repeat overflow
+- avformat: Add integer fps from 31 to 60 to get_std_framerate()
+- avformat/ivfenc: fix division by zero
+- avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range
+- avfilter/vf_scale: set proper out frame color range
+- avcodec/motion_est: Fix mv_penalty table size
+- avcodec/h264_slice: Fix integer overflow in implicit weight computation
+- swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny 
dimensions
+- avcodec/put_bits: Always check buffer end before writing
+- mjpegdec: extend check for incompatible values of s->rgb and s->ls
+- swscale/utils: Fix intermediate format for cascaded alpha downscaling
+- avformat/mov: Update handbrake_version threshold for full mp3 parsing
+- x86/float_dsp: zero extend offset from ff_scalarproduct_float_sse
+- avfilter/vf_zoompan: do not free frame we pushed to lavfi
+- nuv: sanitize negative fps rate
+- nutdec: reject negative value_len in read_sm_data
+- xwddec: prevent overflow of lsize * avctx->height
+- nutdec: only copy the header if it exists
+- exr: fix out of bounds read in get_code
+- on2avc: limit number of bits to 30 in get_egolomb
+
+
 version 2.8.4
 - rawdec: only exempt BIT0 with need_copy from buffer sanity check
 - mlvdec: check that index_entries exist
diff --git a/RELEASE b/RELEASE
index 2701a22..766d708 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1 +1 @@
-2.8.4
+2.8.5
diff --git a/doc/Doxyfile b/doc/Doxyfile
index 5c4b466..61bd8cb 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -31,7 +31,7 @@ PROJECT_NAME   = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
-PROJECT_NUMBER = 2.8.4
+PROJECT_NUMBER = 2.8.5
 
 # With the PROJECT_LOGO tag one can specify a logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] configure: bump copyright year to 2016

[James Almer]

ffmpeg | branch: release/2.8 | James Almer  | Sat Jan  2 
16:28:31 2016 -0300| [063928910ff8d65335dc404aa1f33f4ccae4a15f] | committer: 
Michael Niedermayer

configure: bump copyright year to 2016

Signed-off-by: James Almer 
(cherry picked from commit 78129978f02f27d76ecaf2cd1a7bf7a47253fdab)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=063928910ff8d65335dc404aa1f33f4ccae4a15f
---

 configure |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure b/configure
index 7f9fed3..ec4ff08 100755
--- a/configure
+++ b/configure
@@ -6141,7 +6141,7 @@ cat > $TMPH 

[FFmpeg-cvslog] avcodec/aacdec_template: Check id_map

[Michael Niedermayer]

ffmpeg | branch: release/2.8 | Michael Niedermayer  | 
Sun Jan 10 19:29:39 2016 +0100| [e5567f2f6982e765c6d477b2cb6b8f9f6a4d77ab] | 
committer: Michael Niedermayer

avcodec/aacdec_template: Check id_map

Fixes index out of bounds error
Fixes: aac_index_out_of_bounds.wmv

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 590863876d1478547640304a31c15809c3618090)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e5567f2f6982e765c6d477b2cb6b8f9f6a4d77ab
---

 libavcodec/aacdec_template.c |4 
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c
index fb1ce2c..ec8264e 100644
--- a/libavcodec/aacdec_template.c
+++ b/libavcodec/aacdec_template.c
@@ -449,6 +449,10 @@ static int output_configure(AACContext *ac,
 int type = layout_map[i][0];
 int id =   layout_map[i][1];
 id_map[type][id] = type_counts[type]++;
+if (id_map[type][id] >= MAX_ELEM_ID) {
+avpriv_request_sample(ac->avctx, "Remapped id too large\n");
+return AVERROR_PATCHWELCOME;
+}
 }
 // Try to sniff a reasonable channel order, otherwise output the
 // channels in the order the PCE declared them.

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avfilter/vf_scale: set proper out frame color range

[Thomas Mundt]

ffmpeg | branch: release/2.8 | Thomas Mundt  | Thu Dec 31 
00:01:21 2015 +0100| [3fb97a01ce7423352545858c6072d1d3b63c6501] | committer: 
Michael Niedermayer

avfilter/vf_scale: set proper out frame color range

Prevents that following scalers in the filter chain will do unintentional color 
range conversions.
Fixes Ticket #5096

Signed-off-by: Thomas Mundt 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 73ce8162f3499cf0e86d1d80dea53324bd62bcb3)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3fb97a01ce7423352545858c6072d1d3b63c6501
---

 libavfilter/vf_scale.c |2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
index a40b392..8780be4 100644
--- a/libavfilter/vf_scale.c
+++ b/libavfilter/vf_scale.c
@@ -565,6 +565,8 @@ static int filter_frame(AVFilterLink *link, AVFrame *in)
 sws_setColorspaceDetails(scale->isws[1], inv_table, in_full,
  table, out_full,
  brightness, contrast, saturation);
+
+av_frame_set_color_range(out, out_full ? AVCOL_RANGE_JPEG : 
AVCOL_RANGE_MPEG);
 }
 
 av_reduce(&out->sample_aspect_ratio.num, &out->sample_aspect_ratio.den,

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Fix intermediate format for cascaded alpha downscaling

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Thu Dec 24 21:46:15 2015 +0100| [d41b91ba33a52f8deac4d2e35b698b360de5666c] | 
committer: Michael Niedermayer

swscale/utils: Fix intermediate format for cascaded alpha downscaling

Fixes Ticket4926

Signed-off-by: Michael Niedermayer 
(cherry picked from commit b83d8be6bff7d645469a623aee0b380541da15cf)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d41b91ba33a52f8deac4d2e35b698b360de5666c
---

 libswscale/utils.c |3 +++
 1 file changed, 3 insertions(+)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index 93cbad7..cc6402d 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -1598,6 +1598,9 @@ fail: // FIXME replace things by appropriate error codes
 int tmpH = sqrt(srcH * (int64_t)dstH);
 enum AVPixelFormat tmpFormat = AV_PIX_FMT_YUV420P;
 
+if (isALPHA(srcFormat))
+tmpFormat = AV_PIX_FMT_YUVA420P;
+
 if (srcW*(int64_t)srcH <= 4LL*dstW*dstH)
 return AVERROR(EINVAL);
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] Update for 2.7.5

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Fri Jan 15 16:29:16 2016 +0100| [99f3f5a8d595e546c3944f500753c5b2053913a4] | 
committer: Michael Niedermayer

Update for 2.7.5

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=99f3f5a8d595e546c3944f500753c5b2053913a4
---

 Changelog|   29 +
 RELEASE  |2 +-
 doc/Doxyfile |2 +-
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/Changelog b/Changelog
index 0935c1a..990a348 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,35 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+version 2.7.5
+- configure: bump copyright year to 2016
+- avformat/hls: Even stricter URL checks
+- avformat/hls: More strict url checks
+- swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls
+- swscale/yuv2rgb: Increase YUV2RGB table headroom
+- swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out
+- avformat/hls: forbid all protocols except http(s) & file
+- avformat/aviobuf: Fix end check in put_str16()
+- avformat/asfenc: Check pts
+- avcodec/mpeg4video: Check time_incr
+- avcodec/wavpackenc: Check the number of channels
+- avcodec/wavpackenc: Headers are per channel
+- avcodec/aacdec_template: Check id_map
+- avcodec/dvdec: Fix "left shift of negative value -254"
+- avcodec/mjpegdec: Fix negative shift
+- avcodec/mss2: Check for repeat overflow
+- avformat: Add integer fps from 31 to 60 to get_std_framerate()
+- avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range
+- avfilter/vf_scale: set proper out frame color range
+- avcodec/motion_est: Fix mv_penalty table size
+- avcodec/h264_slice: Fix integer overflow in implicit weight computation
+- swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny 
dimensions
+- avcodec/put_bits: Always check buffer end before writing
+- mjpegdec: extend check for incompatible values of s->rgb and s->ls
+- swscale/utils: Fix intermediate format for cascaded alpha downscaling
+- x86/float_dsp: zero extend offset from ff_scalarproduct_float_sse
+- avfilter/vf_zoompan: do not free frame we pushed to lavfi
+
 
 version 2.7.4
 - nuv: sanitize negative fps rate
diff --git a/RELEASE b/RELEASE
index a4dd9db..a603bb5 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1 +1 @@
-2.7.4
+2.7.5
diff --git a/doc/Doxyfile b/doc/Doxyfile
index 7e7e091..1b8e500 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -31,7 +31,7 @@ PROJECT_NAME   = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
-PROJECT_NUMBER = 2.7.4
+PROJECT_NUMBER = 2.7.5
 
 # With the PROJECT_LOGO tag one can specify a logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/wavpackenc: Headers are per channel

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Mon Jan 11 18:32:32 2016 +0100| [d0fd9bec1f8d7055c5036935d9a8d3a8e4a69566] | 
committer: Michael Niedermayer

avcodec/wavpackenc: Headers are per channel

Fixes: 
1b8b83a53bfa751f01b1daa65a4758db/signal_sigabrt_76ae7cb7_7488_403f71d1a2565b598d01b6cb110fac8f.aiff
Fixes: assertion failure

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 26757b0279b4b93c6066c2151d4d3dbd2ec266bf)

Conflicts:

libavcodec/wavpackenc.c

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d0fd9bec1f8d7055c5036935d9a8d3a8e4a69566
---

 libavcodec/wavpackenc.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/wavpackenc.c b/libavcodec/wavpackenc.c
index 87f1445..b387b36 100644
--- a/libavcodec/wavpackenc.c
+++ b/libavcodec/wavpackenc.c
@@ -2878,7 +2878,7 @@ static int wavpack_encode_frame(AVCodecContext *avctx, 
AVPacket *avpkt,
 }
 
 buf_size = s->block_samples * avctx->channels * 8
- + 200 /* for headers */;
+ + 200 * avctx->channels /* for headers */;
 if ((ret = ff_alloc_packet2(avctx, avpkt, buf_size)) < 0)
 return ret;
 buf = avpkt->data;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/put_bits: Always check buffer end before writing

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Fri Jan  1 02:41:06 2016 +0100| [b65c06ee5efefe96f1dccf65c68174099ba26d7a] | 
committer: Michael Niedermayer

avcodec/put_bits: Always check buffer end before writing

This causes a overall slowdown of 0.1 % (tested with mpeg4 single thread 
encoding of matrixbench at QP=3)

Signed-off-by: Michael Niedermayer 
(cherry picked from commit cccb0ffccc3723acc7aab3a859b24743596dd9c0)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b65c06ee5efefe96f1dccf65c68174099ba26d7a
---

 libavcodec/put_bits.h |   20 ++--
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/libavcodec/put_bits.h b/libavcodec/put_bits.h
index 5b1bc8b..0db8a03 100644
--- a/libavcodec/put_bits.h
+++ b/libavcodec/put_bits.h
@@ -163,9 +163,13 @@ static inline void put_bits(PutBitContext *s, int n, 
unsigned int value)
 #ifdef BITSTREAM_WRITER_LE
 bit_buf |= value << (32 - bit_left);
 if (n >= bit_left) {
-av_assert2(s->buf_ptr+3buf_end);
-AV_WL32(s->buf_ptr, bit_buf);
-s->buf_ptr += 4;
+if (3 < s->buf_end - s->buf_ptr) {
+AV_WL32(s->buf_ptr, bit_buf);
+s->buf_ptr += 4;
+} else {
+av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too 
small\n");
+av_assert2(0);
+}
 bit_buf = value >> bit_left;
 bit_left   += 32;
 }
@@ -177,9 +181,13 @@ static inline void put_bits(PutBitContext *s, int n, 
unsigned int value)
 } else {
 bit_buf   <<= bit_left;
 bit_buf|= value >> (n - bit_left);
-av_assert2(s->buf_ptr+3buf_end);
-AV_WB32(s->buf_ptr, bit_buf);
-s->buf_ptr += 4;
+if (3 < s->buf_end - s->buf_ptr) {
+AV_WB32(s->buf_ptr, bit_buf);
+s->buf_ptr += 4;
+} else {
+av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too 
small\n");
+av_assert2(0);
+}
 bit_left   += 32 - n;
 bit_buf = value;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/wavpackenc: Check the number of channels

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Mon Jan 11 18:58:08 2016 +0100| [858f43043f74278cb8f4f9967a1177348a528ca0] | 
committer: Michael Niedermayer

avcodec/wavpackenc: Check the number of channels

They are stored in a byte, thus more than 255 is not possible

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 59c915a403af32c4ff5126625b0cc7e38f4beff9)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=858f43043f74278cb8f4f9967a1177348a528ca0
---

 libavcodec/wavpackenc.c |5 +
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/wavpackenc.c b/libavcodec/wavpackenc.c
index b387b36..0798fc5 100644
--- a/libavcodec/wavpackenc.c
+++ b/libavcodec/wavpackenc.c
@@ -128,6 +128,11 @@ static av_cold int wavpack_encode_init(AVCodecContext 
*avctx)
 
 s->avctx = avctx;
 
+if (avctx->channels > 255) {
+av_log(avctx, AV_LOG_ERROR, "Too many channels\n", avctx->channels);
+return AVERROR(EINVAL);
+}
+
 if (!avctx->frame_size) {
 int block_samples;
 if (!(avctx->sample_rate & 1))

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/dvdec: Fix "left shift of negative value -254"

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Sun Jan 10 17:43:56 2016 +0100| [3820c6a979cad16ad993580af80b5968b87ea382] | 
committer: Michael Niedermayer

avcodec/dvdec: Fix "left shift of negative value -254"

Fixes: dvdec_left_shift.avi

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 93ac72a98dff592ffc174cfb36a8975dfbf145ae)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3820c6a979cad16ad993580af80b5968b87ea382
---

 libavcodec/dvdec.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/dvdec.c b/libavcodec/dvdec.c
index fbd6bf5..0f9edf0 100644
--- a/libavcodec/dvdec.c
+++ b/libavcodec/dvdec.c
@@ -333,7 +333,7 @@ static int dv_decode_video_segment(AVCodecContext *avctx, 
void *arg)
 dct_mode* 22 * 64 +
 (quant + ff_dv_quant_offset[class1]) * 64];
 }
-dc = dc << 2;
+dc = dc * 4;
 /* convert to unsigned because 128 is not added in the
  * standard IDCT */
 dc   += 1024;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat: Add integer fps from 31 to 60 to get_std_framerate()

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Sat Jan  9 10:49:23 2016 +0100| [2316c3586591f858ad14f586bb30a54700dd266e] | 
committer: Michael Niedermayer

avformat: Add integer fps from 31 to 60 to get_std_framerate()

Fixes Ticket 5106

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 2039b3e7511ef183dae206575114e15b6d99c134)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2316c3586591f858ad14f586bb30a54700dd266e
---

 libavformat/avformat.h |2 +-
 libavformat/utils.c|   10 +++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/libavformat/avformat.h b/libavformat/avformat.h
index fb69852..4b270db 100644
--- a/libavformat/avformat.h
+++ b/libavformat/avformat.h
@@ -968,7 +968,7 @@ typedef struct AVStream {
 /**
  * Stream information used internally by av_find_stream_info()
  */
-#define MAX_STD_TIMEBASES (30*12+7+6)
+#define MAX_STD_TIMEBASES (30*12+30+3+6)
 struct {
 int64_t last_dts;
 int64_t duration_gcd;
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 47d0707..d5e6581 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2832,10 +2832,14 @@ static int get_std_framerate(int i)
 return (i + 1) * 1001;
 i -= 30*12;
 
-if (i < 7)
-return ((const int[]) { 40, 48, 50, 60, 80, 120, 240})[i] * 1001 * 12;
+if (i < 30)
+return (i + 31) * 1001 * 12;
+i -= 30;
 
-i -= 7;
+if (i < 3)
+return ((const int[]) { 80, 120, 240})[i] * 1001 * 12;
+
+i -= 3;
 
 return ((const int[]) { 24, 30, 60, 12, 15, 48 })[i] * 1000 * 12;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/h264_slice: Fix integer overflow in implicit weight computation

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Tue Jan  5 01:06:18 2016 +0100| [5b14f436c6358dc0db599be6a1c635a4135a96a9] | 
committer: Michael Niedermayer

avcodec/h264_slice: Fix integer overflow in implicit weight computation

Fixes mozilla bug 1230423

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7cc01c25727a96eaaa0c177234b626e47c8ea491)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5b14f436c6358dc0db599be6a1c635a4135a96a9
---

 libavcodec/h264_slice.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index f80c469..75ea464 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -778,7 +778,7 @@ static void implicit_weight_table(const H264Context *h, 
H264SliceContext *sl, in
 cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1];
 }
 if (sl->ref_count[0] == 1 && sl->ref_count[1] == 1 && !FRAME_MBAFF(h) 
&&
-sl->ref_list[0][0].poc + sl->ref_list[1][0].poc == 2 * cur_poc) {
+sl->ref_list[0][0].poc + (int64_t)sl->ref_list[1][0].poc == 2 * 
cur_poc) {
 sl->use_weight= 0;
 sl->use_weight_chroma = 0;
 return;
@@ -799,7 +799,7 @@ static void implicit_weight_table(const H264Context *h, 
H264SliceContext *sl, in
 sl->chroma_log2_weight_denom = 5;
 
 for (ref0 = ref_start; ref0 < ref_count0; ref0++) {
-int poc0 = sl->ref_list[0][ref0].poc;
+int64_t poc0 = sl->ref_list[0][ref0].poc;
 for (ref1 = ref_start; ref1 < ref_count1; ref1++) {
 int w = 32;
 if (!sl->ref_list[0][ref0].parent->long_ref && 
!sl->ref_list[1][ref1].parent->long_ref) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avfilter/vf_scale: set proper out frame color range

[Thomas Mundt]

ffmpeg | branch: release/2.7 | Thomas Mundt  | Thu Dec 31 
00:01:21 2015 +0100| [2f6d3459d9085472ddab243eaa1bf47aed3f130f] | committer: 
Michael Niedermayer

avfilter/vf_scale: set proper out frame color range

Prevents that following scalers in the filter chain will do unintentional color 
range conversions.
Fixes Ticket #5096

Signed-off-by: Thomas Mundt 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 73ce8162f3499cf0e86d1d80dea53324bd62bcb3)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2f6d3459d9085472ddab243eaa1bf47aed3f130f
---

 libavfilter/vf_scale.c |2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
index 2a3d008..d5cd2dc 100644
--- a/libavfilter/vf_scale.c
+++ b/libavfilter/vf_scale.c
@@ -526,6 +526,8 @@ static int filter_frame(AVFilterLink *link, AVFrame *in)
 sws_setColorspaceDetails(scale->isws[1], inv_table, in_full,
  table, out_full,
  brightness, contrast, saturation);
+
+av_frame_set_color_range(out, out_full ? AVCOL_RANGE_JPEG : 
AVCOL_RANGE_MPEG);
 }
 
 av_reduce(&out->sample_aspect_ratio.num, &out->sample_aspect_ratio.den,

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny dimensions

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Mon Jan  4 23:22:25 2016 +0100| [d7a13ff23b5ea698e97f6c432349d3eb8b860e14] | 
committer: Michael Niedermayer

swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny 
dimensions

Fixes Ticket4960

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 1edf129cbc897447a289ca8b045853df5df1bab3)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d7a13ff23b5ea698e97f6c432349d3eb8b860e14
---

 libswscale/utils.c |6 ++
 1 file changed, 6 insertions(+)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index cc6402d..66bce60 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -1071,6 +1071,12 @@ av_cold int sws_init_context(SwsContext *c, SwsFilter 
*srcFilter,
srcW, srcH, dstW, dstH);
 return AVERROR(EINVAL);
 }
+if (flags & SWS_FAST_BILINEAR) {
+if (srcW < 8 || dstW < 8) {
+flags ^= SWS_FAST_BILINEAR | SWS_BILINEAR;
+c->flags = flags;
+}
+}
 
 if (!dstFilter)
 dstFilter = &dummyFilter;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Thu Jan  7 00:22:56 2016 +0100| [3dd0d43d8cf7970a141c8f76fa8ec3d81d65be82] | 
committer: Michael Niedermayer

avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range

Fixes out of array read
Fixes: test_case-mdc.264 (b47be15a120979f5a1a945c938cbef33)

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 13f266b50cc7554028d22480b7e4383968e64a63)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3dd0d43d8cf7970a141c8f76fa8ec3d81d65be82
---

 libavcodec/mpegvideo_enc.c |1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index edebc9d..0cf138e 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -317,6 +317,7 @@ av_cold int ff_mpv_encode_init(AVCodecContext *avctx)
 break;
 }
 
+avctx->bits_per_raw_sample = av_clip(avctx->bits_per_raw_sample, 0, 8);
 s->bit_rate = avctx->bit_rate;
 s->width= avctx->width;
 s->height   = avctx->height;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/hls: forbid all protocols except http(s) & file

[Maxim Andreev]

ffmpeg | branch: release/2.7 | Maxim Andreev  | Wed Jan 
13 11:51:12 2016 +0300| [cde38373d134e6cf6a92d900fb2f3ce996e4655c] | committer: 
Michael Niedermayer

avformat/hls: forbid all protocols except http(s) & file

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7145e80b4f78cff5ed5fee04d4c4d53daaa0e077)

Conflicts:

libavformat/hls.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cde38373d134e6cf6a92d900fb2f3ce996e4655c
---

 libavformat/hls.c |   11 +++
 1 file changed, 11 insertions(+)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index bd34329..e7e323b 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -1036,6 +1036,12 @@ static int open_input(HLSContext *c, struct playlist 
*pls, struct segment *seg)
seg->url, seg->url_offset, pls->index);
 
 if (seg->key_type == KEY_NONE) {
+const char *proto_name = avio_find_protocol_name(seg->url);
+if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL)) {
+ret = AVERROR_INVALIDDATA;
+goto cleanup;
+}
+
 ret = ffurl_open(&pls->input, seg->url, AVIO_FLAG_READ,
   &pls->parent->interrupt_callback, &opts);
 
@@ -1043,6 +1049,11 @@ static int open_input(HLSContext *c, struct playlist 
*pls, struct segment *seg)
 char iv[33], key[33], url[MAX_URL_SIZE];
 if (strcmp(seg->key, pls->key_url)) {
 URLContext *uc;
+const char *proto_name = avio_find_protocol_name(seg->key);
+if (!av_strstart(proto_name, "http", NULL) && 
!av_strstart(proto_name, "file", NULL)) {
+ret = AVERROR_INVALIDDATA;
+goto cleanup;
+}
 if (ffurl_open(&uc, seg->key, AVIO_FLAG_READ,
&pls->parent->interrupt_callback, &opts2) == 0) {
 if (ffurl_read_complete(uc, pls->key, sizeof(pls->key))

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] mjpegdec: extend check for incompatible values of s->rgb and s->ls

[Andreas Cadhalpun]

ffmpeg | branch: release/2.7 | Andreas Cadhalpun 
 | Thu Dec 31 16:55:43 2015 +0100| 
[a7a7c6e44c403d64cdd2fd3e8f83b796274fe40e] | committer: Michael Niedermayer

mjpegdec: extend check for incompatible values of s->rgb and s->ls

This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.

In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.

This fixes an out-of-bounds read in ls_decode_line.

Reviewed-by: Michael Niedermayer 
Signed-off-by: Andreas Cadhalpun 
(cherry picked from commit 7ea2db6eafa0a8a9497aab20be2cfc8742a59072)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a7a7c6e44c403d64cdd2fd3e8f83b796274fe40e
---

 libavcodec/mjpegdec.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 48f5ca4..c28f07d 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -628,7 +628,8 @@ unk_pixfmt:
 av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) 
mismatch\n", len);
 }
 
-if (s->rgb && !s->lossless && !s->ls) {
+if ((s->rgb && !s->lossless && !s->ls) ||
+(!s->rgb && s->ls && s->nb_components > 1)) {
 av_log(s->avctx, AV_LOG_ERROR, "Unsupported coding and pixel format 
combination\n");
 return AVERROR_PATCHWELCOME;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/hls: More strict url checks

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Fri Jan 15 13:29:38 2016 +0100| [123d356829d6d72f75c820a184fee3dc7086dde0] | 
committer: Michael Niedermayer

avformat/hls: More strict url checks

No case is known where these are needed

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 6ba42b6482c725a59eb468391544dc0c75b8c6f0)

Conflicts:

libavformat/hls.c

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=123d356829d6d72f75c820a184fee3dc7086dde0
---

 libavformat/hls.c |   26 ++
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index e7e323b..472e226 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -1010,6 +1010,19 @@ static void update_options(char **dest, const char 
*name, void *src)
 av_freep(dest);
 }
 
+static int check_url(const char *url) {
+const char *proto_name = avio_find_protocol_name(url);
+if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL))
+return AVERROR_INVALIDDATA;
+
+if (!strncmp(proto_name, url, strlen(proto_name)) && 
url[strlen(proto_name)] == ':')
+return 0;
+else if (strcmp(proto_name, "file") || !strcmp(url, "file,"))
+return AVERROR_INVALIDDATA;
+
+return 0;
+}
+
 static int open_input(HLSContext *c, struct playlist *pls, struct segment *seg)
 {
 AVDictionary *opts = NULL;
@@ -1036,11 +1049,9 @@ static int open_input(HLSContext *c, struct playlist 
*pls, struct segment *seg)
seg->url, seg->url_offset, pls->index);
 
 if (seg->key_type == KEY_NONE) {
-const char *proto_name = avio_find_protocol_name(seg->url);
-if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL)) {
-ret = AVERROR_INVALIDDATA;
+ret = check_url(seg->url);
+if (ret < 0)
 goto cleanup;
-}
 
 ret = ffurl_open(&pls->input, seg->url, AVIO_FLAG_READ,
   &pls->parent->interrupt_callback, &opts);
@@ -1049,11 +1060,10 @@ static int open_input(HLSContext *c, struct playlist 
*pls, struct segment *seg)
 char iv[33], key[33], url[MAX_URL_SIZE];
 if (strcmp(seg->key, pls->key_url)) {
 URLContext *uc;
-const char *proto_name = avio_find_protocol_name(seg->key);
-if (!av_strstart(proto_name, "http", NULL) && 
!av_strstart(proto_name, "file", NULL)) {
-ret = AVERROR_INVALIDDATA;
+ret = check_url(seg->key);
+if (ret < 0)
 goto cleanup;
-}
+
 if (ffurl_open(&uc, seg->key, AVIO_FLAG_READ,
&pls->parent->interrupt_callback, &opts2) == 0) {
 if (ffurl_read_complete(uc, pls->key, sizeof(pls->key))

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/motion_est: Fix mv_penalty table size

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Tue Jan  5 14:41:04 2016 +0100| [2c58d734132fba3773629d1ce347af2c931267a1] | 
committer: Michael Niedermayer

avcodec/motion_est: Fix mv_penalty table size

Fixes out of array read

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5b4da8a38a5ed211df9504c85ce401c30af86b97)

Conflicts:

libavcodec/motion_est.h

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2c58d734132fba3773629d1ce347af2c931267a1
---

 libavcodec/ituh263enc.c|6 +++---
 libavcodec/motion_est.c|   16 
 libavcodec/motion_est.h|3 ++-
 libavcodec/mpeg12enc.c |6 +++---
 libavcodec/mpegvideo_enc.c |2 +-
 libavcodec/snowenc.c   |2 +-
 6 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/libavcodec/ituh263enc.c b/libavcodec/ituh263enc.c
index 3ea2d19..0073560 100644
--- a/libavcodec/ituh263enc.c
+++ b/libavcodec/ituh263enc.c
@@ -44,7 +44,7 @@
 /**
  * Table of number of bits a motion vector component needs.
  */
-static uint8_t mv_penalty[MAX_FCODE+1][MAX_MV*2+1];
+static uint8_t mv_penalty[MAX_FCODE+1][MAX_DMV*2+1];
 
 /**
  * Minimal fcode that a motion vector component would need.
@@ -677,7 +677,7 @@ static av_cold void 
init_mv_penalty_and_fcode(MpegEncContext *s)
 int mv;
 
 for(f_code=1; f_code<=MAX_FCODE; f_code++){
-for(mv=-MAX_MV; mv<=MAX_MV; mv++){
+for(mv=-MAX_DMV; mv<=MAX_DMV; mv++){
 int len;
 
 if(mv==0) len= ff_mvtab[0][1];
@@ -698,7 +698,7 @@ static av_cold void 
init_mv_penalty_and_fcode(MpegEncContext *s)
 }
 }
 
-mv_penalty[f_code][mv+MAX_MV]= len;
+mv_penalty[f_code][mv+MAX_DMV]= len;
 }
 }
 
diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c
index 96aa9ac..25cf812 100644
--- a/libavcodec/motion_est.c
+++ b/libavcodec/motion_est.c
@@ -908,7 +908,7 @@ void ff_estimate_p_frame_motion(MpegEncContext * s,
 c->penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_cmp);
 c->sub_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_sub_cmp);
 c->mb_penalty_factor = get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->mb_cmp);
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 
 get_limits(s, 16*mb_x, 16*mb_y);
 c->skip=0;
@@ -1084,7 +1084,7 @@ int ff_pre_estimate_p_frame_motion(MpegEncContext * s,
 av_assert0(s->quarter_sample==0 || s->quarter_sample==1);
 
 c->pre_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_pre_cmp);
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 
 get_limits(s, 16*mb_x, 16*mb_y);
 c->skip=0;
@@ -1133,7 +1133,7 @@ static int estimate_motion_b(MpegEncContext *s, int mb_x, 
int mb_y,
 const int shift= 1+s->quarter_sample;
 const int mot_stride = s->mb_stride;
 const int mot_xy = mb_y*mot_stride + mb_x;
-uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_MV;
+uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_DMV;
 int mv_scale;
 
 c->penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_cmp);
@@ -1207,8 +1207,8 @@ static inline int check_bidir_mv(MpegEncContext * s,
 //FIXME better f_code prediction (max mv & distance)
 //FIXME pointers
 MotionEstContext * const c= &s->me;
-uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_MV; // f_code 
of the prev frame
-uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_MV; // f_code 
of the prev frame
+uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_DMV; // 
f_code of the prev frame
+uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_DMV; // 
f_code of the prev frame
 int stride= c->stride;
 uint8_t *dest_y = c->scratchpad;
 uint8_t *ptr;
@@ -1421,7 +1421,7 @@ static inline int direct_search(MpegEncContext * s, int 
mb_x, int mb_y)
 int mx, my, xmin, xmax, ymin, ymax;
 int16_t (*mv_table)[2]= s->b_direct_mv_table;
 
-c->current_mv_penalty= c->mv_penalty[1] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[1] + MAX_DMV;
 ymin= xmin=(-32)>>shift;
 ymax= xmax=   31>>shift;
 
@@ -1557,11 +1557,11 @@ void ff_estimate_b_frame_motion(MpegEncContext * s,
 if (s->avctx->flags & CODEC_FLAG_INTERLACED_ME) {
 //FIXME mb type penalty
 c->skip=0;
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 fimin= interlaced_search(s, 0,
  s->b_field_mv_table[0], 
s->b_field_select_table[0],
  s->b_forw_mv_table[xy][0], 
s->b_forw_mv_table[xy][1], 0);
-c->current_mv_penalty= c->mv_penalty[s->b_code] + MAX_MV;
+ 

[FFmpeg-cvslog] avformat/hls: Even stricter URL checks

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Fri Jan 15 15:29:22 2016 +0100| [e681e92d2c8a46feb11ce1f36ff82c16e37cfe11] | 
committer: Michael Niedermayer

avformat/hls: Even stricter URL checks

This fixes a null pointer dereference at least

Signed-off-by: Michael Niedermayer 
(cherry picked from commit cfda1bea4c18ec1edbc11ecc465f788b02851488)

Conflicts:

libavformat/hls.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e681e92d2c8a46feb11ce1f36ff82c16e37cfe11
---

 libavformat/hls.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 472e226..a6bf692 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -1012,12 +1012,16 @@ static void update_options(char **dest, const char 
*name, void *src)
 
 static int check_url(const char *url) {
 const char *proto_name = avio_find_protocol_name(url);
+
+if (!proto_name)
+return AVERROR_INVALIDDATA;
+
 if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL))
 return AVERROR_INVALIDDATA;
 
 if (!strncmp(proto_name, url, strlen(proto_name)) && 
url[strlen(proto_name)] == ':')
 return 0;
-else if (strcmp(proto_name, "file") || !strcmp(url, "file,"))
+else if (strcmp(proto_name, "file") || !strncmp(url, "file,", 5))
 return AVERROR_INVALIDDATA;
 
 return 0;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mjpegdec: Fix negative shift

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Sun Jan 10 15:52:09 2016 +0100| [7cfea0d41cb05f099c2456f7b0797382adda7756] | 
committer: Michael Niedermayer

avcodec/mjpegdec: Fix negative shift

Fixes: mjpeg_left_shift.avi

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit d86d7b2486cd5c31db8e820d8a89554abf19567e)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7cfea0d41cb05f099c2456f7b0797382adda7756
---

 libavcodec/mjpegdec.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index c28f07d..2e0a568 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -994,7 +994,7 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int 
nb_components, int p
 return -1;
 
 left[i] = buffer[mb_x][i] =
-mask & (pred + (dc << point_transform));
+mask & (pred + (dc * (1 << point_transform)));
 }
 
 if (s->restart_interval && !--s->restart_count) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/asfenc: Check pts

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Tue Jan 12 18:49:20 2016 +0100| [f1cdd93517c8c7f2ed5956962c7e41528c063b1e] | 
committer: Michael Niedermayer

avformat/asfenc: Check pts

Fixes integer overflow
Fixes: 
0063df8be3aaa30dd6d76f59c8f818c8/signal_sigsegv_7b7b59_3634_bf418b6822bbfa68734411d96b667be3.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7c0b84d89911b2035161f5ef51aafbfcc84aa9e2)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f1cdd93517c8c7f2ed5956962c7e41528c063b1e
---

 libavformat/asfenc.c |5 +
 1 file changed, 5 insertions(+)

diff --git a/libavformat/asfenc.c b/libavformat/asfenc.c
index 015c731..6b4e794 100644
--- a/libavformat/asfenc.c
+++ b/libavformat/asfenc.c
@@ -927,6 +927,11 @@ static int asf_write_packet(AVFormatContext *s, AVPacket 
*pkt)
 
 pts = (pkt->pts != AV_NOPTS_VALUE) ? pkt->pts : pkt->dts;
 av_assert0(pts != AV_NOPTS_VALUE);
+if (   pts < - PREROLL_TIME
+|| pts > (INT_MAX-3)/1LL * ASF_INDEXED_INTERVAL - PREROLL_TIME) {
+av_log(s, AV_LOG_ERROR, "input pts %"PRId64" is invalid\n", pts);
+return AVERROR(EINVAL);
+}
 pts *= 1;
 asf->duration = FFMAX(asf->duration, pts + pkt->duration * 1);
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Thu Jan 14 15:11:48 2016 +0100| [119659b759a6840d7121340313d06cdc83215d7b] | 
committer: Michael Niedermayer

swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls

This avoids running various table inits unnecessarily

Signed-off-by: Michael Niedermayer 
(cherry picked from commit cc538e9dbd14b61d1ac8c9fa687d83289673fe90)

Conflicts:

libswscale/utils.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=119659b759a6840d7121340313d06cdc83215d7b
---

 libswscale/utils.c |   22 ++
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index 66bce60..8dcc116 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -829,8 +829,6 @@ int sws_setColorspaceDetails(struct SwsContext *c, const 
int inv_table[4],
 const AVPixFmtDescriptor *desc_dst;
 const AVPixFmtDescriptor *desc_src;
 int need_reinit = 0;
-memmove(c->srcColorspaceTable, inv_table, sizeof(int) * 4);
-memmove(c->dstColorspaceTable, table, sizeof(int) * 4);
 
 handle_formats(c);
 desc_dst = av_pix_fmt_desc_get(c->dstFormat);
@@ -841,11 +839,24 @@ int sws_setColorspaceDetails(struct SwsContext *c, const 
int inv_table[4],
 if(!isYUV(c->srcFormat) && !isGray(c->srcFormat))
 srcRange = 0;
 
+if (c->srcRange != srcRange ||
+c->dstRange != dstRange ||
+c->brightness != brightness ||
+c->contrast   != contrast ||
+c->saturation != saturation ||
+memcmp(c->srcColorspaceTable, inv_table, sizeof(int) * 4) ||
+memcmp(c->dstColorspaceTable, table, sizeof(int) * 4)
+)
+need_reinit = 1;
+
+memmove(c->srcColorspaceTable, inv_table, sizeof(int) * 4);
+memmove(c->dstColorspaceTable, table, sizeof(int) * 4);
+
+
+
 c->brightness = brightness;
 c->contrast   = contrast;
 c->saturation = saturation;
-if (c->srcRange != srcRange || c->dstRange != dstRange)
-need_reinit = 1;
 c->srcRange   = srcRange;
 c->dstRange   = dstRange;
 
@@ -860,6 +871,9 @@ int sws_setColorspaceDetails(struct SwsContext *c, const 
int inv_table[4],
 c->dstFormatBpp = av_get_bits_per_pixel(desc_dst);
 c->srcFormatBpp = av_get_bits_per_pixel(desc_src);
 
+if (!need_reinit)
+return 0;
+
 if (!isYUV(c->dstFormat) && !isGray(c->dstFormat)) {
 ff_yuv2rgb_c_init_tables(c, inv_table, srcRange, brightness,
  contrast, saturation);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/aviobuf: Fix end check in put_str16()

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Wed Jan 13 02:31:59 2016 +0100| [a2b234b917bf15fd0f60c131b801f0f84bf14ef4] | 
committer: Michael Niedermayer

avformat/aviobuf: Fix end check in put_str16()

Fixes out of array read
Fixes: 
03c406ec9530e594a074ce2979f8a1f0/asan_heap-oob_7dec26_4664_37c52495b2870a2eaac65f53958e76c1.flac

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 115fb6d03ef6310732b42258d8c3cd1839cfb74b)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a2b234b917bf15fd0f60c131b801f0f84bf14ef4
---

 libavformat/aviobuf.c |2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 392b369..5dda200 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -359,6 +359,8 @@ static inline int put_str16(AVIOContext *s, const char 
*str, const int be)
 invalid:
 av_log(s, AV_LOG_ERROR, "Invaid UTF8 sequence in avio_put_str16%s\n", 
be ? "be" : "le");
 err = AVERROR(EINVAL);
+if (!*(q-1))
+break;
 }
 if (be)
 avio_wb16(s, 0);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mpeg4video: Check time_incr

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Tue Jan 12 03:03:01 2016 +0100| [0e3c36518d9920aebee0cfaf6a54d81ae5180666] | 
committer: Michael Niedermayer

avcodec/mpeg4video: Check time_incr

Fixes assertion failure
Fixes out of memory access

Fixes: test_casex.ivf

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7c97946d6131b31340954a3f603b6bf92590a9a5)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0e3c36518d9920aebee0cfaf6a54d81ae5180666
---

 libavcodec/mpeg4video.h|2 +-
 libavcodec/mpeg4videoenc.c |   10 +-
 libavcodec/mpegvideo_enc.c |8 +---
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/libavcodec/mpeg4video.h b/libavcodec/mpeg4video.h
index 49bc13f..5998c71 100644
--- a/libavcodec/mpeg4video.h
+++ b/libavcodec/mpeg4video.h
@@ -140,7 +140,7 @@ void ff_mpeg4_encode_mb(MpegEncContext *s,
 void ff_mpeg4_pred_ac(MpegEncContext *s, int16_t *block, int n,
   int dir);
 void ff_set_mpeg4_time(MpegEncContext *s);
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);
 
 int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb);
 void ff_mpeg4_encode_video_packet_header(MpegEncContext *s);
diff --git a/libavcodec/mpeg4videoenc.c b/libavcodec/mpeg4videoenc.c
index bca294e..f565e3a 100644
--- a/libavcodec/mpeg4videoenc.c
+++ b/libavcodec/mpeg4videoenc.c
@@ -1086,7 +1086,7 @@ static void mpeg4_encode_vol_header(MpegEncContext *s,
 }
 
 /* write mpeg4 VOP header */
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
 {
 int time_incr;
 int time_div, time_mod;
@@ -1112,6 +1112,12 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, 
int picture_number)
 time_mod  = FFUMOD(s->time, s->avctx->time_base.den);
 time_incr = time_div - s->last_time_base;
 av_assert0(time_incr >= 0);
+
+// This limits the frame duration to max 1 hour
+if (time_incr > 3600) {
+av_log(s->avctx, AV_LOG_ERROR, "time_incr %d too large\n", time_incr);
+return AVERROR(EINVAL);
+}
 while (time_incr--)
 put_bits(&s->pb, 1, 1);
 
@@ -1137,6 +1143,8 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, 
int picture_number)
 put_bits(&s->pb, 3, s->f_code);  /* fcode_for */
 if (s->pict_type == AV_PICTURE_TYPE_B)
 put_bits(&s->pb, 3, s->b_code);  /* fcode_back */
+
+return 0;
 }
 
 static av_cold void init_uni_dc_tab(void)
diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index 0cf138e..c4e4482 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -3723,9 +3723,11 @@ static int encode_picture(MpegEncContext *s, int 
picture_number)
 ff_wmv2_encode_picture_header(s, picture_number);
 else if (CONFIG_MSMPEG4_ENCODER && s->msmpeg4_version)
 ff_msmpeg4_encode_picture_header(s, picture_number);
-else if (CONFIG_MPEG4_ENCODER && s->h263_pred)
-ff_mpeg4_encode_picture_header(s, picture_number);
-else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
+else if (CONFIG_MPEG4_ENCODER && s->h263_pred) {
+ret = ff_mpeg4_encode_picture_header(s, picture_number);
+if (ret < 0)
+return ret;
+} else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
 ret = ff_rv10_encode_picture_header(s, picture_number);
 if (ret < 0)
 return ret;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Thu Jan 14 12:36:41 2016 +0100| [f5060bce3108acf85b2e5da22d8d9e98858de43a] | 
committer: Michael Niedermayer

swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5e5f82a28737fba4402259617500911cc37e3674)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f5060bce3108acf85b2e5da22d8d9e98858de43a
---

 libswscale/swscale_internal.h |1 +
 libswscale/yuv2rgb.c  |   89 +
 2 files changed, 46 insertions(+), 44 deletions(-)

diff --git a/libswscale/swscale_internal.h b/libswscale/swscale_internal.h
index 2299aa5..fa119d3 100644
--- a/libswscale/swscale_internal.h
+++ b/libswscale/swscale_internal.h
@@ -40,6 +40,7 @@
 #define STR(s) AV_TOSTRING(s) // AV_STRINGIFY is too long
 
 #define YUVRGB_TABLE_HEADROOM 256
+#define YUVRGB_TABLE_LUMA_HEADROOM 0
 
 #define MAX_FILTER_SIZE SWS_MAX_FILTER_SIZE
 
diff --git a/libswscale/yuv2rgb.c b/libswscale/yuv2rgb.c
index 1d682ba..e81f3f6 100644
--- a/libswscale/yuv2rgb.c
+++ b/libswscale/yuv2rgb.c
@@ -776,7 +776,8 @@ av_cold int ff_yuv2rgb_c_init_tables(SwsContext *c, const 
int inv_table[4],
 uint16_t *y_table16;
 uint32_t *y_table32;
 int i, base, rbase, gbase, bbase, av_uninit(abase), needAlpha;
-const int yoffs = fullRange ? 384 : 326;
+const int yoffs = (fullRange ? 384 : 326) + YUVRGB_TABLE_LUMA_HEADROOM;
+const int table_plane_size = 1024 + 2*YUVRGB_TABLE_LUMA_HEADROOM;
 
 int64_t crv =  inv_table[0];
 int64_t cbu =  inv_table[1];
@@ -833,10 +834,10 @@ av_cold int ff_yuv2rgb_c_init_tables(SwsContext *c, const 
int inv_table[4],
 return AVERROR(ENOMEM);
 switch (bpp) {
 case 1:
-ALLOC_YUV_TABLE(1024);
+ALLOC_YUV_TABLE(table_plane_size);
 y_table = c->yuvTable;
-yb = -(384 << 16) - oy;
-for (i = 0; i < 1024 - 110; i++) {
+yb = -(384 << 16) - YUVRGB_TABLE_LUMA_HEADROOM*cy - oy;
+for (i = 0; i < table_plane_size - 110; i++) {
 y_table[i + 110]  = av_clip_uint8((yb + 0x8000) >> 16) >> 7;
 yb   += cy;
 }
@@ -848,60 +849,60 @@ av_cold int ff_yuv2rgb_c_init_tables(SwsContext *c, const 
int inv_table[4],
 rbase   = isRgb ? 3 : 0;
 gbase   = 1;
 bbase   = isRgb ? 0 : 3;
-ALLOC_YUV_TABLE(1024 * 3);
+ALLOC_YUV_TABLE(table_plane_size * 3);
 y_table = c->yuvTable;
-yb = -(384 << 16) - oy;
-for (i = 0; i < 1024 - 110; i++) {
+yb = -(384 << 16) - YUVRGB_TABLE_LUMA_HEADROOM*cy - oy;
+for (i = 0; i < table_plane_size - 110; i++) {
 int yval= av_clip_uint8((yb + 0x8000) >> 16);
 y_table[i + 110]= (yval >> 7)<< rbase;
-y_table[i +  37 + 1024] = ((yval + 43) / 85) << gbase;
-y_table[i + 110 + 2048] = (yval >> 7)<< bbase;
+y_table[i +  37 +   table_plane_size] = ((yval + 43) / 85) << 
gbase;
+y_table[i + 110 + 2*table_plane_size] = (yval >> 7)<< 
bbase;
 yb += cy;
 }
 fill_table(c->table_rV, 1, crv, y_table + yoffs);
-fill_table(c->table_gU, 1, cgu, y_table + yoffs + 1024);
-fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2048);
+fill_table(c->table_gU, 1, cgu, y_table + yoffs +   table_plane_size);
+fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2*table_plane_size);
 fill_gv_table(c->table_gV, 1, cgv);
 break;
 case 8:
 rbase   = isRgb ? 5 : 0;
 gbase   = isRgb ? 2 : 3;
 bbase   = isRgb ? 0 : 6;
-ALLOC_YUV_TABLE(1024 * 3);
+ALLOC_YUV_TABLE(table_plane_size * 3);
 y_table = c->yuvTable;
-yb = -(384 << 16) - oy;
-for (i = 0; i < 1024 - 38; i++) {
+yb = -(384 << 16) - YUVRGB_TABLE_LUMA_HEADROOM*cy - oy;
+for (i = 0; i < table_plane_size - 38; i++) {
 int yval   = av_clip_uint8((yb + 0x8000) >> 16);
 y_table[i + 16]= ((yval + 18) / 36) << rbase;
-y_table[i + 16 + 1024] = ((yval + 18) / 36) << gbase;
-y_table[i + 37 + 2048] = ((yval + 43) / 85) << bbase;
+y_table[i + 16 +   table_plane_size] = ((yval + 18) / 36) << gbase;
+y_table[i + 37 + 2*table_plane_size] = ((yval + 43) / 85) << bbase;
 yb += cy;
 }
 fill_table(c->table_rV, 1, crv, y_table + yoffs);
-fill_table(c->table_gU, 1, cgu, y_table + yoffs + 1024);
-fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2048);
+fill_table(c->table_gU, 1, cgu, y_table + yoffs +   table_plane_size);
+fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2*table_plane_size);
 fill_gv_table(c->table_gV, 1, cgv);
 break;
 case 12:
 

[FFmpeg-cvslog] avcodec/aacdec_template: Check id_map

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Sun Jan 10 19:29:39 2016 +0100| [d755045e7801a4ceb35027ab9bf069f7e6ecc221] | 
committer: Michael Niedermayer

avcodec/aacdec_template: Check id_map

Fixes index out of bounds error
Fixes: aac_index_out_of_bounds.wmv

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 590863876d1478547640304a31c15809c3618090)

Conflicts:

libavcodec/aacdec_template.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d755045e7801a4ceb35027ab9bf069f7e6ecc221
---

 libavcodec/aacdec.c |4 
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
index 9fe1133..8030827 100644
--- a/libavcodec/aacdec.c
+++ b/libavcodec/aacdec.c
@@ -473,6 +473,10 @@ static int output_configure(AACContext *ac,
 int type = layout_map[i][0];
 int id =   layout_map[i][1];
 id_map[type][id] = type_counts[type]++;
+if (id_map[type][id] >= MAX_ELEM_ID) {
+avpriv_request_sample(ac->avctx, "Remapped id too large\n");
+return AVERROR_PATCHWELCOME;
+}
 }
 // Try to sniff a reasonable channel order, otherwise output the
 // channels in the order the PCE declared them.

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/yuv2rgb: Increase YUV2RGB table headroom

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Thu Jan 14 03:05:11 2016 +0100| [f0cc6f74fcfed14b7ff7b3fdff66866db8447d73] | 
committer: Michael Niedermayer

swscale/yuv2rgb: Increase YUV2RGB table headroom

This makes SWS more robust
Fixes: 
07650a772d98aa63b0fed6370dc89037/asan_heap-oob_27ddeaf_2657_2c81ff264dee5d9712cb3251fb9c3bbb.264
Fixes: out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 8f3a9a8c278acf886f70a1d743bc07b6f9c7b51a)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f0cc6f74fcfed14b7ff7b3fdff66866db8447d73
---

 libswscale/swscale_internal.h |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libswscale/swscale_internal.h b/libswscale/swscale_internal.h
index fa119d3..217e307 100644
--- a/libswscale/swscale_internal.h
+++ b/libswscale/swscale_internal.h
@@ -39,8 +39,8 @@
 
 #define STR(s) AV_TOSTRING(s) // AV_STRINGIFY is too long
 
-#define YUVRGB_TABLE_HEADROOM 256
-#define YUVRGB_TABLE_LUMA_HEADROOM 0
+#define YUVRGB_TABLE_HEADROOM 512
+#define YUVRGB_TABLE_LUMA_HEADROOM 512
 
 #define MAX_FILTER_SIZE SWS_MAX_FILTER_SIZE
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mss2: Check for repeat overflow

[Michael Niedermayer]

ffmpeg | branch: release/2.7 | Michael Niedermayer  | 
Sun Jan 10 12:19:48 2016 +0100| [8c08247990ca5246bf8f2c48fc2f3fd8a043f326] | 
committer: Michael Niedermayer

avcodec/mss2: Check for repeat overflow

Fixes: mss2_left_shift.wmv

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit e273dade78943e22b71d0ddb67cd0d737fc26edf)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8c08247990ca5246bf8f2c48fc2f3fd8a043f326
---

 libavcodec/mss2.c |7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c
index f57685d..1af2cd0 100644
--- a/libavcodec/mss2.c
+++ b/libavcodec/mss2.c
@@ -210,8 +210,13 @@ static int decode_555(GetByteContext *gB, uint16_t *dst, 
int stride,
 last_symbol = b << 8 | bytestream2_get_byte(gB);
 else if (b > 129) {
 repeat = 0;
-while (b-- > 130)
+while (b-- > 130) {
+if (repeat >= (INT_MAX >> 8) - 1) {
+av_log(NULL, AV_LOG_ERROR, "repeat overflow\n");
+return AVERROR_INVALIDDATA;
+}
 repeat = (repeat << 8) + bytestream2_get_byte(gB) + 1;
+}
 if (last_symbol == -2) {
 int skip = FFMIN((unsigned)repeat, dst + w - p);
 repeat -= skip;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] configure: bump copyright year to 2016

[James Almer]

ffmpeg | branch: release/2.7 | James Almer  | Sat Jan  2 
16:28:31 2016 -0300| [d4a7e8979338865dea5eed1615d133dc54031700] | committer: 
Michael Niedermayer

configure: bump copyright year to 2016

Signed-off-by: James Almer 
(cherry picked from commit 78129978f02f27d76ecaf2cd1a7bf7a47253fdab)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d4a7e8979338865dea5eed1615d133dc54031700
---

 configure |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure b/configure
index cf124b7..66eb54a 100755
--- a/configure
+++ b/configure
@@ -5950,7 +5950,7 @@ cat > $TMPH 

[FFmpeg-cvslog] avfilter/vaf_spectrumsynth: Fix mixed declaration and statment

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer  | Fri 
Jan 15 16:51:54 2016 +0100| [48f5244df7ea5f764a63402147235cfa5355d388] | 
committer: Michael Niedermayer

avfilter/vaf_spectrumsynth: Fix mixed declaration and statment

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=48f5244df7ea5f764a63402147235cfa5355d388
---

 libavfilter/vaf_spectrumsynth.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavfilter/vaf_spectrumsynth.c b/libavfilter/vaf_spectrumsynth.c
index 76788e1..ab9a69b 100644
--- a/libavfilter/vaf_spectrumsynth.c
+++ b/libavfilter/vaf_spectrumsynth.c
@@ -392,6 +392,7 @@ static int try_push_frame(AVFilterContext *ctx, int x)
 
 if (ch == s->channels - 1) {
 float *dst;
+int c;
 
 out = ff_get_audio_buffer(outlink, s->win_size);
 if (!out) {
@@ -402,7 +403,7 @@ static int try_push_frame(AVFilterContext *ctx, int x)
 
 out->pts = s->pts;
 s->pts += s->win_size;
-for (int c = 0; c < s->channels; c++) {
+for (c = 0; c < s->channels; c++) {
 dst = (float *)out->extended_data[c];
 buf = (float *)s->buffer->extended_data[c];
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/x86/fmtconvert: Add emms to int32_to_float_fmul_array8_sse()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer  | Fri 
Jan 15 17:08:37 2016 +0100| [da6f34516b60aea0ea2e4864976706d11ef2b687] | 
committer: Michael Niedermayer

avcodec/x86/fmtconvert: Add emms to int32_to_float_fmul_array8_sse()

this should fix checkasm on x86_64-archlinux-gcc-valgrind

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=da6f34516b60aea0ea2e4864976706d11ef2b687
---

 libavcodec/x86/fmtconvert.asm |9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libavcodec/x86/fmtconvert.asm b/libavcodec/x86/fmtconvert.asm
index b4220e2..8f62a0a 100644
--- a/libavcodec/x86/fmtconvert.asm
+++ b/libavcodec/x86/fmtconvert.asm
@@ -107,7 +107,14 @@ cglobal int32_to_float_fmul_array8, 5, 5, 5, c, dst, src, 
mul, len
 add mulq, 4
 add lenq, 32
 jl .loop
-REP_RET
+%if notcpuflag(sse2)
+;; cvtpi2ps switches to MMX even if the source is a memory location
+;; possible an error in documentation since every tested CPU disagrees with
+;; that. Use emms anyway since the vast majority of machines will use the
+;; SSE2 variant
+emms
+%endif
+RET
 %endmacro
 
 INIT_XMM sse

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny dimensions

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Mon Jan  4 23:22:25 2016 +0100| [dbe194002a798b0866eeabd21c9f788d96b42d78] | 
committer: Michael Niedermayer

swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny 
dimensions

Fixes Ticket4960

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 1edf129cbc897447a289ca8b045853df5df1bab3)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dbe194002a798b0866eeabd21c9f788d96b42d78
---

 libswscale/utils.c |6 ++
 1 file changed, 6 insertions(+)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index cb78c59..5380f3f 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -1052,6 +1052,12 @@ av_cold int sws_init_context(SwsContext *c, SwsFilter 
*srcFilter,
srcW, srcH, dstW, dstH);
 return AVERROR(EINVAL);
 }
+if (flags & SWS_FAST_BILINEAR) {
+if (srcW < 8 || dstW < 8) {
+flags ^= SWS_FAST_BILINEAR | SWS_BILINEAR;
+c->flags = flags;
+}
+}
 
 if (!dstFilter)
 dstFilter = &dummyFilter;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/put_bits: Always check buffer end before writing

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Fri Jan  1 02:41:06 2016 +0100| [9c4d8343bb30f10557fc6fae3b98ee2cfc4c926c] | 
committer: Michael Niedermayer

avcodec/put_bits: Always check buffer end before writing

This causes a overall slowdown of 0.1 % (tested with mpeg4 single thread 
encoding of matrixbench at QP=3)

Signed-off-by: Michael Niedermayer 
(cherry picked from commit cccb0ffccc3723acc7aab3a859b24743596dd9c0)

Conflicts:

libavcodec/put_bits.h

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9c4d8343bb30f10557fc6fae3b98ee2cfc4c926c
---

 libavcodec/put_bits.h |   20 ++--
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/libavcodec/put_bits.h b/libavcodec/put_bits.h
index 70335e1..413c758 100644
--- a/libavcodec/put_bits.h
+++ b/libavcodec/put_bits.h
@@ -163,9 +163,13 @@ static inline void put_bits(PutBitContext *s, int n, 
unsigned int value)
 #ifdef BITSTREAM_WRITER_LE
 bit_buf |= value << (32 - bit_left);
 if (n >= bit_left) {
-av_assert2(s->buf_ptr+3buf_end);
-AV_WL32(s->buf_ptr, bit_buf);
-s->buf_ptr += 4;
+if (3 < s->buf_end - s->buf_ptr) {
+AV_WL32(s->buf_ptr, bit_buf);
+s->buf_ptr += 4;
+} else {
+av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too 
small\n");
+av_assert2(0);
+}
 bit_buf = (bit_left == 32) ? 0 : value >> bit_left;
 bit_left   += 32;
 }
@@ -177,9 +181,13 @@ static inline void put_bits(PutBitContext *s, int n, 
unsigned int value)
 } else {
 bit_buf   <<= bit_left;
 bit_buf|= value >> (n - bit_left);
-av_assert2(s->buf_ptr+3buf_end);
-AV_WB32(s->buf_ptr, bit_buf);
-s->buf_ptr += 4;
+if (3 < s->buf_end - s->buf_ptr) {
+AV_WB32(s->buf_ptr, bit_buf);
+s->buf_ptr += 4;
+} else {
+av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too 
small\n");
+av_assert2(0);
+}
 bit_left   += 32 - n;
 bit_buf = value;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Fix intermediate format for cascaded alpha downscaling

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Thu Dec 24 21:46:15 2015 +0100| [bb70069e6a5c6786825234d44d808150784bb36b] | 
committer: Michael Niedermayer

swscale/utils: Fix intermediate format for cascaded alpha downscaling

Fixes Ticket4926

Signed-off-by: Michael Niedermayer 
(cherry picked from commit b83d8be6bff7d645469a623aee0b380541da15cf)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bb70069e6a5c6786825234d44d808150784bb36b
---

 libswscale/utils.c |3 +++
 1 file changed, 3 insertions(+)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index 71456db..cb78c59 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -1528,6 +1528,9 @@ fail: // FIXME replace things by appropriate error codes
 int tmpH = sqrt(srcH * (int64_t)dstH);
 enum AVPixelFormat tmpFormat = AV_PIX_FMT_YUV420P;
 
+if (isALPHA(srcFormat))
+tmpFormat = AV_PIX_FMT_YUVA420P;
+
 if (srcW*(int64_t)srcH <= 4LL*dstW*dstH)
 return AVERROR(EINVAL);
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avfilter/vf_scale: set proper out frame color range

[Thomas Mundt]

ffmpeg | branch: release/2.6 | Thomas Mundt  | Thu Dec 31 
00:01:21 2015 +0100| [482ca8241d7758ff81c51e1f54fa4bb1286269e4] | committer: 
Michael Niedermayer

avfilter/vf_scale: set proper out frame color range

Prevents that following scalers in the filter chain will do unintentional color 
range conversions.
Fixes Ticket #5096

Signed-off-by: Thomas Mundt 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 73ce8162f3499cf0e86d1d80dea53324bd62bcb3)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=482ca8241d7758ff81c51e1f54fa4bb1286269e4
---

 libavfilter/vf_scale.c |2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
index f77884c..ab6cab0 100644
--- a/libavfilter/vf_scale.c
+++ b/libavfilter/vf_scale.c
@@ -523,6 +523,8 @@ static int filter_frame(AVFilterLink *link, AVFrame *in)
 sws_setColorspaceDetails(scale->isws[1], inv_table, in_full,
  table, out_full,
  brightness, contrast, saturation);
+
+av_frame_set_color_range(out, out_full ? AVCOL_RANGE_JPEG : 
AVCOL_RANGE_MPEG);
 }
 
 av_reduce(&out->sample_aspect_ratio.num, &out->sample_aspect_ratio.den,

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Thu Jan 14 15:11:48 2016 +0100| [f0b6705e1a76b5eca07fe4b365c3d138860b05a2] | 
committer: Michael Niedermayer

swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls

This avoids running various table inits unnecessarily

Signed-off-by: Michael Niedermayer 
(cherry picked from commit cc538e9dbd14b61d1ac8c9fa687d83289673fe90)

Conflicts:

libswscale/utils.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f0b6705e1a76b5eca07fe4b365c3d138860b05a2
---

 libswscale/utils.c |   22 ++
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index 5380f3f..0c07939 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -825,8 +825,6 @@ int sws_setColorspaceDetails(struct SwsContext *c, const 
int inv_table[4],
 const AVPixFmtDescriptor *desc_dst;
 const AVPixFmtDescriptor *desc_src;
 int need_reinit = 0;
-memmove(c->srcColorspaceTable, inv_table, sizeof(int) * 4);
-memmove(c->dstColorspaceTable, table, sizeof(int) * 4);
 
 handle_formats(c);
 desc_dst = av_pix_fmt_desc_get(c->dstFormat);
@@ -837,11 +835,24 @@ int sws_setColorspaceDetails(struct SwsContext *c, const 
int inv_table[4],
 if(!isYUV(c->srcFormat) && !isGray(c->srcFormat))
 srcRange = 0;
 
+if (c->srcRange != srcRange ||
+c->dstRange != dstRange ||
+c->brightness != brightness ||
+c->contrast   != contrast ||
+c->saturation != saturation ||
+memcmp(c->srcColorspaceTable, inv_table, sizeof(int) * 4) ||
+memcmp(c->dstColorspaceTable, table, sizeof(int) * 4)
+)
+need_reinit = 1;
+
+memmove(c->srcColorspaceTable, inv_table, sizeof(int) * 4);
+memmove(c->dstColorspaceTable, table, sizeof(int) * 4);
+
+
+
 c->brightness = brightness;
 c->contrast   = contrast;
 c->saturation = saturation;
-if (c->srcRange != srcRange || c->dstRange != dstRange)
-need_reinit = 1;
 c->srcRange   = srcRange;
 c->dstRange   = dstRange;
 
@@ -856,6 +867,9 @@ int sws_setColorspaceDetails(struct SwsContext *c, const 
int inv_table[4],
 c->dstFormatBpp = av_get_bits_per_pixel(desc_dst);
 c->srcFormatBpp = av_get_bits_per_pixel(desc_src);
 
+if (!need_reinit)
+return 0;
+
 if (!isYUV(c->dstFormat) && !isGray(c->dstFormat)) {
 ff_yuv2rgb_c_init_tables(c, inv_table, srcRange, brightness,
  contrast, saturation);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] configure: bump copyright year to 2016

[James Almer]

ffmpeg | branch: release/2.6 | James Almer  | Sat Jan  2 
16:28:31 2016 -0300| [80fc1f3399f1e3ecea1e4886215d87e973d3035d] | committer: 
Michael Niedermayer

configure: bump copyright year to 2016

Signed-off-by: James Almer 
(cherry picked from commit 78129978f02f27d76ecaf2cd1a7bf7a47253fdab)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=80fc1f3399f1e3ecea1e4886215d87e973d3035d
---

 configure |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure b/configure
index e4c1c24..e13b767 100755
--- a/configure
+++ b/configure
@@ -5748,7 +5748,7 @@ cat > $TMPH 

[FFmpeg-cvslog] avcodec/motion_est: Fix mv_penalty table size

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Tue Jan  5 14:41:04 2016 +0100| [f3cf94fa47d197ed33c00012a0a827bf88431e6d] | 
committer: Michael Niedermayer

avcodec/motion_est: Fix mv_penalty table size

Fixes out of array read

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5b4da8a38a5ed211df9504c85ce401c30af86b97)

Conflicts:

libavcodec/motion_est.h

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f3cf94fa47d197ed33c00012a0a827bf88431e6d
---

 libavcodec/ituh263enc.c|6 +++---
 libavcodec/motion_est.c|   16 
 libavcodec/mpeg12enc.c |6 +++---
 libavcodec/mpegvideo.h |3 ++-
 libavcodec/mpegvideo_enc.c |2 +-
 libavcodec/snowenc.c   |2 +-
 6 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/libavcodec/ituh263enc.c b/libavcodec/ituh263enc.c
index 7d4d9b0..6ce634d 100644
--- a/libavcodec/ituh263enc.c
+++ b/libavcodec/ituh263enc.c
@@ -43,7 +43,7 @@
 /**
  * Table of number of bits a motion vector component needs.
  */
-static uint8_t mv_penalty[MAX_FCODE+1][MAX_MV*2+1];
+static uint8_t mv_penalty[MAX_FCODE+1][MAX_DMV*2+1];
 
 /**
  * Minimal fcode that a motion vector component would need.
@@ -676,7 +676,7 @@ static av_cold void 
init_mv_penalty_and_fcode(MpegEncContext *s)
 int mv;
 
 for(f_code=1; f_code<=MAX_FCODE; f_code++){
-for(mv=-MAX_MV; mv<=MAX_MV; mv++){
+for(mv=-MAX_DMV; mv<=MAX_DMV; mv++){
 int len;
 
 if(mv==0) len= ff_mvtab[0][1];
@@ -697,7 +697,7 @@ static av_cold void 
init_mv_penalty_and_fcode(MpegEncContext *s)
 }
 }
 
-mv_penalty[f_code][mv+MAX_MV]= len;
+mv_penalty[f_code][mv+MAX_DMV]= len;
 }
 }
 
diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c
index a0a5965..d161043 100644
--- a/libavcodec/motion_est.c
+++ b/libavcodec/motion_est.c
@@ -906,7 +906,7 @@ void ff_estimate_p_frame_motion(MpegEncContext * s,
 c->penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_cmp);
 c->sub_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_sub_cmp);
 c->mb_penalty_factor = get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->mb_cmp);
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 
 get_limits(s, 16*mb_x, 16*mb_y);
 c->skip=0;
@@ -1082,7 +1082,7 @@ int ff_pre_estimate_p_frame_motion(MpegEncContext * s,
 av_assert0(s->quarter_sample==0 || s->quarter_sample==1);
 
 c->pre_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_pre_cmp);
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 
 get_limits(s, 16*mb_x, 16*mb_y);
 c->skip=0;
@@ -1131,7 +1131,7 @@ static int estimate_motion_b(MpegEncContext *s, int mb_x, 
int mb_y,
 const int shift= 1+s->quarter_sample;
 const int mot_stride = s->mb_stride;
 const int mot_xy = mb_y*mot_stride + mb_x;
-uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_MV;
+uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_DMV;
 int mv_scale;
 
 c->penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_cmp);
@@ -1205,8 +1205,8 @@ static inline int check_bidir_mv(MpegEncContext * s,
 //FIXME better f_code prediction (max mv & distance)
 //FIXME pointers
 MotionEstContext * const c= &s->me;
-uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_MV; // f_code 
of the prev frame
-uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_MV; // f_code 
of the prev frame
+uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_DMV; // 
f_code of the prev frame
+uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_DMV; // 
f_code of the prev frame
 int stride= c->stride;
 uint8_t *dest_y = c->scratchpad;
 uint8_t *ptr;
@@ -1419,7 +1419,7 @@ static inline int direct_search(MpegEncContext * s, int 
mb_x, int mb_y)
 int mx, my, xmin, xmax, ymin, ymax;
 int16_t (*mv_table)[2]= s->b_direct_mv_table;
 
-c->current_mv_penalty= c->mv_penalty[1] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[1] + MAX_DMV;
 ymin= xmin=(-32)>>shift;
 ymax= xmax=   31>>shift;
 
@@ -1555,11 +1555,11 @@ void ff_estimate_b_frame_motion(MpegEncContext * s,
 if(s->flags & CODEC_FLAG_INTERLACED_ME){
 //FIXME mb type penalty
 c->skip=0;
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 fimin= interlaced_search(s, 0,
  s->b_field_mv_table[0], 
s->b_field_select_table[0],
  s->b_forw_mv_table[xy][0], 
s->b_forw_mv_table[xy][1], 0);
-c->current_mv_penalty= c->mv_penalty[s->b_code] + MAX_MV;
+c-

[FFmpeg-cvslog] avcodec/wavpackenc: Headers are per channel

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Mon Jan 11 18:32:32 2016 +0100| [60956a9dc86228f37197f3ffe35f2d9ceb105ed0] | 
committer: Michael Niedermayer

avcodec/wavpackenc: Headers are per channel

Fixes: 
1b8b83a53bfa751f01b1daa65a4758db/signal_sigabrt_76ae7cb7_7488_403f71d1a2565b598d01b6cb110fac8f.aiff
Fixes: assertion failure

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 26757b0279b4b93c6066c2151d4d3dbd2ec266bf)

Conflicts:

libavcodec/wavpackenc.c

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=60956a9dc86228f37197f3ffe35f2d9ceb105ed0
---

 libavcodec/wavpackenc.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/wavpackenc.c b/libavcodec/wavpackenc.c
index c174950..aee4b79 100644
--- a/libavcodec/wavpackenc.c
+++ b/libavcodec/wavpackenc.c
@@ -2882,7 +2882,7 @@ static int wavpack_encode_frame(AVCodecContext *avctx, 
AVPacket *avpkt,
 }
 
 buf_size = s->block_samples * avctx->channels * 8
- + 200 /* for headers */;
+ + 200 * avctx->channels /* for headers */;
 if ((ret = ff_alloc_packet2(avctx, avpkt, buf_size)) < 0)
 return ret;
 buf = avpkt->data;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] mjpegdec: extend check for incompatible values of s->rgb and s->ls

[Andreas Cadhalpun]

ffmpeg | branch: release/2.6 | Andreas Cadhalpun 
 | Thu Dec 31 16:55:43 2015 +0100| 
[a5fb5a18e3e234ded3f18926d0cbc411504ab99e] | committer: Michael Niedermayer

mjpegdec: extend check for incompatible values of s->rgb and s->ls

This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.

In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.

This fixes an out-of-bounds read in ls_decode_line.

Reviewed-by: Michael Niedermayer 
Signed-off-by: Andreas Cadhalpun 
(cherry picked from commit 7ea2db6eafa0a8a9497aab20be2cfc8742a59072)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a5fb5a18e3e234ded3f18926d0cbc411504ab99e
---

 libavcodec/mjpegdec.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 8a190fc..57279bf 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -606,7 +606,8 @@ unk_pixfmt:
 av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) 
mismatch\n", len);
 }
 
-if (s->rgb && !s->lossless && !s->ls) {
+if ((s->rgb && !s->lossless && !s->ls) ||
+(!s->rgb && s->ls && s->nb_components > 1)) {
 av_log(s->avctx, AV_LOG_ERROR, "Unsupported coding and pixel format 
combination\n");
 return AVERROR_PATCHWELCOME;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mss2: Check for repeat overflow

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Sun Jan 10 12:19:48 2016 +0100| [aa5ae8b2136f9390dcc7e4dd31b1a2e557045449] | 
committer: Michael Niedermayer

avcodec/mss2: Check for repeat overflow

Fixes: mss2_left_shift.wmv

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit e273dade78943e22b71d0ddb67cd0d737fc26edf)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=aa5ae8b2136f9390dcc7e4dd31b1a2e557045449
---

 libavcodec/mss2.c |7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c
index 4d53f8a..ea448da 100644
--- a/libavcodec/mss2.c
+++ b/libavcodec/mss2.c
@@ -209,8 +209,13 @@ static int decode_555(GetByteContext *gB, uint16_t *dst, 
int stride,
 last_symbol = b << 8 | bytestream2_get_byte(gB);
 else if (b > 129) {
 repeat = 0;
-while (b-- > 130)
+while (b-- > 130) {
+if (repeat >= (INT_MAX >> 8) - 1) {
+av_log(NULL, AV_LOG_ERROR, "repeat overflow\n");
+return AVERROR_INVALIDDATA;
+}
 repeat = (repeat << 8) + bytestream2_get_byte(gB) + 1;
+}
 if (last_symbol == -2) {
 int skip = FFMIN((unsigned)repeat, dst + w - p);
 repeat -= skip;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/wavpackenc: Check the number of channels

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Mon Jan 11 18:58:08 2016 +0100| [6d483543217fd0956977a2e5989a51966e7c14cf] | 
committer: Michael Niedermayer

avcodec/wavpackenc: Check the number of channels

They are stored in a byte, thus more than 255 is not possible

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 59c915a403af32c4ff5126625b0cc7e38f4beff9)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6d483543217fd0956977a2e5989a51966e7c14cf
---

 libavcodec/wavpackenc.c |5 +
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/wavpackenc.c b/libavcodec/wavpackenc.c
index aee4b79..a1ea66b 100644
--- a/libavcodec/wavpackenc.c
+++ b/libavcodec/wavpackenc.c
@@ -128,6 +128,11 @@ static av_cold int wavpack_encode_init(AVCodecContext 
*avctx)
 
 s->avctx = avctx;
 
+if (avctx->channels > 255) {
+av_log(avctx, AV_LOG_ERROR, "Too many channels\n", avctx->channels);
+return AVERROR(EINVAL);
+}
+
 if (!avctx->frame_size) {
 int block_samples;
 if (!(avctx->sample_rate & 1))

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/hls: Even stricter URL checks

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Fri Jan 15 15:29:22 2016 +0100| [82db8bcffae0010c638a01069d0754c06960470d] | 
committer: Michael Niedermayer

avformat/hls: Even stricter URL checks

This fixes a null pointer dereference at least

Signed-off-by: Michael Niedermayer 
(cherry picked from commit cfda1bea4c18ec1edbc11ecc465f788b02851488)

Conflicts:

libavformat/hls.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=82db8bcffae0010c638a01069d0754c06960470d
---

 libavformat/hls.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 6c3424b..8aa9a83 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -913,12 +913,16 @@ static void update_options(char **dest, const char *name, 
void *src)
 
 static int check_url(const char *url) {
 const char *proto_name = avio_find_protocol_name(url);
+
+if (!proto_name)
+return AVERROR_INVALIDDATA;
+
 if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL))
 return AVERROR_INVALIDDATA;
 
 if (!strncmp(proto_name, url, strlen(proto_name)) && 
url[strlen(proto_name)] == ':')
 return 0;
-else if (strcmp(proto_name, "file") || !strcmp(url, "file,"))
+else if (strcmp(proto_name, "file") || !strncmp(url, "file,", 5))
 return AVERROR_INVALIDDATA;
 
 return 0;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/yuv2rgb: Increase YUV2RGB table headroom

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Thu Jan 14 03:05:11 2016 +0100| [1ba90ce49e278298e0c8e8f59428edb5359e4e5d] | 
committer: Michael Niedermayer

swscale/yuv2rgb: Increase YUV2RGB table headroom

This makes SWS more robust
Fixes: 
07650a772d98aa63b0fed6370dc89037/asan_heap-oob_27ddeaf_2657_2c81ff264dee5d9712cb3251fb9c3bbb.264
Fixes: out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 8f3a9a8c278acf886f70a1d743bc07b6f9c7b51a)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1ba90ce49e278298e0c8e8f59428edb5359e4e5d
---

 libswscale/swscale_internal.h |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libswscale/swscale_internal.h b/libswscale/swscale_internal.h
index 0d07b2b..4181308 100644
--- a/libswscale/swscale_internal.h
+++ b/libswscale/swscale_internal.h
@@ -39,8 +39,8 @@
 
 #define STR(s) AV_TOSTRING(s) // AV_STRINGIFY is too long
 
-#define YUVRGB_TABLE_HEADROOM 256
-#define YUVRGB_TABLE_LUMA_HEADROOM 0
+#define YUVRGB_TABLE_HEADROOM 512
+#define YUVRGB_TABLE_LUMA_HEADROOM 512
 
 #define MAX_FILTER_SIZE SWS_MAX_FILTER_SIZE
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/h264_slice: Fix integer overflow in implicit weight computation

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Tue Jan  5 01:06:18 2016 +0100| [85732714ce945f2e11ddc9f8d5ddbc4e82a77739] | 
committer: Michael Niedermayer

avcodec/h264_slice: Fix integer overflow in implicit weight computation

Fixes mozilla bug 1230423

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7cc01c25727a96eaaa0c177234b626e47c8ea491)

Conflicts:

libavcodec/h264_slice.c

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=85732714ce945f2e11ddc9f8d5ddbc4e82a77739
---

 libavcodec/h264_slice.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index b0b4060..5e7efdd 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -893,7 +893,7 @@ static void implicit_weight_table(H264Context *h, int field)
 cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1];
 }
 if (h->ref_count[0] == 1 && h->ref_count[1] == 1 && !FRAME_MBAFF(h) &&
-h->ref_list[0][0].poc + h->ref_list[1][0].poc == 2 * cur_poc) {
+h->ref_list[0][0].poc + (int64_t)h->ref_list[1][0].poc == 2 * 
cur_poc) {
 h->use_weight= 0;
 h->use_weight_chroma = 0;
 return;
@@ -914,7 +914,7 @@ static void implicit_weight_table(H264Context *h, int field)
 h->chroma_log2_weight_denom = 5;
 
 for (ref0 = ref_start; ref0 < ref_count0; ref0++) {
-int poc0 = h->ref_list[0][ref0].poc;
+int64_t poc0 = h->ref_list[0][ref0].poc;
 for (ref1 = ref_start; ref1 < ref_count1; ref1++) {
 int w = 32;
 if (!h->ref_list[0][ref0].long_ref && 
!h->ref_list[1][ref1].long_ref) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/dvdec: Fix "left shift of negative value -254"

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Sun Jan 10 17:43:56 2016 +0100| [526b5facc59e5d45aac5b3832a04b3af28f038b0] | 
committer: Michael Niedermayer

avcodec/dvdec: Fix "left shift of negative value -254"

Fixes: dvdec_left_shift.avi

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 93ac72a98dff592ffc174cfb36a8975dfbf145ae)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=526b5facc59e5d45aac5b3832a04b3af28f038b0
---

 libavcodec/dvdec.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/dvdec.c b/libavcodec/dvdec.c
index 388bbf2..2a4a18d 100644
--- a/libavcodec/dvdec.c
+++ b/libavcodec/dvdec.c
@@ -333,7 +333,7 @@ static int dv_decode_video_segment(AVCodecContext *avctx, 
void *arg)
 dct_mode* 22 * 64 +
 (quant + ff_dv_quant_offset[class1]) * 64];
 }
-dc = dc << 2;
+dc = dc * 4;
 /* convert to unsigned because 128 is not added in the
  * standard IDCT */
 dc   += 1024;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mjpegdec: Fix negative shift

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Sun Jan 10 15:52:09 2016 +0100| [bb1263185b609663dfcdaad616b5667a2f4cd2d9] | 
committer: Michael Niedermayer

avcodec/mjpegdec: Fix negative shift

Fixes: mjpeg_left_shift.avi

Found-by: Piotr Bandurski 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit d86d7b2486cd5c31db8e820d8a89554abf19567e)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bb1263185b609663dfcdaad616b5667a2f4cd2d9
---

 libavcodec/mjpegdec.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 57279bf..7f2d479 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -972,7 +972,7 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int 
nb_components, int p
 return -1;
 
 left[i] = buffer[mb_x][i] =
-mask & (pred + (dc << point_transform));
+mask & (pred + (dc * (1 << point_transform)));
 }
 
 if (s->restart_interval && !--s->restart_count) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/hls: More strict url checks

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Fri Jan 15 13:29:38 2016 +0100| [232c2ed4a4a546ee28b84dc1673660fbfeb08d2f] | 
committer: Michael Niedermayer

avformat/hls: More strict url checks

No case is known where these are needed

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 6ba42b6482c725a59eb468391544dc0c75b8c6f0)

Conflicts:

libavformat/hls.c

Signed-off-by: Michael Niedermayer 

Conflicts:

libavformat/hls.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=232c2ed4a4a546ee28b84dc1673660fbfeb08d2f
---

 libavformat/hls.c |   26 ++
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 96bcb36..6c3424b 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -911,6 +911,19 @@ static void update_options(char **dest, const char *name, 
void *src)
 av_freep(dest);
 }
 
+static int check_url(const char *url) {
+const char *proto_name = avio_find_protocol_name(url);
+if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL))
+return AVERROR_INVALIDDATA;
+
+if (!strncmp(proto_name, url, strlen(proto_name)) && 
url[strlen(proto_name)] == ':')
+return 0;
+else if (strcmp(proto_name, "file") || !strcmp(url, "file,"))
+return AVERROR_INVALIDDATA;
+
+return 0;
+}
+
 static int open_input(HLSContext *c, struct playlist *pls)
 {
 AVDictionary *opts = NULL;
@@ -938,11 +951,9 @@ static int open_input(HLSContext *c, struct playlist *pls)
seg->url, seg->url_offset, pls->index);
 
 if (seg->key_type == KEY_NONE) {
-const char *proto_name = avio_find_protocol_name(seg->url);
-if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL)) {
-ret = AVERROR_INVALIDDATA;
+ret = check_url(seg->url);
+if (ret < 0)
 goto cleanup;
-}
 
 ret = ffurl_open(&pls->input, seg->url, AVIO_FLAG_READ,
   &pls->parent->interrupt_callback, &opts);
@@ -951,11 +962,10 @@ static int open_input(HLSContext *c, struct playlist *pls)
 char iv[33], key[33], url[MAX_URL_SIZE];
 if (strcmp(seg->key, pls->key_url)) {
 URLContext *uc;
-const char *proto_name = avio_find_protocol_name(seg->key);
-if (!av_strstart(proto_name, "http", NULL) && 
!av_strstart(proto_name, "file", NULL)) {
-ret = AVERROR_INVALIDDATA;
+ret = check_url(seg->key);
+if (ret < 0)
 goto cleanup;
-}
+
 if (ffurl_open(&uc, seg->key, AVIO_FLAG_READ,
&pls->parent->interrupt_callback, &opts2) == 0) {
 if (ffurl_read_complete(uc, pls->key, sizeof(pls->key))

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Thu Jan 14 12:36:41 2016 +0100| [4bafd677953f5e8bb4def1a4c4964cdecd72616b] | 
committer: Michael Niedermayer

swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5e5f82a28737fba4402259617500911cc37e3674)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4bafd677953f5e8bb4def1a4c4964cdecd72616b
---

 libswscale/swscale_internal.h |1 +
 libswscale/yuv2rgb.c  |   89 +
 2 files changed, 46 insertions(+), 44 deletions(-)

diff --git a/libswscale/swscale_internal.h b/libswscale/swscale_internal.h
index 55f683f..0d07b2b 100644
--- a/libswscale/swscale_internal.h
+++ b/libswscale/swscale_internal.h
@@ -40,6 +40,7 @@
 #define STR(s) AV_TOSTRING(s) // AV_STRINGIFY is too long
 
 #define YUVRGB_TABLE_HEADROOM 256
+#define YUVRGB_TABLE_LUMA_HEADROOM 0
 
 #define MAX_FILTER_SIZE SWS_MAX_FILTER_SIZE
 
diff --git a/libswscale/yuv2rgb.c b/libswscale/yuv2rgb.c
index 1d682ba..e81f3f6 100644
--- a/libswscale/yuv2rgb.c
+++ b/libswscale/yuv2rgb.c
@@ -776,7 +776,8 @@ av_cold int ff_yuv2rgb_c_init_tables(SwsContext *c, const 
int inv_table[4],
 uint16_t *y_table16;
 uint32_t *y_table32;
 int i, base, rbase, gbase, bbase, av_uninit(abase), needAlpha;
-const int yoffs = fullRange ? 384 : 326;
+const int yoffs = (fullRange ? 384 : 326) + YUVRGB_TABLE_LUMA_HEADROOM;
+const int table_plane_size = 1024 + 2*YUVRGB_TABLE_LUMA_HEADROOM;
 
 int64_t crv =  inv_table[0];
 int64_t cbu =  inv_table[1];
@@ -833,10 +834,10 @@ av_cold int ff_yuv2rgb_c_init_tables(SwsContext *c, const 
int inv_table[4],
 return AVERROR(ENOMEM);
 switch (bpp) {
 case 1:
-ALLOC_YUV_TABLE(1024);
+ALLOC_YUV_TABLE(table_plane_size);
 y_table = c->yuvTable;
-yb = -(384 << 16) - oy;
-for (i = 0; i < 1024 - 110; i++) {
+yb = -(384 << 16) - YUVRGB_TABLE_LUMA_HEADROOM*cy - oy;
+for (i = 0; i < table_plane_size - 110; i++) {
 y_table[i + 110]  = av_clip_uint8((yb + 0x8000) >> 16) >> 7;
 yb   += cy;
 }
@@ -848,60 +849,60 @@ av_cold int ff_yuv2rgb_c_init_tables(SwsContext *c, const 
int inv_table[4],
 rbase   = isRgb ? 3 : 0;
 gbase   = 1;
 bbase   = isRgb ? 0 : 3;
-ALLOC_YUV_TABLE(1024 * 3);
+ALLOC_YUV_TABLE(table_plane_size * 3);
 y_table = c->yuvTable;
-yb = -(384 << 16) - oy;
-for (i = 0; i < 1024 - 110; i++) {
+yb = -(384 << 16) - YUVRGB_TABLE_LUMA_HEADROOM*cy - oy;
+for (i = 0; i < table_plane_size - 110; i++) {
 int yval= av_clip_uint8((yb + 0x8000) >> 16);
 y_table[i + 110]= (yval >> 7)<< rbase;
-y_table[i +  37 + 1024] = ((yval + 43) / 85) << gbase;
-y_table[i + 110 + 2048] = (yval >> 7)<< bbase;
+y_table[i +  37 +   table_plane_size] = ((yval + 43) / 85) << 
gbase;
+y_table[i + 110 + 2*table_plane_size] = (yval >> 7)<< 
bbase;
 yb += cy;
 }
 fill_table(c->table_rV, 1, crv, y_table + yoffs);
-fill_table(c->table_gU, 1, cgu, y_table + yoffs + 1024);
-fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2048);
+fill_table(c->table_gU, 1, cgu, y_table + yoffs +   table_plane_size);
+fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2*table_plane_size);
 fill_gv_table(c->table_gV, 1, cgv);
 break;
 case 8:
 rbase   = isRgb ? 5 : 0;
 gbase   = isRgb ? 2 : 3;
 bbase   = isRgb ? 0 : 6;
-ALLOC_YUV_TABLE(1024 * 3);
+ALLOC_YUV_TABLE(table_plane_size * 3);
 y_table = c->yuvTable;
-yb = -(384 << 16) - oy;
-for (i = 0; i < 1024 - 38; i++) {
+yb = -(384 << 16) - YUVRGB_TABLE_LUMA_HEADROOM*cy - oy;
+for (i = 0; i < table_plane_size - 38; i++) {
 int yval   = av_clip_uint8((yb + 0x8000) >> 16);
 y_table[i + 16]= ((yval + 18) / 36) << rbase;
-y_table[i + 16 + 1024] = ((yval + 18) / 36) << gbase;
-y_table[i + 37 + 2048] = ((yval + 43) / 85) << bbase;
+y_table[i + 16 +   table_plane_size] = ((yval + 18) / 36) << gbase;
+y_table[i + 37 + 2*table_plane_size] = ((yval + 43) / 85) << bbase;
 yb += cy;
 }
 fill_table(c->table_rV, 1, crv, y_table + yoffs);
-fill_table(c->table_gU, 1, cgu, y_table + yoffs + 1024);
-fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2048);
+fill_table(c->table_gU, 1, cgu, y_table + yoffs +   table_plane_size);
+fill_table(c->table_bU, 1, cbu, y_table + yoffs + 2*table_plane_size);
 fill_gv_table(c->table_gV, 1, cgv);
 break;
 case 12:
 

[FFmpeg-cvslog] avcodec/mpeg4video: Check time_incr

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Tue Jan 12 03:03:01 2016 +0100| [9b8d1a183d467470b7fe873eea36e407c42f3105] | 
committer: Michael Niedermayer

avcodec/mpeg4video: Check time_incr

Fixes assertion failure
Fixes out of memory access

Fixes: test_casex.ivf

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7c97946d6131b31340954a3f603b6bf92590a9a5)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9b8d1a183d467470b7fe873eea36e407c42f3105
---

 libavcodec/mpeg4video.h|2 +-
 libavcodec/mpeg4videoenc.c |   10 +-
 libavcodec/mpegvideo_enc.c |8 +---
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/libavcodec/mpeg4video.h b/libavcodec/mpeg4video.h
index e83692c..fa92e99 100644
--- a/libavcodec/mpeg4video.h
+++ b/libavcodec/mpeg4video.h
@@ -137,7 +137,7 @@ void ff_mpeg4_encode_mb(MpegEncContext *s,
 void ff_mpeg4_pred_ac(MpegEncContext *s, int16_t *block, int n,
   int dir);
 void ff_set_mpeg4_time(MpegEncContext *s);
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);
 
 int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb);
 void ff_mpeg4_encode_video_packet_header(MpegEncContext *s);
diff --git a/libavcodec/mpeg4videoenc.c b/libavcodec/mpeg4videoenc.c
index 5751432a..c47b6e8 100644
--- a/libavcodec/mpeg4videoenc.c
+++ b/libavcodec/mpeg4videoenc.c
@@ -1086,7 +1086,7 @@ static void mpeg4_encode_vol_header(MpegEncContext *s,
 }
 
 /* write mpeg4 VOP header */
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
 {
 int time_incr;
 int time_div, time_mod;
@@ -1112,6 +1112,12 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, 
int picture_number)
 time_mod  = FFUMOD(s->time, s->avctx->time_base.den);
 time_incr = time_div - s->last_time_base;
 av_assert0(time_incr >= 0);
+
+// This limits the frame duration to max 1 hour
+if (time_incr > 3600) {
+av_log(s->avctx, AV_LOG_ERROR, "time_incr %d too large\n", time_incr);
+return AVERROR(EINVAL);
+}
 while (time_incr--)
 put_bits(&s->pb, 1, 1);
 
@@ -1137,6 +1143,8 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, 
int picture_number)
 put_bits(&s->pb, 3, s->f_code);  /* fcode_for */
 if (s->pict_type == AV_PICTURE_TYPE_B)
 put_bits(&s->pb, 3, s->b_code);  /* fcode_back */
+
+return 0;
 }
 
 static av_cold void init_uni_dc_tab(void)
diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index ff10d68..2a00c84 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -3714,9 +3714,11 @@ static int encode_picture(MpegEncContext *s, int 
picture_number)
 ff_wmv2_encode_picture_header(s, picture_number);
 else if (CONFIG_MSMPEG4_ENCODER && s->msmpeg4_version)
 ff_msmpeg4_encode_picture_header(s, picture_number);
-else if (CONFIG_MPEG4_ENCODER && s->h263_pred)
-ff_mpeg4_encode_picture_header(s, picture_number);
-else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
+else if (CONFIG_MPEG4_ENCODER && s->h263_pred) {
+ret = ff_mpeg4_encode_picture_header(s, picture_number);
+if (ret < 0)
+return ret;
+} else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
 ret = ff_rv10_encode_picture_header(s, picture_number);
 if (ret < 0)
 return ret;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Thu Jan  7 00:22:56 2016 +0100| [81bac54ab3cdf1cac32bc0ee84956077c5562589] | 
committer: Michael Niedermayer

avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range

Fixes out of array read
Fixes: test_case-mdc.264 (b47be15a120979f5a1a945c938cbef33)

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 13f266b50cc7554028d22480b7e4383968e64a63)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=81bac54ab3cdf1cac32bc0ee84956077c5562589
---

 libavcodec/mpegvideo_enc.c |1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index 76f78bd..ff10d68 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -315,6 +315,7 @@ av_cold int ff_mpv_encode_init(AVCodecContext *avctx)
 break;
 }
 
+avctx->bits_per_raw_sample = av_clip(avctx->bits_per_raw_sample, 0, 8);
 s->bit_rate = avctx->bit_rate;
 s->width= avctx->width;
 s->height   = avctx->height;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] Update for 2.6.7

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Fri Jan 15 17:36:43 2016 +0100| [3fd30f53a99e10c02691946a78a1210af95d71e5] | 
committer: Michael Niedermayer

Update for 2.6.7

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3fd30f53a99e10c02691946a78a1210af95d71e5
---

 Changelog|   27 +++
 RELEASE  |2 +-
 doc/Doxyfile |2 +-
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/Changelog b/Changelog
index 37d3a05..06184cf 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,33 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+version 2.6.7:
+- configure: bump copyright year to 2016
+- avformat/hls: Even stricter URL checks
+- avformat/hls: More strict url checks
+- swscale/utils: Detect and skip unneeded sws_setColorspaceDetails() calls
+- swscale/yuv2rgb: Increase YUV2RGB table headroom
+- swscale/yuv2rgb: Factor YUVRGB_TABLE_LUMA_HEADROOM out
+- avformat/hls: forbid all protocols except http(s) & file
+- avformat/aviobuf: Fix end check in put_str16()
+- avformat/asfenc: Check pts
+- avcodec/mpeg4video: Check time_incr
+- avcodec/wavpackenc: Check the number of channels
+- avcodec/wavpackenc: Headers are per channel
+- avcodec/dvdec: Fix "left shift of negative value -254"
+- avcodec/mjpegdec: Fix negative shift
+- avcodec/mss2: Check for repeat overflow
+- avformat: Add integer fps from 31 to 60 to get_std_framerate()
+- avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range
+- avfilter/vf_scale: set proper out frame color range
+- avcodec/motion_est: Fix mv_penalty table size
+- avcodec/h264_slice: Fix integer overflow in implicit weight computation
+- swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny 
dimensions
+- avcodec/put_bits: Always check buffer end before writing
+- mjpegdec: extend check for incompatible values of s->rgb and s->ls
+- swscale/utils: Fix intermediate format for cascaded alpha downscaling
+- x86/float_dsp: zero extend offset from ff_scalarproduct_float_sse
+
 
 version 2.6.6:
 - nuv: sanitize negative fps rate
diff --git a/RELEASE b/RELEASE
index 338a5b5..e261122 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1 +1 @@
-2.6.6
+2.6.7
diff --git a/doc/Doxyfile b/doc/Doxyfile
index 537a02b..e3f5d0f 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -31,7 +31,7 @@ PROJECT_NAME   = FFmpeg
 # This could be handy for archiving the generated documentation or
 # if some version control system is used.
 
-PROJECT_NUMBER = 2.6.6
+PROJECT_NUMBER = 2.6.7
 
 # With the PROJECT_LOGO tag one can specify a logo or icon that is included
 # in the documentation. The maximum height of the logo should not exceed 55

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/hls: forbid all protocols except http(s) & file

[Maxim Andreev]

ffmpeg | branch: release/2.6 | Maxim Andreev  | Wed Jan 
13 11:51:12 2016 +0300| [8b93f6676b89d23bc5f6e0f4e0afac469de881b9] | committer: 
Michael Niedermayer

avformat/hls: forbid all protocols except http(s) & file

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7145e80b4f78cff5ed5fee04d4c4d53daaa0e077)

Conflicts:

libavformat/hls.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8b93f6676b89d23bc5f6e0f4e0afac469de881b9
---

 libavformat/hls.c |   11 +++
 1 file changed, 11 insertions(+)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index af890bd..96bcb36 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -938,6 +938,12 @@ static int open_input(HLSContext *c, struct playlist *pls)
seg->url, seg->url_offset, pls->index);
 
 if (seg->key_type == KEY_NONE) {
+const char *proto_name = avio_find_protocol_name(seg->url);
+if (!av_strstart(proto_name, "http", NULL) && !av_strstart(proto_name, 
"file", NULL)) {
+ret = AVERROR_INVALIDDATA;
+goto cleanup;
+}
+
 ret = ffurl_open(&pls->input, seg->url, AVIO_FLAG_READ,
   &pls->parent->interrupt_callback, &opts);
 
@@ -945,6 +951,11 @@ static int open_input(HLSContext *c, struct playlist *pls)
 char iv[33], key[33], url[MAX_URL_SIZE];
 if (strcmp(seg->key, pls->key_url)) {
 URLContext *uc;
+const char *proto_name = avio_find_protocol_name(seg->key);
+if (!av_strstart(proto_name, "http", NULL) && 
!av_strstart(proto_name, "file", NULL)) {
+ret = AVERROR_INVALIDDATA;
+goto cleanup;
+}
 if (ffurl_open(&uc, seg->key, AVIO_FLAG_READ,
&pls->parent->interrupt_callback, &opts2) == 0) {
 if (ffurl_read_complete(uc, pls->key, sizeof(pls->key))

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat: Add integer fps from 31 to 60 to get_std_framerate()

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Sat Jan  9 10:49:23 2016 +0100| [c0315b74e2563f8c3b97e8ff99cd9bd12654c143] | 
committer: Michael Niedermayer

avformat: Add integer fps from 31 to 60 to get_std_framerate()

Fixes Ticket 5106

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 2039b3e7511ef183dae206575114e15b6d99c134)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c0315b74e2563f8c3b97e8ff99cd9bd12654c143
---

 libavformat/avformat.h |2 +-
 libavformat/utils.c|   10 +++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/libavformat/avformat.h b/libavformat/avformat.h
index 4211a95..6498bb6 100644
--- a/libavformat/avformat.h
+++ b/libavformat/avformat.h
@@ -921,7 +921,7 @@ typedef struct AVStream {
 /**
  * Stream information used internally by av_find_stream_info()
  */
-#define MAX_STD_TIMEBASES (30*12+7+6)
+#define MAX_STD_TIMEBASES (30*12+30+3+6)
 struct {
 int64_t last_dts;
 int64_t duration_gcd;
diff --git a/libavformat/utils.c b/libavformat/utils.c
index bdcbd72..0e23c1d 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2824,10 +2824,14 @@ static int get_std_framerate(int i)
 return (i + 1) * 1001;
 i -= 30*12;
 
-if (i < 7)
-return ((const int[]) { 40, 48, 50, 60, 80, 120, 240})[i] * 1001 * 12;
+if (i < 30)
+return (i + 31) * 1001 * 12;
+i -= 30;
 
-i -= 7;
+if (i < 3)
+return ((const int[]) { 80, 120, 240})[i] * 1001 * 12;
+
+i -= 3;
 
 return ((const int[]) { 24, 30, 60, 12, 15, 48 })[i] * 1000 * 12;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/asfenc: Check pts

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Tue Jan 12 18:49:20 2016 +0100| [fbfef00e688357494a5228897a6a865fded05b32] | 
committer: Michael Niedermayer

avformat/asfenc: Check pts

Fixes integer overflow
Fixes: 
0063df8be3aaa30dd6d76f59c8f818c8/signal_sigsegv_7b7b59_3634_bf418b6822bbfa68734411d96b667be3.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7c0b84d89911b2035161f5ef51aafbfcc84aa9e2)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fbfef00e688357494a5228897a6a865fded05b32
---

 libavformat/asfenc.c |5 +
 1 file changed, 5 insertions(+)

diff --git a/libavformat/asfenc.c b/libavformat/asfenc.c
index 5e0f7b0..0aea552 100644
--- a/libavformat/asfenc.c
+++ b/libavformat/asfenc.c
@@ -925,6 +925,11 @@ static int asf_write_packet(AVFormatContext *s, AVPacket 
*pkt)
 
 pts = (pkt->pts != AV_NOPTS_VALUE) ? pkt->pts : pkt->dts;
 av_assert0(pts != AV_NOPTS_VALUE);
+if (   pts < - PREROLL_TIME
+|| pts > (INT_MAX-3)/1LL * ASF_INDEXED_INTERVAL - PREROLL_TIME) {
+av_log(s, AV_LOG_ERROR, "input pts %"PRId64" is invalid\n", pts);
+return AVERROR(EINVAL);
+}
 pts *= 1;
 asf->duration = FFMAX(asf->duration, pts + pkt->duration * 1);
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/aviobuf: Fix end check in put_str16()

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer  | 
Wed Jan 13 02:31:59 2016 +0100| [6d5fca34a629daaa1941942130961ffa08bf56a1] | 
committer: Michael Niedermayer

avformat/aviobuf: Fix end check in put_str16()

Fixes out of array read
Fixes: 
03c406ec9530e594a074ce2979f8a1f0/asan_heap-oob_7dec26_4664_37c52495b2870a2eaac65f53958e76c1.flac

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 115fb6d03ef6310732b42258d8c3cd1839cfb74b)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6d5fca34a629daaa1941942130961ffa08bf56a1
---

 libavformat/aviobuf.c |2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index db066f8..3cb8c82 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -359,6 +359,8 @@ static inline int put_str16(AVIOContext *s, const char 
*str, const int be)
 invalid:
 av_log(s, AV_LOG_ERROR, "Invaid UTF8 sequence in avio_put_str16%s\n", 
be ? "be" : "le");
 err = AVERROR(EINVAL);
+if (!*(q-1))
+break;
 }
 if (be)
 avio_wb16(s, 0);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/motion_est: Fix mv_penalty table size

[Michael Niedermayer]

ffmpeg | branch: release/2.5 | Michael Niedermayer  | 
Tue Jan  5 14:41:04 2016 +0100| [1b3dffc0c7ff260e296573a0977735fe9e60d273] | 
committer: Michael Niedermayer

avcodec/motion_est: Fix mv_penalty table size

Fixes out of array read

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5b4da8a38a5ed211df9504c85ce401c30af86b97)

Conflicts:

libavcodec/motion_est.h

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1b3dffc0c7ff260e296573a0977735fe9e60d273
---

 libavcodec/ituh263enc.c|6 +++---
 libavcodec/motion_est.c|   16 
 libavcodec/mpeg12enc.c |6 +++---
 libavcodec/mpegvideo.h |3 ++-
 libavcodec/mpegvideo_enc.c |2 +-
 libavcodec/snowenc.c   |2 +-
 6 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/libavcodec/ituh263enc.c b/libavcodec/ituh263enc.c
index 43ad080..7a91dc0 100644
--- a/libavcodec/ituh263enc.c
+++ b/libavcodec/ituh263enc.c
@@ -43,7 +43,7 @@
 /**
  * Table of number of bits a motion vector component needs.
  */
-static uint8_t mv_penalty[MAX_FCODE+1][MAX_MV*2+1];
+static uint8_t mv_penalty[MAX_FCODE+1][MAX_DMV*2+1];
 
 /**
  * Minimal fcode that a motion vector component would need.
@@ -676,7 +676,7 @@ static av_cold void 
init_mv_penalty_and_fcode(MpegEncContext *s)
 int mv;
 
 for(f_code=1; f_code<=MAX_FCODE; f_code++){
-for(mv=-MAX_MV; mv<=MAX_MV; mv++){
+for(mv=-MAX_DMV; mv<=MAX_DMV; mv++){
 int len;
 
 if(mv==0) len= ff_mvtab[0][1];
@@ -697,7 +697,7 @@ static av_cold void 
init_mv_penalty_and_fcode(MpegEncContext *s)
 }
 }
 
-mv_penalty[f_code][mv+MAX_MV]= len;
+mv_penalty[f_code][mv+MAX_DMV]= len;
 }
 }
 
diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c
index 901fafd..100e503 100644
--- a/libavcodec/motion_est.c
+++ b/libavcodec/motion_est.c
@@ -906,7 +906,7 @@ void ff_estimate_p_frame_motion(MpegEncContext * s,
 c->penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_cmp);
 c->sub_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_sub_cmp);
 c->mb_penalty_factor = get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->mb_cmp);
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 
 get_limits(s, 16*mb_x, 16*mb_y);
 c->skip=0;
@@ -1082,7 +1082,7 @@ int ff_pre_estimate_p_frame_motion(MpegEncContext * s,
 av_assert0(s->quarter_sample==0 || s->quarter_sample==1);
 
 c->pre_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_pre_cmp);
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 
 get_limits(s, 16*mb_x, 16*mb_y);
 c->skip=0;
@@ -1131,7 +1131,7 @@ static int estimate_motion_b(MpegEncContext *s, int mb_x, 
int mb_y,
 const int shift= 1+s->quarter_sample;
 const int mot_stride = s->mb_stride;
 const int mot_xy = mb_y*mot_stride + mb_x;
-uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_MV;
+uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_DMV;
 int mv_scale;
 
 c->penalty_factor= get_penalty_factor(s->lambda, s->lambda2, 
c->avctx->me_cmp);
@@ -1205,8 +1205,8 @@ static inline int check_bidir_mv(MpegEncContext * s,
 //FIXME better f_code prediction (max mv & distance)
 //FIXME pointers
 MotionEstContext * const c= &s->me;
-uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_MV; // f_code 
of the prev frame
-uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_MV; // f_code 
of the prev frame
+uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_DMV; // 
f_code of the prev frame
+uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_DMV; // 
f_code of the prev frame
 int stride= c->stride;
 uint8_t *dest_y = c->scratchpad;
 uint8_t *ptr;
@@ -1419,7 +1419,7 @@ static inline int direct_search(MpegEncContext * s, int 
mb_x, int mb_y)
 int mx, my, xmin, xmax, ymin, ymax;
 int16_t (*mv_table)[2]= s->b_direct_mv_table;
 
-c->current_mv_penalty= c->mv_penalty[1] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[1] + MAX_DMV;
 ymin= xmin=(-32)>>shift;
 ymax= xmax=   31>>shift;
 
@@ -1555,11 +1555,11 @@ void ff_estimate_b_frame_motion(MpegEncContext * s,
 if(s->flags & CODEC_FLAG_INTERLACED_ME){
 //FIXME mb type penalty
 c->skip=0;
-c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
 fimin= interlaced_search(s, 0,
  s->b_field_mv_table[0], 
s->b_field_select_table[0],
  s->b_forw_mv_table[xy][0], 
s->b_forw_mv_table[xy][1], 0);
-c->current_mv_penalty= c->mv_penalty[s->b_code] + MAX_MV;
+c-

[FFmpeg-cvslog] avformat/utils: estimate_timings_from_pts - increase retry counter, fixes invalid duration for ts files with hevc codec

[Rainer Hochecker]

ffmpeg | branch: release/2.5 | Rainer Hochecker  | Sun 
Nov 15 13:58:50 2015 +0100| [50aacb334a341b941603f22b3a0d841046dc4887] | 
committer: Michael Niedermayer

avformat/utils: estimate_timings_from_pts - increase retry counter, fixes 
invalid duration for ts files with hevc codec

Fixes a mpegts file with hevc that fails estimating duration. Increasing number 
of
retries fixes the issue.

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 2d8c2f1a28073d451c7db31291c333cb15ca3d0b)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=50aacb334a341b941603f22b3a0d841046dc4887
---

 libavformat/utils.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/utils.c b/libavformat/utils.c
index 3413a7f..b116a45 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2361,7 +2361,7 @@ static void 
estimate_timings_from_bit_rate(AVFormatContext *ic)
 }
 
 #define DURATION_MAX_READ_SIZE 25LL
-#define DURATION_MAX_RETRY 4
+#define DURATION_MAX_RETRY 6
 
 /* only usable for MPEG-PS streams */
 static void estimate_timings_from_pts(AVFormatContext *ic, int64_t old_offset)

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny dimensions

[Michael Niedermayer]

ffmpeg | branch: release/2.5 | Michael Niedermayer  | 
Mon Jan  4 23:22:25 2016 +0100| [c3abdd0f44615f0bbfde3ebcd1fddabd23d0b332] | 
committer: Michael Niedermayer

swscale/utils: Use normal bilinear scaler if fast cannot be used due to tiny 
dimensions

Fixes Ticket4960

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 1edf129cbc897447a289ca8b045853df5df1bab3)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c3abdd0f44615f0bbfde3ebcd1fddabd23d0b332
---

 libswscale/utils.c |6 ++
 1 file changed, 6 insertions(+)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index b496b8f..82c8e5e 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -1045,6 +1045,12 @@ av_cold int sws_init_context(SwsContext *c, SwsFilter 
*srcFilter,
srcW, srcH, dstW, dstH);
 return AVERROR(EINVAL);
 }
+if (flags & SWS_FAST_BILINEAR) {
+if (srcW < 8 || dstW < 8) {
+flags ^= SWS_FAST_BILINEAR | SWS_BILINEAR;
+c->flags = flags;
+}
+}
 
 if (!dstFilter)
 dstFilter = &dummyFilter;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avutil/mathematics: Fix division by 0

[Michael Niedermayer]

ffmpeg | branch: release/2.5 | Michael Niedermayer  | 
Wed Dec  9 17:39:38 2015 +0100| [5d865cb375c49227d3966858728908ad1d1044f8] | 
committer: Michael Niedermayer

avutil/mathematics: Fix division by 0

Fixes: CID1341571

Signed-off-by: Michael Niedermayer 
(cherry picked from commit bc8b1e694cc395fdf5e2917377ef11263c937d85)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5d865cb375c49227d3966858728908ad1d1044f8
---

 libavutil/mathematics.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavutil/mathematics.c b/libavutil/mathematics.c
index 4d8467b..78a87d8 100644
--- a/libavutil/mathematics.c
+++ b/libavutil/mathematics.c
@@ -90,7 +90,7 @@ int64_t av_rescale_rnd(int64_t a, int64_t b, int64_t c, enum 
AVRounding rnd)
 else {
 int64_t ad = a / c;
 int64_t a2 = (a % c * b + r) / c;
-if (ad >= INT32_MAX && ad > (INT64_MAX - a2) / b)
+if (ad >= INT32_MAX && b && ad > (INT64_MAX - a2) / b)
 return INT64_MIN;
 return ad * b + a2;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avfilter/vf_scale: set proper out frame color range

[Thomas Mundt]

ffmpeg | branch: release/2.5 | Thomas Mundt  | Thu Dec 31 
00:01:21 2015 +0100| [53025e8681c141883662ab9882ac2f7769c6ed4d] | committer: 
Michael Niedermayer

avfilter/vf_scale: set proper out frame color range

Prevents that following scalers in the filter chain will do unintentional color 
range conversions.
Fixes Ticket #5096

Signed-off-by: Thomas Mundt 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 73ce8162f3499cf0e86d1d80dea53324bd62bcb3)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=53025e8681c141883662ab9882ac2f7769c6ed4d
---

 libavfilter/vf_scale.c |2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c
index 64b88c2..237f3b8 100644
--- a/libavfilter/vf_scale.c
+++ b/libavfilter/vf_scale.c
@@ -512,6 +512,8 @@ static int filter_frame(AVFilterLink *link, AVFrame *in)
 sws_setColorspaceDetails(scale->isws[1], inv_table, in_full,
  table, out_full,
  brightness, contrast, saturation);
+
+av_frame_set_color_range(out, out_full ? AVCOL_RANGE_JPEG : 
AVCOL_RANGE_MPEG);
 }
 
 av_reduce(&out->sample_aspect_ratio.num, &out->sample_aspect_ratio.den,

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/h264_slice: Fix integer overflow in implicit weight computation

[Michael Niedermayer]

ffmpeg | branch: release/2.5 | Michael Niedermayer  | 
Tue Jan  5 01:06:18 2016 +0100| [d472b83abc765cc84e569b3778c746c6179a5d2f] | 
committer: Michael Niedermayer

avcodec/h264_slice: Fix integer overflow in implicit weight computation

Fixes mozilla bug 1230423

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7cc01c25727a96eaaa0c177234b626e47c8ea491)

Conflicts:

libavcodec/h264_slice.c

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d472b83abc765cc84e569b3778c746c6179a5d2f
---

 libavcodec/h264_slice.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index 57a135e..b24978a 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -924,7 +924,7 @@ static void implicit_weight_table(H264Context *h, int field)
 cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1];
 }
 if (h->ref_count[0] == 1 && h->ref_count[1] == 1 && !FRAME_MBAFF(h) &&
-h->ref_list[0][0].poc + h->ref_list[1][0].poc == 2 * cur_poc) {
+h->ref_list[0][0].poc + (int64_t)h->ref_list[1][0].poc == 2 * 
cur_poc) {
 h->use_weight= 0;
 h->use_weight_chroma = 0;
 return;
@@ -945,7 +945,7 @@ static void implicit_weight_table(H264Context *h, int field)
 h->chroma_log2_weight_denom = 5;
 
 for (ref0 = ref_start; ref0 < ref_count0; ref0++) {
-int poc0 = h->ref_list[0][ref0].poc;
+int64_t poc0 = h->ref_list[0][ref0].poc;
 for (ref1 = ref_start; ref1 < ref_count1; ref1++) {
 int w = 32;
 if (!h->ref_list[0][ref0].long_ref && 
!h->ref_list[1][ref1].long_ref) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range

[Michael Niedermayer]

ffmpeg | branch: release/2.5 | Michael Niedermayer  | 
Thu Jan  7 00:22:56 2016 +0100| [2111d5161926cef343031efcaf09662afb14db25] | 
committer: Michael Niedermayer

avcodec/mpegvideo_enc: Clip bits_per_raw_sample within valid range

Fixes out of array read
Fixes: test_case-mdc.264 (b47be15a120979f5a1a945c938cbef33)

Found-by: Tyson Smith 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 13f266b50cc7554028d22480b7e4383968e64a63)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2111d5161926cef343031efcaf09662afb14db25
---

 libavcodec/mpegvideo_enc.c |1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index 9b95f33..6b997f1 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -315,6 +315,7 @@ av_cold int ff_mpv_encode_init(AVCodecContext *avctx)
 break;
 }
 
+avctx->bits_per_raw_sample = av_clip(avctx->bits_per_raw_sample, 0, 8);
 s->bit_rate = avctx->bit_rate;
 s->width= avctx->width;
 s->height   = avctx->height;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avcodec/wavpackenc: Check the number of channels

[Michael Niedermayer]

ffmpeg | branch: release/2.5 | Michael Niedermayer  | 
Mon Jan 11 18:58:08 2016 +0100| [4865d66b76f7bb85b837bcadb9f9d7b7337f137a] | 
committer: Michael Niedermayer

avcodec/wavpackenc: Check the number of channels

They are stored in a byte, thus more than 255 is not possible

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 59c915a403af32c4ff5126625b0cc7e38f4beff9)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4865d66b76f7bb85b837bcadb9f9d7b7337f137a
---

 libavcodec/wavpackenc.c |5 +
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/wavpackenc.c b/libavcodec/wavpackenc.c
index ecc4a2e..2d98e53 100644
--- a/libavcodec/wavpackenc.c
+++ b/libavcodec/wavpackenc.c
@@ -128,6 +128,11 @@ static av_cold int wavpack_encode_init(AVCodecContext 
*avctx)
 
 s->avctx = avctx;
 
+if (avctx->channels > 255) {
+av_log(avctx, AV_LOG_ERROR, "Too many channels\n", avctx->channels);
+return AVERROR(EINVAL);
+}
+
 if (!avctx->frame_size) {
 int block_samples;
 if (!(avctx->sample_rate & 1))

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat: Add integer fps from 31 to 60 to get_std_framerate()

[Michael Niedermayer]

ffmpeg | branch: release/2.5 | Michael Niedermayer  | 
Sat Jan  9 10:49:23 2016 +0100| [7974642cfd609d6321ef3e2e4d8f2c84aad1bd9b] | 
committer: Michael Niedermayer

avformat: Add integer fps from 31 to 60 to get_std_framerate()

Fixes Ticket 5106

Signed-off-by: Michael Niedermayer 
(cherry picked from commit 2039b3e7511ef183dae206575114e15b6d99c134)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7974642cfd609d6321ef3e2e4d8f2c84aad1bd9b
---

 libavformat/avformat.h |2 +-
 libavformat/utils.c|   10 +++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/libavformat/avformat.h b/libavformat/avformat.h
index 2e54ed1..6654694 100644
--- a/libavformat/avformat.h
+++ b/libavformat/avformat.h
@@ -916,7 +916,7 @@ typedef struct AVStream {
 /**
  * Stream information used internally by av_find_stream_info()
  */
-#define MAX_STD_TIMEBASES (30*12+7+6)
+#define MAX_STD_TIMEBASES (30*12+30+3+6)
 struct {
 int64_t last_dts;
 int64_t duration_gcd;
diff --git a/libavformat/utils.c b/libavformat/utils.c
index b116a45..bbf67ef 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2802,10 +2802,14 @@ static int get_std_framerate(int i)
 return (i + 1) * 1001;
 i -= 30*12;
 
-if (i < 7)
-return ((const int[]) { 40, 48, 50, 60, 80, 120, 240})[i] * 1001 * 12;
+if (i < 30)
+return (i + 31) * 1001 * 12;
+i -= 30;
 
-i -= 7;
+if (i < 3)
+return ((const int[]) { 80, 120, 240})[i] * 1001 * 12;
+
+i -= 3;
 
 return ((const int[]) { 24, 30, 60, 12, 15, 48 })[i] * 1000 * 12;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] mjpegdec: extend check for incompatible values of s->rgb and s->ls

[Andreas Cadhalpun]

ffmpeg | branch: release/2.5 | Andreas Cadhalpun 
 | Thu Dec 31 16:55:43 2015 +0100| 
[f48392197d365f2a3a62e7ee8786fa4e9a41f3e9] | committer: Michael Niedermayer

mjpegdec: extend check for incompatible values of s->rgb and s->ls

This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.

In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.

This fixes an out-of-bounds read in ls_decode_line.

Reviewed-by: Michael Niedermayer 
Signed-off-by: Andreas Cadhalpun 
(cherry picked from commit 7ea2db6eafa0a8a9497aab20be2cfc8742a59072)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f48392197d365f2a3a62e7ee8786fa4e9a41f3e9
---

 libavcodec/mjpegdec.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index d2624f0..67db2bb 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -609,7 +609,8 @@ unk_pixfmt:
 av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) 
mismatch\n", len);
 }
 
-if (s->rgb && !s->lossless && !s->ls) {
+if ((s->rgb && !s->lossless && !s->ls) ||
+(!s->rgb && s->ls && s->nb_components > 1)) {
 av_log(s->avctx, AV_LOG_ERROR, "Unsupported coding and pixel format 
combination\n");
 return AVERROR_PATCHWELCOME;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] swscale/utils: Fix intermediate format for cascaded alpha downscaling

[Michael Niedermayer]

ffmpeg | branch: release/2.5 | Michael Niedermayer  | 
Thu Dec 24 21:46:15 2015 +0100| [c1521dd418db3ad63019a7f7f2bbc985a3adf31c] | 
committer: Michael Niedermayer

swscale/utils: Fix intermediate format for cascaded alpha downscaling

Fixes Ticket4926

Signed-off-by: Michael Niedermayer 
(cherry picked from commit b83d8be6bff7d645469a623aee0b380541da15cf)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c1521dd418db3ad63019a7f7f2bbc985a3adf31c
---

 libswscale/utils.c |3 +++
 1 file changed, 3 insertions(+)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index 4d91f2d..b496b8f 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -1521,6 +1521,9 @@ fail: // FIXME replace things by appropriate error codes
 int tmpH = sqrt(srcH * (int64_t)dstH);
 enum AVPixelFormat tmpFormat = AV_PIX_FMT_YUV420P;
 
+if (isALPHA(srcFormat))
+tmpFormat = AV_PIX_FMT_YUVA420P;
+
 if (srcW*(int64_t)srcH <= 4LL*dstW*dstH)
 return AVERROR(EINVAL);
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

[FFmpeg-cvslog] avformat/mxfenc: Do not crash if there is no packet in the first stream

[Michael Niedermayer]

ffmpeg | branch: release/2.5 | Michael Niedermayer  | 
Sun Dec 13 16:13:22 2015 +0100| [07b96325311bcc5f79f02a2ff20e6f54b3c4a459] | 
committer: Michael Niedermayer

avformat/mxfenc: Do not crash if there is no packet in the first stream

Fixes: Ticket4914

Signed-off-by: Michael Niedermayer 
(cherry picked from commit b51e7554e74cbf007a1cab83c7bed3ad9fa2793a)

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=07b96325311bcc5f79f02a2ff20e6f54b3c4a459
---

 libavformat/mxfenc.c |4 
 1 file changed, 4 insertions(+)

diff --git a/libavformat/mxfenc.c b/libavformat/mxfenc.c
index 36503f3..7607f95 100644
--- a/libavformat/mxfenc.c
+++ b/libavformat/mxfenc.c
@@ -2122,6 +2122,10 @@ static int mxf_write_packet(AVFormatContext *s, AVPacket 
*pkt)
 }
 mxf->edit_units_count++;
 } else if (!mxf->edit_unit_byte_count && st->index == 1) {
+if (!mxf->edit_units_count) {
+av_log(s, AV_LOG_ERROR, "No packets in first stream\n");
+return AVERROR_PATCHWELCOME;
+}
 mxf->index_entries[mxf->edit_units_count-1].slice_offset =
 mxf->body_offset - 
mxf->index_entries[mxf->edit_units_count-1].offset;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog