Commits · e58870a58749eb3266e16166d8370a5f2e960311 · sixue.cheng / ffmpeg-7.1

04 Nov, 2011 36 commits

mov: 10l: Terminate string with 0 not '0' · e58870a5

Alex Converse authored 13 years ago

(cherry picked from commit 7ad06beb

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

e58870a5

mov: Prevent illegal writes when chapter titles are very short. · 5c18bcfd
Alex Converse authored 13 years ago
```
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
```
5c18bcfd

truespeech: check to make sure channels == 1 · 62cf52c8

Justin Ruggles authored 13 years ago

(cherry picked from commit 3e7a1767

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

62cf52c8

mlpdec: validate that the reported channel count matches the actual output · 7e95a12d
Justin Ruggles authored 13 years ago
```
channel count
(cherry picked from commit caa84585

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
```
7e95a12d

rtpdec: Read the packet length for all RTCP packet types · 2c0cddf2

John Brooks authored 13 years ago


This allows skipping past unsupported RTCP packet types, as
RFC 3550 section 6.1 mandates.

Currently this only has any practical effect if a sender puts
an unrecognized type before RTCP_BYE in a compounded packet, or
(incorrectly) does not put RTCP_SR first.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 07b77fe3

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

2c0cddf2

rtpdec: Fix the minimum packet length for RTCP SR packets · d398d042

John Brooks authored 13 years ago


We actually read 20 bytes of these packets.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d6ecf53

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

d398d042

mem: fix memalign hack av_realloc() · 5ae87280

Michael Niedermayer authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc119278

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

5ae87280

arm: fix av_clipl_int32() asm · 7d02df70

Michael Niedermayer authored 13 years ago


Note, the other arm asm code is likely affected too and should be changed as well.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 96bc6485

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

7d02df70

h264: fix HRD parameters parsing · 1c3d46a9

Mans Rullgard authored 13 years ago


The bit_rate_value_minus1 and cpb_size_value_minus1 elements
allow a wider range than get_ue_golomb() supports.  This
adds a get_ue_golomb_long() function supporting up to 31
leading zeros, which is the maximum for these syntax
elements, and uses it in decode_hrd_parameters().
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit fdba370f

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1c3d46a9

smacker: validate channels and sample format. · 800ab099
Justin Ruggles authored 13 years ago
```
(cherry picked from commit ff1f89de

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
```
800ab099
smacker: check buffer size before reading output size · e6b22553
Justin Ruggles authored 13 years ago
```
(cherry picked from commit cf044f8b

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
```
e6b22553

smacker: validate number of channels · 7f7b2e89

Justin Ruggles authored 13 years ago

(cherry picked from commit e190e453

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

7f7b2e89

sipr: fix get_bits(0) calls · 73f85eae

Mans Rullgard authored 13 years ago


Zero-length get_bits() is undefined, must check before calling.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit c79d2a20

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

73f85eae

mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions. · 9b6080f6
Alex Converse authored 13 years ago
```
(cherry picked from commit 0c46e958

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
```
9b6080f6

4xm: fix signed overflow · 190807a5

Mans Rullgard authored 13 years ago

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 84dda407

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

190807a5

wmavoice: fix a signed overflow · 33029d73

Mans Rullgard authored 13 years ago

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit ba3f07d0

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

33029d73

mpegvideo_enc: fix a signed overflow · c4195009

Mans Rullgard authored 13 years ago

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 05795f35

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

c4195009

crc: fix signed overflow · f65e396a

Mans Rullgard authored 13 years ago


This fixes a signed overflow from i << 24 when i == 255 by
making i unsigned.  The result of the shift is already
assigned to an variable of unsigned type.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 8b19ae07

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

f65e396a

h264pred: use unsigned types for pixel values, fix signed overflows · 115d88c4

Mans Rullgard authored 13 years ago

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 60f10e0a

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

115d88c4

qtrle: check for out of bound writes. · a6504591

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7fb92be7

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

a6504591

xxan: check for out of bound accesses · adb12c4d

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a68a6a4f

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

adb12c4d

txd: check for out of bound reads. · ca58b215

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e182de9a

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

ca58b215

qtrle: check for invalid line offset · 67c46b9b

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4ed7c3f

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

67c46b9b

vqavideo: check for out of bound reads. · 7ab0b6b7

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6d45702f

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

7ab0b6b7

vqa: fix double free on corrupted streams · b832e539

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e3123856

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

b832e539

vqavideo: check for invalid/unsupported version · 2fdbc1d5

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b226af39

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

2fdbc1d5

eamad: release the reference frame on video size changes · 5415c488

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6c1fb3e7

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

5415c488

eamad: check for out of bound reads when doing MC · 79bafbb0

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit da357973

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

79bafbb0

eamad: avoid NULL derefence when missing the reference frame. · 7b3c8515

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6e20554a

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

7b3c8515

eatgv: fix pointer arithmetic overflows. · 1b6e6439

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6bfe0d4c

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1b6e6439

eatgv: fix out of bound reads on corrupted motions vectors. · 44740513

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 09302a89

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

44740513

eamad: clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffer · 1646d2d2

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 74b9c598

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1646d2d2

lavf: fix signed overflow in avformat_find_stream_info() · edc94220

Mans Rullgard authored 13 years ago


On the first iteration through this code, last_dts is always
INT64_MIN (AV_NOPTS_VALUE) and the subtraction overflows in
an invalid manner.  Although the result is only used if the
input values are valid, performing the subtraction is still
not allowed in a strict environment.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit a31e9f68

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

edc94220

vp8: fix signed overflows · f7be632c

Mans Rullgard authored 13 years ago


In addition to avoiding undefined behaviour, an unsigned type
makes more sense for packing multiple 8-bit values.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit bb591566

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

f7be632c

motion_est: fix some signed overflows · 4ba0e037

Mans Rullgard authored 13 years ago

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit e708afd3

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

4ba0e037

dca: fix signed overflow in shift · 37ce6ba4

Mans Rullgard authored 13 years ago

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 559c244d

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

37ce6ba4

03 Nov, 2011 4 commits

aacdec: fix undefined shifts · c2c83dcb

Mans Rullgard authored 13 years ago


Since nnz can be zero, this is needed to avoid a shift by 32.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit d1229430

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

c2c83dcb

put_bits: fix invalid shift by 32 in flush_put_bits() · 4c5cdb49

Mans Rullgard authored 13 years ago


If flush_put_bits() is called when the 32-bit buffer is empty,
e.g. after writing a multiple of 32 bits, and invalid shift by
32 is performed.  Since flush_put_bits() is called infrequently,
this additional check should have negligible performance impact.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit ac6eab14

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

4c5cdb49

h264: fix the size of PPS::chroma_qp_table · 06b15b37

Laurent Aimar authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e588a5c2

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

06b15b37

h264: fix fill_colmap() to not store entries mbaff style when the reference is not mbaff at all · 614ef0dc

Michael Niedermayer authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a3ba542a

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

614ef0dc

GitLab

Menu