Commits · n0.7.13 · sixue.cheng / FFmpeg

09 Jun, 2012 21 commits

Update for 0.7.13 · 84ffe14e
Michael Niedermayer authored 13 years ago
```
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
```
84ffe14e

Merge branch 'release/0.8' into release/0.7 · 796039ad

Michael Niedermayer authored 13 years ago


* release/0.8:
  Update for 0.8.12
  mpc8: fix channel checks
  h263: disable loop filter with lowres
  wmv1: check that the input buffer is large enough
  yopdec: check frame oddness to be within supported limits
  yopdec: check that palette fits in the packet
  8svx: fix crash
  binkaudio: check number of channels
  indeo5: check quant_mat
  truemotion1: Check index, fix out of array read
  iff: check if there is extradata
  ape: Fix null ptr dereference with files missing a seekatable.
  4xm: fix division by zero caused by bps<8
  jvdec: check videosize
  motionpixels: check extradata size
  iff_ilbm: fix null ptr deref
  yop: check for missing extradata
  xan: fix out of array read
  cdgraphics: Fix out of array write

Conflicts:
	Doxyfile
	RELEASE
	VERSION
Merged-by: Michael Niedermayer <michaelni@gmx.at>

796039ad

Update for 0.8.12 · 858c3158
Michael Niedermayer authored 13 years ago
```
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
```
858c3158

mpc8: fix channel checks · 5e87fa34

Michael Niedermayer authored 13 years ago


fix heap array overflow
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 44c10168

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

5e87fa34

h263: disable loop filter with lowres · 6a441ee7

Michael Niedermayer authored 13 years ago


Fixes ticket1212
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc229d4e

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

6a441ee7

wmv1: check that the input buffer is large enough · 316589e1

Michael Niedermayer authored 13 years ago


Fixes null ptr deref
Fixes Ticket1367
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f23a2418

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

316589e1

yopdec: check frame oddness to be within supported limits · 35bf5f79

Michael Niedermayer authored 13 years ago


Fixes Ticket1365
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit febc013d

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

35bf5f79

yopdec: check that palette fits in the packet · 89409be5

Michael Niedermayer authored 13 years ago

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b6fdf8de

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

89409be5

8svx: fix crash · a4bf9033

Michael Niedermayer authored 13 years ago


Fixes Ticket1377
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 03ce421c

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

a4bf9033

binkaudio: check number of channels · 8502b4ae

Paul B Mahol authored 13 years ago


Fixes #1380.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit 824a6975

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

8502b4ae

indeo5: check quant_mat · 03e40474

Michael Niedermayer authored 13 years ago


prevents out of array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8aaa00c3

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

03e40474

truemotion1: Check index, fix out of array read · 688da036

Michael Niedermayer authored 13 years ago


Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fd4c1c0b

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

688da036

iff: check if there is extradata · c761e144

Paul B Mahol authored 13 years ago


Fixes #1368.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit 8f615269

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

c761e144

ape: Fix null ptr dereference with files missing a seekatable. · b3e5c8de

Michael Niedermayer authored 13 years ago


Such files are currently not supported as the table is used at several points

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e7cb1615

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

b3e5c8de

4xm: fix division by zero caused by bps<8 · ee6c1670

Michael Niedermayer authored 13 years ago


Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1b8741a6

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

ee6c1670

jvdec: check videosize · 9e4a68a7

Michael Niedermayer authored 13 years ago


Fixes null ptr dereference
fixes Ticket1364
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b4904e80

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

9e4a68a7

motionpixels: check extradata size · 25594f00

Michael Niedermayer authored 13 years ago


Fixes null ptr derefernce
Fixes Ticket1363
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 50122084

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

25594f00

iff_ilbm: fix null ptr deref · a85c3fff

Michael Niedermayer authored 13 years ago


Fixes Ticket1362
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 849d4b04

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

a85c3fff

yop: check for missing extradata · 0f5840b5

Michael Niedermayer authored 13 years ago


Fixes null ptr deref
Fixes Ticket1361
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 77a4c8b9

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

0f5840b5

xan: fix out of array read · 1285fe55

Michael Niedermayer authored 13 years ago


Fixes ticket1360
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 01900fcc

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1285fe55

cdgraphics: Fix out of array write · 0aefcb6a

Michael Niedermayer authored 13 years ago


Fixes Ticket1359
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e5c7376

)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

0aefcb6a

04 Jun, 2012 2 commits

Merge branch 'release/0.8' into release/0.7 · a56b07b5

Michael Niedermayer authored 13 years ago


* release/0.8:
  Update RELEASE file for 0.7.6
  Update changelog for 0.7.6 release
  ea: check chunk_size for validity.
  png: check bit depth for PAL8/Y400A pixel formats.
  x86: fix build with gcc 4.7
  qdm2: clip array indices returned by qdm2_get_vlc().
  kmvc: Check palsize.
  aacsbr: prevent out of bounds memcpy().
  rtpdec_asf: Fix integer underflow that could allow remote code execution
  dpcm: ignore extra unpaired bytes in stereo streams.
  tqi: Pass errors from the MB decoder
  h264: Add check for invalid chroma_format_idc
  adpcm: ADPCM Electronic Arts has always two channels
  h263dec: Disallow width/height changing with frame threads.
  vqavideo: return error if image size is not a multiple of block size
  celp filters: Do not read earlier than the start of the 'out' vector.
  motionpixels: Clip YUV values after applying a gradient.
  h263: more strictly forbid frame size changes with frame-mt.
  h264: additional protection against unsupported size/bitdepth changes.
  Update for 0.8.11

Conflicts:
	Doxyfile
	RELEASE
	VERSION
Merged-by: Michael Niedermayer <michaelni@gmx.at>

a56b07b5

Merge remote-tracking branch 'qatar/release/0.7' into release/0.8 · 64bc5f3b

Michael Niedermayer authored 13 years ago


* qatar/release/0.7:
  Update RELEASE file for 0.7.6
  Update changelog for 0.7.6 release
  ea: check chunk_size for validity.
  png: check bit depth for PAL8/Y400A pixel formats.
  x86: fix build with gcc 4.7
  qdm2: clip array indices returned by qdm2_get_vlc().
  kmvc: Check palsize.
  aacsbr: prevent out of bounds memcpy().
  rtpdec_asf: Fix integer underflow that could allow remote code execution
  dpcm: ignore extra unpaired bytes in stereo streams.
  tqi: Pass errors from the MB decoder
  h264: Add check for invalid chroma_format_idc
  adpcm: ADPCM Electronic Arts has always two channels
  h263dec: Disallow width/height changing with frame threads.
  vqavideo: return error if image size is not a multiple of block size
  celp filters: Do not read earlier than the start of the 'out' vector.
  motionpixels: Clip YUV values after applying a gradient.
  h263: more strictly forbid frame size changes with frame-mt.
  h264: additional protection against unsupported size/bitdepth changes.

Conflicts:
	Changelog
	RELEASE
	libavcodec/aacsbr.c
	libavcodec/h264_ps.c
	libavcodec/pngdec.c
	libavformat/rtpdec_asf.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>

64bc5f3b

03 Jun, 2012 4 commits

Update RELEASE file for 0.7.6 · b61e311b
Reinhard Tartler authored 13 years ago

b61e311b
Update changelog for 0.7.6 release · ee66a719
Reinhard Tartler authored 13 years ago

ee66a719

ea: check chunk_size for validity. · 50336dc4

Ronald S. Bultje authored 13 years ago

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 273e6af4

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 6a86b705e1d4b72f0dddfbe23ad3eed9947001d5)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

50336dc4

png: check bit depth for PAL8/Y400A pixel formats. · 269dbc53

Ronald S. Bultje authored 13 years ago

Wrong bit depth can lead to invalid rowsize values, which crashes the
decoder further down.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d2205d65

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit b8d6ba9d50e80fdce2ed74cdaffd4960df8a21c5)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

269dbc53

02 Jun, 2012 2 commits

x86: fix build with gcc 4.7 · 850298ef

Mans Rullgard authored 13 years ago


The upcoming gcc 4.7 has more advanced constant propagation
resulting some inline asm operands becoming constants and thus
emitted as literals, sometimes in contexts where this results
in invalid instructions.

This patch changes the constraints of the relevant operands
to "rm" thus forcing a valid type.  While obviously suboptimal,
this is what older gcc versions already did, and there is no
change to the code generated with these.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit da4c7cce

)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

850298ef

qdm2: clip array indices returned by qdm2_get_vlc(). · 628b8229

Ronald S. Bultje authored 13 years ago


Prevents subsequent overreads when these numbers are used as indices
in arrays.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 64953f67

)
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Conflicts:

	libavcodec/qdm2.c

628b8229

29 May, 2012 1 commit

kmvc: Check palsize. · 75d8cccf

Alex Converse authored 13 years ago

Fixes: CVE-2011-3952

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Based on fix by Michael Niedermayer
(cherry picked from commit 386741f8)
(cherry picked from commit 416849f2

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

75d8cccf

28 May, 2012 3 commits

aacsbr: prevent out of bounds memcpy(). · d87997b5

Alex Converse authored 13 years ago


Fixes Libav Bug 195.
Fixes CVE-2012-0850

This doesn't make the code handle sample rate or upsample/downsample
change properly but this is still a good sanity check.

Based on change by Michael Niedermayer.
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 17ce5291

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

d87997b5

rtpdec_asf: Fix integer underflow that could allow remote code execution · b15e85d8

Michael Niedermayer authored 13 years ago


Fixes MSVR-11-0088
Fixes CVE-2011-4031
Credit:  Jeong Wook Oh of Microsoft and Microsoft Vulnerability Research (MSVR)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5ea091fb

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

b15e85d8

dpcm: ignore extra unpaired bytes in stereo streams. · 654b24f6

Alex Converse authored 13 years ago

Fixes: CVE-2011-3951

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ce7aee9b)
(cherry picked from commit eaeaeb26

)

Conflicts:

	libavcodec/dpcm.c
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

654b24f6

23 May, 2012 3 commits

tqi: Pass errors from the MB decoder · 2f2fd8c6

Michael Niedermayer authored 13 years ago

This silences some valgrind warnings.
CC: libav-stable@libav.org

Fixes second half of http://ffmpeg.org/trac/ffmpeg/ticket/794


Bug found by: Oana Stratulat
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit f85334f5)
(cherry picked from commit 90290a51

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 5872580e

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

2f2fd8c6

h264: Add check for invalid chroma_format_idc · c5f7c755

Alexander Strange authored 13 years ago


Fixes a crash when FF_DEBUG_PICT_INFO is used.
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit 6ef40639

)

Fixes: CVE-2012-0851
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 47132345

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

c5f7c755

adpcm: ADPCM Electronic Arts has always two channels · b581580b

Janne Grunau authored 13 years ago

Fixes half of http://ffmpeg.org/trac/ffmpeg/ticket/794
Adresses CVE-2012-0852

(cherry picked from commit bb5b3940

)

Conflicts:

	libavcodec/adpcm.c
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

b581580b

22 May, 2012 1 commit

h263dec: Disallow width/height changing with frame threads. · 3313f31f

Michael Niedermayer authored 13 years ago


Fixes CVE-2011-3937

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 71db86d5

)

Conflicts:

	libavcodec/h263dec.c
Signed-off-by: Alex Converse <alex.converse@gmail.com>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 4be63587

)

Conflicts:

	libavcodec/h263dec.c
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

3313f31f

06 May, 2012 3 commits

vqavideo: return error if image size is not a multiple of block size · c71c77e5

Mans Rullgard authored 13 years ago


The decoder assumes in various places that the image size
is a multiple of the block size, and there is no obvious
way to support odd sizes.  Bailing out early if the header
specifies a bad size avoids various errors later on.

Fixes CVE-2012-0947.
Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 58b2e0f0

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit d5207e2a

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

c71c77e5

celp filters: Do not read earlier than the start of the 'out' vector. · 08c81f73

Alex Converse authored 13 years ago

CC: libav-stable@libav.org
(cherry picked from commit 37ddd383

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 9ea94c44

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

08c81f73

motionpixels: Clip YUV values after applying a gradient. · 50073e23

Alex Converse authored 13 years ago

Prevents illegal reads on truncated and malformed input.

CC: libav-stable@libav.org
(cherry picked from commit b5da848f

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit aaa6a666

)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

50073e23

GitLab

Menu