Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: FFmpeg/FFmpeg
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 74bd0cf49c9c
Choose a base ref
...
head repository: FFmpeg/FFmpeg
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 6fcd4f3c7255
Choose a head ref

Commits on Sep 28, 2012

  1. mpegaudiodec: fix short_start calculation

    The value should be always 3, as it follows from the specification.
    
    Fix a stack buffer overflow in exponents_from_scale_factors as reported
    by asan. Thanks to Dale Curtis for the sample vector.
    lu-zero committed Sep 28, 2012
    Copy the full SHA
    97cfa55 View commit details
  2. dsputil_mmx: fix reading prior of the src array in sub_hfyu_median_pr…

    …ediction()
    
    This should fix the utvideoenc valgrind failure
    
    Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
    michaelni authored and dwbuiten committed Sep 28, 2012
    Copy the full SHA
    791b595 View commit details
  3. doc/platform: Mention MinGW-w64

    This is the toolchain most, including Libav's nightlies, use to build.
    
    Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
    dwbuiten committed Sep 28, 2012
    Copy the full SHA
    6a3078b View commit details
  4. doc/platform: Remove false claim about MinGW installer

    This works just fine, and has for quite a while, using the mingw-get
    installer.
    
    Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
    dwbuiten committed Sep 28, 2012
    Copy the full SHA
    55254a3 View commit details
  5. doc/platform: Nuke section on linking static MinGW-built libs with MSVC

    This practice is not supported by the MinGW developers, and even requires
    patching the MinGW runtimes in newer versions. Furthermore, we now support
    build with MSVC, so this section is rendered useless.
    
    Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
    dwbuiten committed Sep 28, 2012
    Copy the full SHA
    3e07155 View commit details
  6. doc/platform: Replace Visual Studio section with build instructions

    Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
    dwbuiten committed Sep 28, 2012
    Copy the full SHA
    f45b544 View commit details
  7. doc/faq: Change the Visual Studio entry to reflect current status

    Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
    dwbuiten committed Sep 28, 2012
    Copy the full SHA
    ed8a2dd View commit details
  8. doc/platform: Rework the Visual Studio linking section

    Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
    dwbuiten committed Sep 28, 2012
    Copy the full SHA
    7d1d446 View commit details

Commits on Sep 29, 2012

  1. lavc: set channel count from channel layout in avcodec_open2().

    Some decoders (e.g. nellymoser) only set channel_layout and do not set
    channel count.
    elenril committed Sep 29, 2012
    Copy the full SHA
    12e1e83 View commit details
  2. cavsdec: check for changing w/h.

    Our decoder does not support changing w/h.
    
    Fixes CVE-2012-2777 and CVE-2012-2784.
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    Signed-off-by: Anton Khirnov <anton@khirnov.net>
    michaelni authored and elenril committed Sep 29, 2012
    Copy the full SHA
    c20a696 View commit details
  3. indeo5dec: Make sure we have had a valid gop header.

    This prevents decoding happening on a half initialized context.
    
    Fixes CVE-2012-2779
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    Signed-off-by: Anton Khirnov <anton@khirnov.net>
    michaelni authored and elenril committed Sep 29, 2012
    Copy the full SHA
    8919184 View commit details
  4. Copy the full SHA
    ee715f4 View commit details
  5. indeo4: update AVCodecContext width/height on size change

    Fixes CVE-2012-2787
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    Signed-off-by: Anton Khirnov <anton@khirnov.net>
    michaelni authored and elenril committed Sep 29, 2012
    Copy the full SHA
    b146d74 View commit details
  6. Copy the full SHA
    eeade67 View commit details
  7. Copy the full SHA
    0af49a6 View commit details
  8. wmaprodec: check num_vec_coeffs for validity

    Fixes CVE-2012-2789
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    Signed-off-by: Anton Khirnov <anton@khirnov.net>
    michaelni authored and elenril committed Sep 29, 2012
    Copy the full SHA
    99f392a View commit details
  9. lagarith: check count before writing zeros.

    Fixes CVE-2012-2793
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    Signed-off-by: Anton Khirnov <anton@khirnov.net>
    michaelni authored and elenril committed Sep 29, 2012
    Copy the full SHA
    b631e4e View commit details
  10. Copy the full SHA
    4a96903 View commit details
  11. wmalosslessdec: increase channel_coeffs/residues size

    Fixes CVE-2012-2792
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    elenril committed Sep 29, 2012
    Copy the full SHA
    065b3a1 View commit details
  12. Merge commit 'b146d74730ab9ec5abede9066f770ad851e45fbc'

    * commit 'b146d74730ab9ec5abede9066f770ad851e45fbc':
      indeo4: update AVCodecContext width/height on size change
      dfa: check that the caller set width/height properly.
      indeo5dec: Make sure we have had a valid gop header.
      cavsdec: check for changing w/h.
      lavc: set channel count from channel layout in avcodec_open2().
      doc/platform: Rework the Visual Studio linking section
      doc/faq: Change the Visual Studio entry to reflect current status
      doc/platform: Replace Visual Studio section with build instructions
      doc/platform: Nuke section on linking static MinGW-built libs with MSVC
      doc/platform: Remove false claim about MinGW installer
      doc/platform: Mention MinGW-w64
      dsputil_mmx: fix reading prior of the src array in sub_hfyu_median_prediction()
      mpegaudiodec: fix short_start calculation
    
    Conflicts:
    	doc/faq.texi
    	doc/platform.texi
    	libavcodec/cavsdec.c
    	libavcodec/indeo5.c
    	libavcodec/ivi_common.h
    
    Merged-by: Michael Niedermayer <michaelni@gmx.at>
    michaelni committed Sep 29, 2012
    Copy the full SHA
    8672fc7 View commit details
  13. Merge remote-tracking branch 'qatar/master'

    * qatar/master:
      wmalosslessdec: increase channel_coeffs/residues size
      wmalosslessdec: increase WMALL_BLOCK_MAX_BITS to 14.
      lagarith: check count before writing zeros.
      wmaprodec: check num_vec_coeffs for validity
      avidec: use actually read size instead of requested size
      avidec: return 0, not packet size from read_packet().
    
    Conflicts:
    	libavcodec/lagarith.c
    	libavcodec/wmalosslessdec.c
    	libavcodec/wmaprodec.c
    	libavformat/avidec.c
    
    Merged-by: Michael Niedermayer <michaelni@gmx.at>
    michaelni committed Sep 29, 2012
    Copy the full SHA
    b96dc09 View commit details
  14. dfa: replace redundant check by assert

    The values are checked in the wraper function used to call this code.
    
    This was introduced by: ee715f4
    
    Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
    michaelni committed Sep 29, 2012
    Copy the full SHA
    6fcd4f3 View commit details
Showing with 41 additions and 22 deletions.
  1. +5 −3 libavcodec/cavsdec.c
  2. +8 −0 libavcodec/dfa.c
  3. +4 −2 libavcodec/indeo5.c
  4. +4 −2 libavcodec/ivi_common.c
  5. +3 −2 libavcodec/lagarith.c
  6. +9 −4 libavcodec/utils.c
  7. +6 −7 libavcodec/wmalosslessdec.c
  8. +2 −2 libavformat/avidec.c
8 changes: 5 additions & 3 deletions libavcodec/cavsdec.c
Original file line number Diff line number Diff line change
@@ -1073,18 +1073,20 @@ static int decode_seq_header(AVSContext *h) {
h->profile = get_bits(&s->gb,8);
h->level = get_bits(&s->gb,8);
skip_bits1(&s->gb); //progressive sequence
width = get_bits(&s->gb,14);
height = get_bits(&s->gb,14);

width = get_bits(&s->gb, 14);
height = get_bits(&s->gb, 14);
if ((s->width || s->height) && (s->width != width || s->height != height)) {
av_log_missing_feature(s, "Width/height changing in CAVS is", 0);
return -1;
return AVERROR_PATCHWELCOME;
}
if (width <= 0 || height <= 0) {
av_log(s, AV_LOG_ERROR, "Dimensions invalid\n");
return AVERROR_INVALIDDATA;
}
s->width = width;
s->height = height;

skip_bits(&s->gb,2); //chroma format
skip_bits(&s->gb,3); //sample_precision
h->aspect_ratio = get_bits(&s->gb,4);
8 changes: 8 additions & 0 deletions libavcodec/dfa.c
Original file line number Diff line number Diff line change
@@ -20,8 +20,11 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/

#include "libavutil/avassert.h"
#include "avcodec.h"
#include "bytestream.h"

#include "libavutil/imgutils.h"
#include "libavutil/lzo.h" // for av_memcpy_backptr

typedef struct DfaContext {
@@ -37,6 +40,11 @@ static av_cold int dfa_decode_init(AVCodecContext *avctx)

avctx->pix_fmt = PIX_FMT_PAL8;

if (!avctx->width || !avctx->height)
return AVERROR_INVALIDDATA;

av_assert0(av_image_check_size(avctx->width, avctx->height, 0, avctx) >= 0);

s->frame_buf = av_mallocz(avctx->width * avctx->height + AV_LZO_OUTPUT_PADDING);
if (!s->frame_buf)
return AVERROR(ENOMEM);
6 changes: 4 additions & 2 deletions libavcodec/indeo5.c
Original file line number Diff line number Diff line change
@@ -321,8 +321,10 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)

if (ctx->frame_type == FRAMETYPE_INTRA) {
ctx->gop_invalid = 1;
if (decode_gop_header(ctx, avctx))
return -1;
if (decode_gop_header(ctx, avctx)) {
av_log(avctx, AV_LOG_ERROR, "Invalid GOP header, skipping frames.\n");
return AVERROR_INVALIDDATA;
}
ctx->gop_invalid = 0;
}

6 changes: 4 additions & 2 deletions libavcodec/ivi_common.c
Original file line number Diff line number Diff line change
@@ -755,11 +755,13 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
ctx->frame_size = buf_size;

result = ctx->decode_pic_hdr(ctx, avctx);
if (result || ctx->gop_invalid) {
if (result) {
av_log(avctx, AV_LOG_ERROR,
"Error while decoding picture header: %d\n", result);
return -1;
}
if (ctx->gop_invalid)
return AVERROR_INVALIDDATA;

if (ctx->gop_flags & IVI5_IS_PROTECTED) {
av_log(avctx, AV_LOG_ERROR, "Password-protected clip!\n");
@@ -805,8 +807,8 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
if (ctx->frame.data[0])
avctx->release_buffer(avctx, &ctx->frame);

avcodec_set_dimensions(avctx, ctx->planes[0].width, ctx->planes[0].height);
ctx->frame.reference = 0;
avcodec_set_dimensions(avctx, ctx->planes[0].width, ctx->planes[0].height);
if ((result = avctx->get_buffer(avctx, &ctx->frame)) < 0) {
av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
return result;
5 changes: 3 additions & 2 deletions libavcodec/lagarith.c
Original file line number Diff line number Diff line change
@@ -365,10 +365,11 @@ static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst,
output_zeros:
if (l->zeros_rem) {
count = FFMIN(l->zeros_rem, width - i);
if(end - dst < count) {
av_log(l->avctx, AV_LOG_ERROR, "too many zeros remaining\n");
if (end - dst < count) {
av_log(l->avctx, AV_LOG_ERROR, "Too many zeros remaining.\n");
return AVERROR_INVALIDDATA;
}

memset(dst, 0, count);
l->zeros_rem -= count;
dst += count;
13 changes: 9 additions & 4 deletions libavcodec/utils.c
Original file line number Diff line number Diff line change
@@ -1023,10 +1023,15 @@ int attribute_align_arg avcodec_open2(AVCodecContext *avctx, const AVCodec *code
if (!avctx->bit_rate)
avctx->bit_rate = get_bit_rate(avctx);
/* validate channel layout from the decoder */
if (avctx->channel_layout &&
av_get_channel_layout_nb_channels(avctx->channel_layout) != avctx->channels) {
av_log(avctx, AV_LOG_WARNING, "channel layout does not match number of channels\n");
avctx->channel_layout = 0;
if (avctx->channel_layout) {
int channels = av_get_channel_layout_nb_channels(avctx->channel_layout);
if (!avctx->channels)
avctx->channels = channels;
else if (channels != avctx->channels) {
av_log(avctx, AV_LOG_WARNING,
"channel layout does not match number of channels\n");
avctx->channel_layout = 0;
}
}
}
end:
13 changes: 6 additions & 7 deletions libavcodec/wmalosslessdec.c
Original file line number Diff line number Diff line change
@@ -23,6 +23,8 @@
*/

#include "libavutil/attributes.h"
#include "libavutil/avassert.h"

#include "avcodec.h"
#include "internal.h"
#include "get_bits.h"
@@ -38,7 +40,7 @@
#define MAX_ORDER 256

#define WMALL_BLOCK_MIN_BITS 6 ///< log2 of min block size
#define WMALL_BLOCK_MAX_BITS 12 ///< log2 of max block size
#define WMALL_BLOCK_MAX_BITS 14 ///< log2 of max block size
#define WMALL_BLOCK_MAX_SIZE (1 << WMALL_BLOCK_MAX_BITS) ///< maximum block size
#define WMALL_BLOCK_SIZES (WMALL_BLOCK_MAX_BITS - WMALL_BLOCK_MIN_BITS + 1) ///< possible block sizes

@@ -213,12 +215,9 @@ static av_cold int decode_init(AVCodecContext *avctx)
s->len_prefix = s->decode_flags & 0x40;

/* get frame len */
bits = ff_wma_get_frame_len_bits(avctx->sample_rate, 3, s->decode_flags);
if (bits > WMALL_BLOCK_MAX_BITS) {
av_log_missing_feature(avctx, "big-bits block sizes", 1);
return AVERROR_INVALIDDATA;
}
s->samples_per_frame = 1 << bits;
s->samples_per_frame = 1 << ff_wma_get_frame_len_bits(avctx->sample_rate,
3, s->decode_flags);
av_assert0(s->samples_per_frame <= WMALL_BLOCK_MAX_SIZE);

/* init previous block len */
for (i = 0; i < avctx->channels; i++)
4 changes: 2 additions & 2 deletions libavformat/avidec.c
Original file line number Diff line number Diff line change
@@ -1205,7 +1205,7 @@ static int avi_read_packet(AVFormatContext *s, AVPacket *pkt)
}
ast->frame_offset += get_duration(ast, pkt->size);
}
ast->remaining -= size;
ast->remaining -= err;
if(!ast->remaining){
avi->stream_index= -1;
ast->packet_size= 0;
@@ -1227,7 +1227,7 @@ static int avi_read_packet(AVFormatContext *s, AVPacket *pkt)
avi->dts_max = dts;
}

return size;
return 0;
}

if ((err = avi_sync(s, 0)) < 0)