c0fd077 | Martin Storsjö | 24 March 2016, 09:27:49 UTC | tls: Use the right return value for breaking out due to the interrupt callback The retry_transfer_wrapper function higher up in the call chain ignores AVERROR(EINTR), which only means "interrupted by system call". This makes sure that returning due to the interrupt callback works as intended. CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st> | 26 March 2016, 21:33:26 UTC |
b8b89f9 | Martin Storsjö | 11 November 2015, 19:42:02 UTC | rtmpcrypt: Do the xtea decryption in little endian mode The XTEA algorithm operates on 32 bit numbers, not on byte sequences. The XTEA implementation in libavutil is written assuming big endian numbers, while the rtmpe signature encryption assumes little endian. This fixes rtmpe communication with rtmpe servers that use signature type 8 (XTEA), e.g. crunchyroll. CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st> | 13 November 2015, 20:17:09 UTC |
e863f4c | Reinhard Tartler | 31 May 2015, 15:39:39 UTC | Update Changelog for 10.7 | 31 May 2015, 15:39:39 UTC |
964fef3 | Luca Barbato | 25 May 2015, 20:30:10 UTC | h264: Make sure reinit failures mark the context as not initialized Bug-Id: CVE-2015-3417 CC: libav-stable@libav.org (cherry picked from commit 3b69f245dbe6e2016659a45c4bfe284f6c5ac57e) Signed-off-by: Reinhard Tartler <siretart@tauware.de> Conflicts: libavcodec/h264_slice.c | 31 May 2015, 15:35:35 UTC |
48c7fe5 | Luca Barbato | 25 May 2015, 19:53:26 UTC | msrle: Use FFABS to determine the frame size in msrle_decode_pal4 As done in msrle_decode_8_16_24_32. Bug-Id: CVE-2015-3395 CC: libav-stable@libav.org | 31 May 2015, 15:23:54 UTC |
6085253 | Michael Niedermayer | 28 May 2015, 10:38:35 UTC | x86: cavs: Remove an unneeded scratch buffer Simplifies the code and makes it build on certain compilers running out of registers on x86. CC: libav-stable@libav.org Reported-By: mudler (cherry picked from commit e4610300de6869bd6b3b00e76cfeabb6d7653dcd) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit 4dc0fbb13c33b4e5bdb766652f4daf900ccc952f) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:23:31 UTC |
9eba675 | Mikulas Patocka | 15 September 2014, 12:11:21 UTC | configure: Disable i686 for i586 and lower CPUs (cherry picked from commit b37bfbfbe53917820d1f97312fa0b2e8c7a15217) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:22:09 UTC |
5e88675 | Shiina Hideaki | 07 May 2015, 00:46:55 UTC | mjpegenc: Fix JFIF header byte ordering The header had a wrong version description. Bug-Id: 808 Signed-off-by: Shiina Hideaki <shiina@yndrd.com> Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com> (cherry picked from commit 5549f693d2181b3211427f65e48eaa2f4fc5a402) Signed-off-by: Reinhard Tartler <siretart@tauware.de> Conflicts: libavcodec/mjpegenc_common.c | 31 May 2015, 15:21:44 UTC |
c34d109 | Luca Barbato | 29 April 2015, 19:29:49 UTC | nut: Make sure to clean up on read_header failure Based on Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> work. CC: libav-stable@libav.org (cherry picked from commit 1f64b018cbec018fa66a4a20f79958d9707913de) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:19:45 UTC |
f29cf57 | wm4 | 08 May 2015, 15:01:50 UTC | png: Set the color range as full range The format uses full range for the gray formats. CC: libav-stable@libav.org (cherry picked from commit 0f50c53cfb959162f2bccc1a2c2e066d35723595) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:19:32 UTC |
0654518 | Andreas Cadhalpun | 06 May 2015, 00:26:57 UTC | avi: Validate sample_size And either error out or set it to 0 if it is negative. CC: libav-stable@libav.org Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit a55a70644872027fdf76a75edf12a09c9008880f) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:19:22 UTC |
3bebca9 | Andreas Cadhalpun | 28 April 2015, 18:57:59 UTC | nut: Check chapter creation in decode_info_header This fixes a segmentation fault when accessing the metadata. Signed-off-by: Luca Barbato <lu_zero@gentoo.org> CC: libav-stable@libav.org (cherry picked from commit 21b21aed797b5e636adcf2df811f96a95f208930) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:19:11 UTC |
1dcb68c | Andreas Cadhalpun | 23 April 2015, 22:01:43 UTC | alac: Reject rice_limit 0 if compression is used If in compression mode rice_limit = 0 leads to call `show_bits(gb, k)` in `decode_scalar` with k = 0. Request a sample in case it is valid and it should be accepted. Signed-off-by: Luca Barbato <lu_zero@gentoo.org> CC: libav-stable@libav.org (cherry picked from commit cb5324200ccdc693dd5b28dcd7d4b722fad83ea2) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:19:02 UTC |
9726f30 | Andreas Cadhalpun | 29 April 2015, 18:39:22 UTC | ape: Support _0000 files with nblock smaller than 64 The decode_array_0000 assumed that 64 is the minimal block size while it is not. CC: libav-stable@libav.org Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit ac1660509ecfbeca7b63eb5ab8360011180e705b) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:18:50 UTC |
296d70f | Michael Niedermayer | 01 May 2015, 22:55:42 UTC | mux: Do not leave stale side data pointers in ff_interleave_add_packet() Signed-off-by: Michael Niedermayer <michaelni@gmx.at> Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com> (cherry picked from commit 386e80610de282c92ad5897683ccaf2675766ac5) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:18:03 UTC |
e3c4eb8 | Nidhi Makhijani | 14 July 2014, 06:22:44 UTC | avpacket: Check for and return errors in ff_interleave_add_packet() Signed-off-by: Diego Biurrun <diego@biurrun.de> (cherry picked from commit 324ff59444ff5470bb325ff1e2be7c4b054fc944) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:17:37 UTC |
feedde4 | John Högberg | 28 April 2015, 08:20:33 UTC | mpegts: Update the PSI/SI table only if the version change If a PAT is finished while a PMT section filter is opened but not yet finished, the PMT section filter is closed and all the received data is discarded. This is usually not an issue but some multiplexers (With very quick PAT/PMT repetition settings) consistently emit a PMT section start, then a PAT, and then the rest of the PMT, causing the aforementioned behavior to result in no PMT being finished. In the most pathologic situation the stream information are lost and the probe fallback miscategorizes subtitles as mp3 audio. Avoid the issue through eliminating redundant PSI/SI table updates by checking their version field, which is required by the standard to be incremented on every change no matter how minor. CC: libav-stable@libav.org Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit 844201e35fe575710be8218d45828df49b77f205) Signed-off-by: Reinhard Tartler <siretart@tauware.de> Conflicts: libavformat/mpegts.c | 31 May 2015, 15:14:03 UTC |
4c4cc9b | Martin Storsjö | 24 April 2015, 09:38:09 UTC | rtsp: Make sure we don't write too many transport entries into a fixed-size array CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st> (cherry picked from commit f77c9d71615e17414aacbb1720693b800a5a32d3) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:11:30 UTC |
1f16866 | Andrey Utkin | 10 April 2015, 21:54:10 UTC | rtpenc_jpeg: Handle case of picture dimensions not dividing by 8 This fixes the calculation of the number of needed blocks to make sure that ALL pixels are represented by the result. Signed-off-by: Martin Storsjö <martin@martin.st> (cherry picked from commit 4415d0f3bbaeb287327ef101ae98d727a69d9af1) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:11:13 UTC |
8b9d0f5 | Vittorio Giovara | 13 March 2015, 19:45:14 UTC | mov: Fix little endian audio detection Set this field to TRUE if the audio component is to operate on little-endian data, and FALSE otherwise. However TRUE and FALSE are not defined. Since this flag is just a boolean, interpret all values except for 0 as little endian. Sample-Id: 64bit_FLOAT_Little_Endian.mov (cherry picked from commit 8ae4d4e117626313e0b7df746e82de84d00d160a) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:10:56 UTC |
987a8f8 | Luca Barbato | 16 March 2015, 10:26:48 UTC | x86: Put COPY3_IF_LT under HAVE_6REGS It uses 6 registers, unbreaks building on hardened x86 system. Bug-Id: gentoo/541930 CC: libav-stable@libav.org (cherry picked from commit 2af720fe5f0418612a8fc26b0147a0e10414fcbe) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:10:31 UTC |
c7a9837 | Andreas Cadhalpun | 09 March 2015, 18:24:09 UTC | roqvideoenc: set enc->avctx in roq_encode_init So far it is only set in roq_encode_frame, but it is used in roq_encode_end to free the coded_frame. This currently segfaults if roq_encode_frame is not called between roq_encode_init and roq_encode_end. CC:libav-stable@libav.org Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 9f6c36d961d27283808310e3ca1d8390b55fce9b) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 15:10:00 UTC |
891ed11 | Vittorio Giovara | 08 March 2015, 21:08:16 UTC | libvpx: Fix mixed use of av_malloc() and av_reallocp() This buffer is resized when vpx_codec_get_cx_data() returns a VPX_CODEC_STATS_PKT packet. CC: libav-stable@libav.org Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com> (cherry picked from commit 7244cefd6e6ba7258cb022dfd7a284099d88a3e8) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 31 May 2015, 14:57:50 UTC |
eaa9693 | Andreas Cadhalpun | 22 April 2015, 14:03:41 UTC | alsdec: only adapt order for positive max_order For max_order = 0 the clipping range is invalid. (amin = 2, amax = 1) CC: libav-stable@libav.org Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 60f1cc4a1ffcbf24acbb543988ceeaec76b70818) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 378ee3bad5b99e8f90864af9bc851590e0f64825) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 05 May 2015, 19:59:22 UTC |
d36d3ae | Andreas Cadhalpun | 21 April 2015, 17:28:30 UTC | alsdec: check sample pointer range in revert_channel_correlation Also change the type of begin, end and smp to ptrdiff_t to make the comparison well-defined. CC: libav-stable@libav.org Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 94bb1ce882a12b6d7a1fa32715a68121b39ee838) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 41a89cba6086de2bd24f9ec7e21200fa162505e9) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 05 May 2015, 19:59:19 UTC |
b0b92ee | Andreas Cadhalpun | 21 April 2015, 16:43:55 UTC | aacpsy: correct calculation of minath in psy_3gpp_init The minimum of the ath(x, ATH_ADD) function depends on ATH_ADD. This patch uses the first order approximation to determine it. For ATH_ADD = 4 this results in the value at 3407.06812 (-5.24241638) not the one at 3410 (-5.24237967). CC: libav-stabl@libav.org Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 110f7f35fb615b97d983b1c6c6a714fddd28bcbe) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 7b66cf5ce7fdb8b3fa13459aab3f4d6ab559f1ea) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 05 May 2015, 19:59:15 UTC |
d0e66cb | Andreas Cadhalpun | 18 April 2015, 18:29:13 UTC | alsdec: limit avctx->bits_per_raw_sample to 32 avctx->bits_per_raw_sample is used in get_sbits_long, which only supports up to 32 bits. CC: libav-stable@libav.org Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit e191aaca44b986816695e3b7ecfae64697fd6631) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 97010c74cbff177b58daf9a092b4e37a7da26f85) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 05 May 2015, 19:59:11 UTC |
941972d | Andreas Cadhalpun | 16 April 2015, 17:12:02 UTC | aasc: return correct buffer size from aasc_decode_frame CC: libav-stable@libav.org Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 8fc8024ea56e814cd257d5fe27b21a865080782f) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 0d3a7dd26490156b607541dd2e1faeaa0fc61a88) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 05 May 2015, 19:59:07 UTC |
bac0850 | Thomas Guillem | 10 April 2015, 17:04:51 UTC | matroskadec: fix crash when parsing invalid mkv CC: libav-stable@libav.org Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit b8d7f3186e86234f6255f5e8ee9e98573b4d9a6e) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 3e1c9da38b849ce2982b516004370081fdd89ed0) Signed-off-by: Anton Khirnov <anton@khirnov.net> Conflicts: libavformat/matroskadec.c | 18 April 2015, 15:06:07 UTC |
8ae0d70 | Reinhard Tartler | 09 March 2015, 01:57:59 UTC | doc: More changelog updates for v10.6 | 09 March 2015, 02:04:40 UTC |
e032e64 | Michael Niedermayer | 04 March 2015, 17:36:14 UTC | utvideodec: Handle slice_height being zero Fixes out of array accesses. CC: libav-stable@libav.org Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Bug-Id: CVE-2014-9604 Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com> Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit 0ce3a0f9d9523a9bcad4c6d451ca5bbd7a4f420d) (cherry picked from commit 3a417a86b330b7c1acf9db4f729be7d619caaded) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 09 March 2015, 02:04:40 UTC |
eb90414 | Anton Khirnov | 07 March 2015, 21:06:59 UTC | tiff: Check that there is no aliasing in pixel format selection Fixes possible issues with unexpected bpp/bppcount values. CC: libav-stable@libav.org Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Bug-Id: CVE-2014-8544 (cherry picked from commit ae5e1f3d663a8c9a532d89e588cbc61f171c9186) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 09 March 2015, 02:04:40 UTC |
0051174 | Andreas Cadhalpun | 02 March 2015, 15:52:26 UTC | rmenc: limit packet size The chunk size is limited to UINT16_MAX (written by avio_wb16), so make sure that the packet size is not too large. Such large frames need to be split into slices smaller than 64 kB, but that is currently supported neither by the rv10/rv20 encoders nor the rm muxer. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> | 08 March 2015, 19:36:26 UTC |
61c966e | Andreas Cadhalpun | 02 March 2015, 19:47:57 UTC | webp: validate the distance prefix code According to the WebP Lossless Bitstream Specification the highest allowed value for a prefix code is 39. If prefix_code is too large, the calculated extra_bits has an invalid value and triggers an assertion in get_bits. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> | 08 March 2015, 19:36:18 UTC |
772f50c | Andreas Cadhalpun | 03 March 2015, 20:31:15 UTC | rv10: check size of s->mb_width * s->mb_height If it doesn't fit into 12 bits it triggers an assertion. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> | 08 March 2015, 19:36:12 UTC |
0eb8786 | Federico Tomassetti | 18 February 2015, 12:11:44 UTC | eamad: check for out of bounds read Bug-Id: CID 1257500 CC: libav-stable@libav.org Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 08 March 2015, 19:36:06 UTC |
b2b359f | Federico Tomassetti | 18 February 2015, 12:11:43 UTC | mdec: check for out of bounds read Bug-Id: CID 1257501 CC: libav-stable@libav.org Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 08 March 2015, 19:35:56 UTC |
0ad8d75 | Vittorio Giovara | 22 February 2015, 19:49:52 UTC | configure: Properly fail when libcdio/cdparanoia is not found | 08 March 2015, 19:35:48 UTC |
7fd11fb | Martin Storsjö | 05 March 2015, 21:38:00 UTC | arm: Suppress tags about used cpu arch and extensions When all the codepaths using manually set .arch/.fpu code is behind runtime detection, the elf attributes should be suppressed. This allows tools to know that the final built binary doesn't strictly require these extensions. Signed-off-by: Martin Storsjö <martin@martin.st> (cherry picked from commit dcae2e32f7d8a1ca5fb8c1e4aa81313be854dd73 and b77e335e441040a40fc6156b8e4a134745d10233) Signed-off-by: Martin Storsjö <martin@martin.st> | 08 March 2015, 16:12:02 UTC |
470fd8e | Reinhard Tartler | 08 March 2015, 15:20:46 UTC | Update Changelog for v10.6 | 08 March 2015, 15:20:46 UTC |
f74f4a5 | Reinhard Tartler | 08 March 2015, 15:16:33 UTC | Prepare for 10.6 Release | 08 March 2015, 15:16:33 UTC |
c47cdf8 | Vittorio Giovara | 06 January 2015, 15:47:18 UTC | img2dec: correctly use the parsed value from -start_number Previously the image sequence was always starting from the minimum number rather than the requested one. CC: libav-stable@libav.org | 22 February 2015, 23:56:00 UTC |
91ef250 | Michael Niedermayer | 31 January 2013, 03:20:24 UTC | h264_cabac: Break infinite loops This fixes out of array reads and/or infinite loops. 30 is the maximum number of bits that can be read into coeff_abs below. CC: libav-stable@libav.org Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Martin Storsjö <martin@martin.st> | 22 February 2015, 23:55:53 UTC |
3670942 | Anton Khirnov | 12 February 2015, 12:06:49 UTC | h264: initialize H264Context.avctx in init_thread_copy This prevents using a wrong (first thread's) AVCodecContext if decoding a frame in the first pass over all threads fails. (cherry picked from commit a06b0b1295c51d100101e0ca0434e199ad6de6b5) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 2686dab45eec54f99866413153aa0b36381e48be) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 21 February 2015, 08:41:30 UTC |
fa4604d | Michael Niedermayer | 25 August 2013, 01:01:19 UTC | h264: Do not share rbsp_buffer across threads Signed-off-by: Luca Barbato <lu_zero@gentoo.org> CC: libav-stable@libav.org (cherry picked from commit 61928b68dc28e080b8c8191afe5541123c682bbd) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 06d433366c02ab81a1aaad33d32934b4180d354b) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 21 February 2015, 08:41:24 UTC |
03fbb6f | Anton Khirnov | 12 February 2015, 11:26:58 UTC | h264: only ref cur_pic in update_thread_context if it is initialized It may be empty if the previous thread's decode call did not contain a valid frame. (cherry picked from commit 0dea4c77ccf5956561bb8991311b3d834bb5fa40) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 1dbfaa34e615606cb3f1a3ecabb117e354459edc) Signed-off-by: Anton Khirnov <anton@khirnov.net> Conflicts: libavcodec/h264_slice.c | 21 February 2015, 08:40:43 UTC |
a9602c6 | Xiaohan Wang | 06 November 2014, 20:59:54 UTC | matroskadec: Fix read-after-free in matroska_read_seek() In matroska_read_seek(), |tracks| is assigned at the begining of the function. However, functions like matroska_parse_cues() could reallocate the tracks and invalidate |tracks|. This assigns |tracks| only before using it, so that it will not get invalidated elsewhere. Bug-Id: chromium/427266 | 27 January 2015, 14:35:24 UTC |
f249e98 | Michael Niedermayer | 03 October 2014, 20:50:45 UTC | smc: fix the bounds check Fixes invalid writes when there are more blocks in a run than total remaining blocks. CC: libav-stable@libav.org Bug-ID: CVE-2014-8548 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit d423dd72be451462c6fb1cbbe313bed0194001ab) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 58dc526ebf722d33bf09275c1241674e0e6b9ef1) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 20 December 2014, 09:53:40 UTC |
92888e9 | Michael Niedermayer | 03 October 2014, 18:15:52 UTC | gifdec: refactor interleave end handling Fixes invalid writes with very small image heights. CC: libav-stable@libav.org Bug-ID: CVE-2014-8547 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 0b39ac6f54505a538c21fe49a626de94c518c903) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit eac49477aa95cf727d87d2741ee8e60be59d394b) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 20 December 2014, 09:53:37 UTC |
3f10a77 | Anton Khirnov | 14 December 2014, 20:01:59 UTC | mmvideo: check frame dimensions The frame size must be set by the caller and each dimension must be a multiple of 2. CC: libav-stable@libav.org Bug-ID: CVE-2014-8543 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind (cherry picked from commit 17ba719d9ba30c970f65747f42d5fbb1e447ca28) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 69a930b988ff4f88ae27e4fc24ff6ed116840b5e) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 20 December 2014, 09:53:35 UTC |
8f238dd | Anton Khirnov | 14 December 2014, 20:01:59 UTC | jvdec: check frame dimensions The frame size must be set by the caller and each dimension must be a multiple of 8. CC: libav-stable@libav.org Bug-ID: CVE-2014-8542 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind (cherry picked from commit 88626e5af8d006e67189bf10b96b982502a7e8ad) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 55788572ea7b89cdd77bab1cf4bf06d14ead34f5) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 20 December 2014, 09:53:32 UTC |
da4f5d9 | Anton Khirnov | 14 December 2014, 19:52:13 UTC | mjpegdec: check for pixel format changes Fixes possible invalid memory access. Based on code by Michael Niedermayer <michaelni@gmx.at> CC: libav-stable@libav.org Bug-ID: CVE-2014-8541 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind (cherry picked from commit 809c3023b699c54c90511913d3b6140dd2436550) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit aa7a19b41774ce5f8a4e43f3692a4f9d90aa5c92) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 20 December 2014, 09:53:28 UTC |
931f5b2 | Anton Khirnov | 12 August 2014, 14:39:10 UTC | mov: avoid a memleak when multiple stss boxes are present CC: libav-stable@libav.org Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind (cherry picked from commit 64f7575fbd64e5b65d5c644347408588c776f1fe) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 577f1feb3fd1e51fd14af7ce6d79d468faa3b929) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 20 December 2014, 09:53:24 UTC |
e7fdd6a | Julien Ramseier | 14 December 2014, 01:00:04 UTC | avconv: Use the mpeg12 private option scan_offset Introduced in aed790070486b1b01b48106310d9d0ca1730e459 Bug-Id: debian/773055 CC: libav-stable@libav.org Signed-off-by: Luca Barbato <lu_zero@gentoo.org> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit fd665f7f48fa7db89eb9a93ac33919f6adc40f9d) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 864c0c50eb0e7a112b20007459b0cb94b61cb8d3) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 14 December 2014, 19:26:37 UTC |
d1c2f86 | Reinhard Tartler | 27 November 2014, 17:21:03 UTC | Replace lena.pnm The new reference.pnm is a freely licensed replacement. The photo has been taken by Reinhard Tartler on August 28 2014, and is licensed under the expat license as stated at http://www.jclark.com/xml/copying.txt (cherry picked from commit e38231007e19e5f27b0e77e72bcd26fb3d76edfb) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 02 December 2014, 01:43:32 UTC |
2bcd8f2 | Reinhard Tartler | 28 November 2014, 14:52:50 UTC | Treat all '*.pnm' files as non-text file This convinces the pre-receive hook to not consider all *.pnm files as text files to reduce the patch sizes and avoids triggering whitespace checks, Contains a correction by Janne Grunau <janne-libav@jannau.net> (cherry picked from commit b877814e09b9f25308ec205cf48bb9554b33e95c) Signed-off-by: Reinhard Tartler <siretart@tauware.de> | 02 December 2014, 01:36:05 UTC |
c790e31 | wm4 | 14 November 2014, 12:34:50 UTC | lavu: fix memory leaks by using a mutex instead of atomics The buffer pool has to atomically add and remove entries from the linked list of available buffers. This was done by removing the entire list with a CAS operation, working on it, and then setting it back again (using a retry-loop in case another thread was doing the same thing). This could effectively cause memory leaks: while a thread was working on the buffer list, other threads would allocate new buffers, increasing the pool's total size. There was no real leak, but since these extra buffers were not needed, but not free'd either (except when the buffer pool was destroyed), this had the same effects as a real leak. For some reason, growth was exponential, and could easily kill the process due to OOM in real-world uses. Fix this by using a mutex to protect the list operations. The fancy way atomics remove the whole list to work on it is not needed anymore, which also avoids the situation which was causing the leak. Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit fbd6c97f9ca858140df16dd07200ea0d4bdc1a83) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 517ce1d09b5e6b72afc2ef9490b5f8ca42fa6a65) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 27 November 2014, 12:45:36 UTC |
7fe5d0a | Anton Khirnov | 23 November 2014, 20:25:05 UTC | lavu: add wrappers for the pthreads mutex API Also add no-op fallbacks when threading is disabled. This helps keeping the code clean if Libav is compiled for targets without threading. Since we assume that no threads of any kind are used in such configurations, doing nothing is ok by definition. Based on a patch by wm4 <nfxjfg@googlemail.com>. (cherry picked from commit 2443e522f0059176ff8717c9c753eb6fe7e7bbf1) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 46a17d886b8559723c40b9f5cdf0e0c6b1c95180) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 27 November 2014, 12:45:28 UTC |
871d99e | Anton Khirnov | 14 November 2014, 19:20:50 UTC | mp3enc: fix a triggerable assert We have to check against the number of bytes actually needed, not the theoretical maximum size. (cherry picked from commit 12700b0219521a5f20c8ba47b3ad7857ea9e0554) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 15 November 2014, 07:46:48 UTC |
72ed416 | Timothy B. Terriberry | 14 October 2014, 00:46:00 UTC | resample: Avoid off-by-1 errors in PTS calcs. The rounding used in the PTS calculations in filter_frame() does not actually match the number of samples output by the resampler. This leads to off-by-1 errors in the timestamps indicating gaps and underruns, even when the input timestamps are all contiguous. Bug-Id: 753 Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 6cbbf0592f4f3940aac7f687850d1b726a2ea836) Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit ca8c62d187fdca13979379fb2ab172ed662aa2f8) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 18 October 2014, 03:15:48 UTC |
787a615 | Vittorio Giovara | 13 October 2014, 14:42:28 UTC | imc: fix order of operations in coefficients read Reported-by: Ruoyu <liangry@ucweb.com> | 15 October 2014, 13:54:20 UTC |
0989a12 | Rémi Denis-Courmont | 25 September 2014, 08:59:58 UTC | mpeg12: Always invoke the get_format() callback Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 27 September 2014, 13:49:06 UTC |
c7caed8 | Rémi Denis-Courmont | 25 September 2014, 08:59:57 UTC | h264: Always invoke the get_format() callback Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 27 September 2014, 13:49:06 UTC |
f13f5a7 | Diego Biurrun | 16 September 2014, 10:40:37 UTC | Add some bug references to the changelog | 17 September 2014, 14:18:39 UTC |
d14696c | Katerina Barone-Adesi | 15 September 2014, 23:40:24 UTC | apetag: Fix APE tag size check The size variable is (correctly) unsigned, but is passed to several functions which take signed parameters, such as avio_read, sometimes after having numbers added to it. So ensure that size remains within the bounds that these functions can handle. (cherry picked from commit b45ab61b24a8f2aeafdd4451491b1b30b7875ee5) Signed-off-by: Diego Biurrun <diego@biurrun.de> | 17 September 2014, 14:18:39 UTC |
d0af7d5 | Diego Biurrun | 10 September 2014, 20:01:30 UTC | Update Changelog for v10.5 | 10 September 2014, 20:24:18 UTC |
f2abf8d | Diego Biurrun | 10 September 2014, 20:01:07 UTC | Prepare for 10.5 release | 10 September 2014, 20:24:13 UTC |
40c7613 | Diego Biurrun | 10 September 2014, 16:38:15 UTC | doc: Fix syntax and logical errors in avconv stream combination example Bug-Id: 661 CC: libav-stable@libav.org (cherry picked from commit 775a0b04f0cf8102fe322b2ee03fe1a0633dea04) Signed-off-by: Diego Biurrun <diego@biurrun.de> | 10 September 2014, 19:02:24 UTC |
1a7d179 | Diego Biurrun | 27 August 2014, 11:14:20 UTC | license: Mention that vf_interlace is GPL, not LGPL (cherry picked from commit 9e8bbe7d4d1dcd5fec491dbfbb98ed2038a7bed5) Signed-off-by: Diego Biurrun <diego@biurrun.de> | 28 August 2014, 17:52:55 UTC |
9fcc632 | Luca Barbato | 23 August 2014, 17:03:21 UTC | pulse: Add a wallclock option to be compatible with other other captures alsa and x11grab use av_gettime() to report timestamps. Have it on by default. Bug-Id: 647 (cherry picked from commit 424b929b5cb9ca4094099f25179829260d4b0fa3) (cherry picked from commit 404731bd20e1df5880e6fe381e975ba48afc75b2) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 28 August 2014, 10:09:53 UTC |
f739592 | Anton Khirnov | 26 August 2014, 06:26:35 UTC | avconv: fix parsing the AVOptions for -target CC: libav-stable@libav.org (cherry picked from commit f5245a9c6206878b892adf3ccbccc9311c202af5) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 27 August 2014, 06:31:05 UTC |
7bc3764 | Anton Khirnov | 25 August 2014, 21:24:35 UTC | avconv: fix the muxrate values for -target The mpegenc private option values are in 50-byte units. CC: libav-stable@libav.org (cherry picked from commit 1688eef25385089026aba55da1885f70a57815ab) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 27 August 2014, 06:31:02 UTC |
3ac0638 | Anton Khirnov | 25 August 2014, 21:21:57 UTC | mpegenc: limit the maximum muxrate It is written to the file as a 22-bit value. CC: libav-stable@libav.org (cherry picked from commit 75bbaf2493a71ee66eaabe3c21fadd84d07888de) Signed-off-by: Anton Khirnov <anton@khirnov.net> Conflicts: libavformat/mpegenc.c | 27 August 2014, 06:30:52 UTC |
051ac5c | Michael Niedermayer | 18 April 2014, 21:11:31 UTC | mpegvideo: Use the current_picture pts The picture slot can be recycled by select_input_picture and only current_picture is populated with the valid pts. Unbreak timestamps when in cbr mode. Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit 1c7b71a5bdb88ebb69734100405bbb5441b871e8) Signed-off-by: Anton Khirnov <anton@khirnov.net> Conflicts: libavcodec/mpegvideo_enc.c | 26 August 2014, 06:33:07 UTC |
37e2d57 | Diego Biurrun | 20 August 2014, 16:54:50 UTC | setpts: Add missing inttypes.h #include for PRId64 Also convert a debug av_log() to av_dlog(). (cherry picked from commit a89dd9a72c6e9c3111d6f34d9b08cd624fe76358) Signed-off-by: Diego Biurrun <diego@biurrun.de> | 20 August 2014, 17:07:09 UTC |
f25f5f8 | Christophe Gisquet | 18 August 2014, 14:15:24 UTC | proresenc: Properly account for alpha plane The packet buffer allocation considers the alpha channel as DCT-coded, while it is actually run-coded and thus requires a larger buffer. CC: libav-stable@libav.org Signed-off-by: Diego Biurrun <diego@biurrun.de> Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit 41e1354c101004ccd46dc08d3dd6e956e83a6b51) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 18 August 2014, 17:03:37 UTC |
a437298 | Christophe Gisquet | 18 August 2014, 14:15:23 UTC | proresenc: Realloc if buffer is too small The buffer allocation may be incorrect (e.g. with an alpha plane), and currently causes the buffer to be set to NULL by init_put_bits, causing a crash later on. So, detect that situation, and if detected, reallocate the buffer and ask for a sample that shows the problem. CC: libav-stable@libav.org Signed-off-by: Diego Biurrun <diego@biurrun.de> Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit 45ce880a9b3e50cfa088f111dffaf8685bd7bc6b) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 18 August 2014, 17:03:34 UTC |
e912b07 | Christophe Gisquet | 18 August 2014, 14:15:22 UTC | proresenc: Report buffer overflow If the allocated size, despite best efforts, is too small, exit with the appropriate error. CC: libav-stable@libav.org Signed-off-by: Diego Biurrun <diego@biurrun.de> Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit 58b68e4fdea22e22178e237bda950b09cc6f363a) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 18 August 2014, 17:03:30 UTC |
b3f48a5 | Christophe Gisquet | 18 August 2014, 14:15:21 UTC | proresenc: Remove unneeded parameters from encode_alpha_plane() Signed-off-by: Diego Biurrun <diego@biurrun.de> Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit b16699f2da9c1d41eff852ec3a0c81f74fd44421) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> | 18 August 2014, 17:03:22 UTC |
ee9e966 | Reinhard Tartler | 17 August 2014, 14:23:20 UTC | Update Changelog for v10.4 | 17 August 2014, 14:23:20 UTC |
493a923 | Reinhard Tartler | 17 August 2014, 14:19:48 UTC | Prepare for 10.4 Release | 17 August 2014, 14:20:00 UTC |
7788297 | Luca Barbato | 12 August 2014, 18:21:12 UTC | mpegts: Do not try to write a PMT larger than SECTION_SIZE Prevent out of array writes. Similar to what Michael Niedermayer did to address the same issue. Bug-Id: CVE-2014-2263 CC: libav-stable@libav.org Signed-off-by: Diego Biurrun <diego@biurrun.de> (cherry picked from commit e8049af1325dd59a51546c15b2e71a0f578e9d27) Conflicts: libavformat/mpegtsenc.c | 13 August 2014, 20:57:47 UTC |
23376ae | Luca Barbato | 03 August 2014, 17:27:07 UTC | mpegts: Define the section length with a constant The specification says the value is expressed in 10 bits including the 4-byte CRC. (cherry picked from commit 89616408e38ac7257e36976723df0e23d6ee1157) Signed-off-by: Diego Biurrun <diego@biurrun.de> Conflicts: libavformat/mpegtsenc.c | 13 August 2014, 20:53:20 UTC |
8231764 | Michael Niedermayer | 30 August 2013, 02:51:09 UTC | ffv1dec: check that global parameters do not change in version 0/1 Such changes are neither allowed nor supported Found-by: ami_stuff Bug-Id: CVE-2013-7020 CC: libav-stable@libav.org Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit da7d839a0d3ec40423a665dc85e0cfaed3f92eb8) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 12 August 2014, 10:34:09 UTC |
67134ad | Felix Abecassis | 07 August 2014, 09:42:36 UTC | h264: fix interpretation of interleaved stereo modes Column and row frame packing arrangements were inverted. Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com> | 07 August 2014, 10:40:08 UTC |
d513c6a | Anton Khirnov | 03 August 2014, 08:14:48 UTC | svq1: do not modify the input packet The input data must remain constant, make a copy instead. This is in theory a performance hit, but since I failed to find any samples using this feature, this should not matter in practice. Also, check the size of the header, avoiding invalid reads on truncated data. CC:libav-stable@libav.org (cherry picked from commit 7b588bb691644e1b3c168b99accf74248a24e3cf) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 06 August 2014, 19:05:34 UTC |
18f48e0 | Anton Khirnov | 06 August 2014, 10:56:34 UTC | cdgraphics: do not return 0 from the decode function 0 means no data consumed, so it can trigger an infinite loop in the caller. CC:libav-stable@libav.org (cherry picked from commit c7d9b473e28238d4a4ef1b7e8b42c1cca256da36) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 06 August 2014, 18:41:44 UTC |
5bf5a35 | Anton Khirnov | 06 August 2014, 10:46:50 UTC | cdgraphics: switch to bytestream2 Fixes possible invalid memory accesses on corrupted data. CC:libav-stable@libav.org Bug-ID: CVE-2013-3674 (cherry picked from commit a1599f3f7ea8478d1f6a95e59e3bc6bc86d5f812) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 06 August 2014, 18:41:42 UTC |
6598aae | Vittorio Giovara | 06 August 2014, 10:07:08 UTC | jpeg2000: enable 4 component pixel formats Bug-Id: 721 CC: libav-stable@libav.org Sample-Id: 31230.mov | 06 August 2014, 11:44:35 UTC |
a5992a2 | Vittorio Giovara | 21 April 2014, 00:33:35 UTC | stereo3d: add missing include guards | 06 August 2014, 11:44:35 UTC |
aa943bd | Michael Niedermayer | 02 August 2014, 23:54:33 UTC | huffyuvdec: check width size for yuv422p Avoid out of array accesses. CC: libav-stable@libav.org Bug-Id: CVE-2013-0848 Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit a7153444df9040bf6ae103e0bbf6104b66f974cb) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 05 August 2014, 20:06:53 UTC |
bea1496 | Michael Niedermayer | 03 August 2014, 18:24:18 UTC | mmvideo: check horizontal coordinate too Fixes out of array accesses. Bug-Id: CVE-2013-3672 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 70cd3b8e659c3522eea5c16a65d14b8658894a94) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 05 August 2014, 19:21:40 UTC |
6be5a3c | Michael Niedermayer | 07 February 2014, 14:07:23 UTC | wmalosslessdec: fix mclms_coeffs* array size Fixes corruption of context Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org Bug-Id: CVE-2014-2098 Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 849b9d34c7ef70b370c53e7af3940f51cbc07d0f) Signed-off-by: Anton Khirnov <anton@khirnov.net> | 05 August 2014, 14:59:29 UTC |
07015d9 | Reinhard Tartler | 04 August 2014, 01:30:32 UTC | Update Changelog for v10.3 | 04 August 2014, 01:30:46 UTC |
744b406 | Diego Biurrun | 03 August 2014, 19:19:10 UTC | huffyuv: Check and propagate function return values Bug-Id: CVE-2013-0868 inspired by a patch from Michael Niedermayer <michaelni@gmx.at> Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Diego Biurrun <diego@biurrun.de> CC: libav-stable@libav.org (cherry picked from commit d0393d79bc3d61c9f2ff832c0e273b7774ff0269) Signed-off-by: Diego Biurrun <diego@biurrun.de> Conflicts: libavcodec/huffyuvdec.c | 03 August 2014, 22:53:38 UTC |
2273e5e | Vittorio Giovara | 30 July 2014, 18:33:36 UTC | h264: prevent theoretical infinite loop in SEI parsing Properly address CVE-2011-3946 and parse bitstream as described in the spec. CC: libav-stable@libav.org Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind | 01 August 2014, 12:15:07 UTC |
a1f7844 | Michael Niedermayer | 31 July 2014, 01:31:19 UTC | pgssubdec: Check RLE size before copying Make sure the buffer size does not exceed the expected RLE size. Prevent an out of array bound write. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at> Bug-Id: CVE-2013-0852 Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit d98e6c5d5d80c1dfe0c30f2e73d41a3aea0b920d) Signed-off-by: Diego Biurrun <diego@biurrun.de> | 01 August 2014, 08:04:13 UTC |
d396987 | Diego Biurrun | 26 June 2014, 00:09:13 UTC | fate: Add dependencies for dct/fft/mdct/rdft tests (cherry picked from commit 24f45c16224d4c5d482e928676714766ffdda4fc) Signed-off-by: Diego Biurrun <diego@biurrun.de> | 30 July 2014, 17:12:17 UTC |
b20a8ad | Bernhard Übelacker | 27 July 2014, 15:38:59 UTC | video4linux2: Avoid a floating point exception This avoids a segfault in avconv_opt.c:opt_target when trying to determine the norm. (cherry picked from commit dc71f1958846bb1d96de43a4603983dc8450cfcc) Signed-off-by: Diego Biurrun <diego@biurrun.de> | 30 July 2014, 17:12:17 UTC |
01a550b | Diego Biurrun | 29 July 2014, 12:43:04 UTC | vf_select: Drop a debug av_log with an unchecked double to enum conversion CC: libav-stable@libav.org (cherry picked from commit a8d803a320fb08b3ad5db4fffc79abd401206905) Signed-off-by: Diego Biurrun <diego@biurrun.de> | 30 July 2014, 17:12:17 UTC |