Overview

Request 222 (accepted)

- Update to 0.10.3

Submit package home:RedDwarf:branches:Essentials / ffmpeg to package Essentials / ffmpeg

ffmpeg.changes Changed
x
 
1
@@ -1,4 +1,9 @@
2
 -------------------------------------------------------------------
3
+Sat May 19 23:04:29 UTC 2012 - reddwarf@opensuse.org
4
+
5
+- Update to 0.10.3
6
+
7
+-------------------------------------------------------------------
8
 Thu May  3 07:53:11 UTC 2012 - pascal.bleser@opensuse.org
9
 
10
 - enable PulseAudio input support on openSUSE >= 11.4
11
ffmpeg.spec Changed
10
 
1
@@ -23,7 +23,7 @@
2
 %define majorswresample  0
3
 %define libswresample    libswresample
4
 %define libnameswresample %{libswresample}%{majorswresample}
5
-%define lastrelease      0.10.2
6
+%define lastrelease      0.10.3
7
 
8
 %bcond_without avfilter
9
 %bcond_without libvpx
10
ffmpeg-0.10.2.tar.bz2/Changelog -> ffmpeg-0.10.3.tar.bz2/Changelog Changed
27
 
1
@@ -3,6 +3,25 @@
2
 
3
 version next:
4
 
5
+
6
+version 0.10.3:
7
+
8
+- Security fixes in the 4xm demuxer, avi demuxer, cook decoder,
9
+  mm demuxer, mpegvideo decoder, vqavideo decoder (CVE-2012-0947) and
10
+  xmv demuxer.
11
+
12
+- Several bugs and crashes have been fixed in the following codecs: AAC,
13
+  APE, H.263, H.264, Indeo 4, Mimic, MJPEG, Motion Pixels Video, RAW,
14
+  TTA, VC1, VQA, WMA Voice, vqavideo.
15
+
16
+- Several bugs and crashes have been fixed in the following formats:
17
+  ASF, ID3v2, MOV, xWMA
18
+
19
+- This release additionally updates the following codecs to the
20
+  bytestream2 API, and therefore benefit from additional overflow
21
+  checks: truemotion2, utvideo, vqavideo
22
+
23
+
24
 version 0.10.1
25
 - Several security fixes, many bugfixes affecting many formats and
26
   codecs, the list below is not complete.
27
ffmpeg-0.10.2.tar.bz2/Doxyfile -> ffmpeg-0.10.3.tar.bz2/Doxyfile Changed
10
 
1
@@ -31,7 +31,7 @@
2
 # This could be handy for archiving the generated documentation or
3
 # if some version control system is used.
4
 
5
-PROJECT_NUMBER         = 0.10.2
6
+PROJECT_NUMBER         = 0.10.3
7
 
8
 # With the PROJECT_LOGO tag one can specify an logo or icon that is included
9
 # in the documentation. The maximum height of the logo should not exceed 55
10
ffmpeg-0.10.2.tar.bz2/RELEASE -> ffmpeg-0.10.3.tar.bz2/RELEASE Changed
4
 
1
@@ -1,1 +1,1 @@
2
-0.10.2
3
+0.10.3
4
ffmpeg-0.10.2.tar.bz2/VERSION -> ffmpeg-0.10.3.tar.bz2/VERSION Changed
4
 
1
@@ -1,1 +1,1 @@
2
-0.10.2
3
+0.10.3
4
ffmpeg-0.10.2.tar.bz2/libavcodec/aacps.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/aacps.c Changed
12
 
1
@@ -275,6 +275,10 @@
2
 err:
3
     ps->start = 0;
4
     skip_bits_long(gb_host, bits_left);
5
+    memset(ps->iid_par, 0, sizeof(ps->iid_par));
6
+    memset(ps->icc_par, 0, sizeof(ps->icc_par));
7
+    memset(ps->ipd_par, 0, sizeof(ps->ipd_par));
8
+    memset(ps->opd_par, 0, sizeof(ps->opd_par));
9
     return bits_left;
10
 }
11
 
12
ffmpeg-0.10.2.tar.bz2/libavcodec/apedec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/apedec.c Changed
15
 
1
@@ -404,9 +404,12 @@
2
 
3
         if (tmpk <= 16)
4
             x = range_decode_bits(ctx, tmpk);
5
-        else {
6
+        else if (tmpk <= 32) {
7
             x = range_decode_bits(ctx, 16);
8
             x |= (range_decode_bits(ctx, tmpk - 16) << 16);
9
+        } else {
10
+            av_log(ctx->avctx, AV_LOG_ERROR, "Too many bits: %d\n", tmpk);
11
+            return AVERROR_INVALIDDATA;
12
         }
13
         x += overflow << tmpk;
14
     } else {
15
ffmpeg-0.10.2.tar.bz2/libavcodec/bytestream.h -> ffmpeg-0.10.3.tar.bz2/libavcodec/bytestream.h Changed
315
 
1
@@ -1,6 +1,7 @@
2
 /*
3
  * Bytestream functions
4
  * copyright (c) 2006 Baptiste Coudurier <baptiste.coudurier@free.fr>
5
+ * Copyright (c) 2012 Aneesh Dogra (lionaneesh) <lionaneesh@gmail.com>
6
  *
7
  * This file is part of FFmpeg.
8
  *
9
@@ -23,6 +24,7 @@
10
 #define AVCODEC_BYTESTREAM_H
11
 
12
 #include <string.h>
13
+
14
 #include "libavutil/common.h"
15
 #include "libavutil/intreadwrite.h"
16
 
17
@@ -30,35 +32,57 @@
18
     const uint8_t *buffer, *buffer_end, *buffer_start;
19
 } GetByteContext;
20
 
21
-#define DEF_T(type, name, bytes, read, write)                             \
22
-static av_always_inline type bytestream_get_ ## name(const uint8_t **b){\
23
-    (*b) += bytes;\
24
-    return read(*b - bytes);\
25
-}\
26
-static av_always_inline void bytestream_put_ ##name(uint8_t **b, const type value){\
27
-    write(*b, value);\
28
-    (*b) += bytes;\
29
-}\
30
-static av_always_inline type bytestream2_get_ ## name ## u(GetByteContext *g)\
31
-{\
32
-    return bytestream_get_ ## name(&g->buffer);\
33
-}\
34
-static av_always_inline type bytestream2_get_ ## name(GetByteContext *g)\
35
-{\
36
-    if (g->buffer_end - g->buffer < bytes)\
37
-        return 0;\
38
-    return bytestream2_get_ ## name ## u(g);\
39
-}\
40
-static av_always_inline type bytestream2_peek_ ## name(GetByteContext *g)\
41
-{\
42
-    if (g->buffer_end - g->buffer < bytes)\
43
-        return 0;\
44
-    return read(g->buffer);\
45
-}
46
-
47
-#define DEF(name, bytes, read, write) \
48
+typedef struct {
49
+    uint8_t *buffer, *buffer_end, *buffer_start;
50
+    int eof;
51
+} PutByteContext;
52
+
53
+#define DEF_T(type, name, bytes, read, write)                                  \
54
+static av_always_inline type bytestream_get_ ## name(const uint8_t **b)        \
55
+{                                                                              \
56
+    (*b) += bytes;                                                             \
57
+    return read(*b - bytes);                                                   \
58
+}                                                                              \
59
+static av_always_inline void bytestream_put_ ## name(uint8_t **b,              \
60
+                                                     const type value)         \
61
+{                                                                              \
62
+    write(*b, value);                                                          \
63
+    (*b) += bytes;                                                             \
64
+}                                                                              \
65
+static av_always_inline void bytestream2_put_ ## name ## u(PutByteContext *p,  \
66
+                                                           const type value)   \
67
+{                                                                              \
68
+    bytestream_put_ ## name(&p->buffer, value);                                \
69
+}                                                                              \
70
+static av_always_inline void bytestream2_put_ ## name(PutByteContext *p,       \
71
+                                                      const type value)        \
72
+{                                                                              \
73
+    if (!p->eof && (p->buffer_end - p->buffer >= bytes)) {                     \
74
+        write(p->buffer, value);                                               \
75
+        p->buffer += bytes;                                                    \
76
+    } else                                                                     \
77
+        p->eof = 1;                                                            \
78
+}                                                                              \
79
+static av_always_inline type bytestream2_get_ ## name ## u(GetByteContext *g)  \
80
+{                                                                              \
81
+    return bytestream_get_ ## name(&g->buffer);                                \
82
+}                                                                              \
83
+static av_always_inline type bytestream2_get_ ## name(GetByteContext *g)       \
84
+{                                                                              \
85
+    if (g->buffer_end - g->buffer < bytes)                                     \
86
+        return 0;                                                              \
87
+    return bytestream2_get_ ## name ## u(g);                                   \
88
+}                                                                              \
89
+static av_always_inline type bytestream2_peek_ ## name(GetByteContext *g)      \
90
+{                                                                              \
91
+    if (g->buffer_end - g->buffer < bytes)                                     \
92
+        return 0;                                                              \
93
+    return read(g->buffer);                                                    \
94
+}
95
+
96
+#define DEF(name, bytes, read, write)                                          \
97
     DEF_T(unsigned int, name, bytes, read, write)
98
-#define DEF64(name, bytes, read, write) \
99
+#define DEF64(name, bytes, read, write)                                        \
100
     DEF_T(uint64_t, name, bytes, read, write)
101
 
102
 DEF64(le64, 8, AV_RL64, AV_WL64)
103
@@ -112,11 +136,22 @@
104
 #endif
105
 
106
 static av_always_inline void bytestream2_init(GetByteContext *g,
107
-                                              const uint8_t *buf, int buf_size)
108
+                                              const uint8_t *buf,
109
+                                              int buf_size)
110
 {
111
-    g->buffer =  buf;
112
+    g->buffer       = buf;
113
     g->buffer_start = buf;
114
-    g->buffer_end = buf + buf_size;
115
+    g->buffer_end   = buf + buf_size;
116
+}
117
+
118
+static av_always_inline void bytestream2_init_writer(PutByteContext *p,
119
+                                                     uint8_t *buf,
120
+                                                     int buf_size)
121
+{
122
+    p->buffer       = buf;
123
+    p->buffer_start = buf;
124
+    p->buffer_end   = buf + buf_size;
125
+    p->eof          = 0;
126
 }
127
 
128
 static av_always_inline unsigned int bytestream2_get_bytes_left(GetByteContext *g)
129
@@ -124,32 +159,61 @@
130
     return g->buffer_end - g->buffer;
131
 }
132
 
133
+static av_always_inline unsigned int bytestream2_get_bytes_left_p(PutByteContext *p)
134
+{
135
+    return p->buffer_end - p->buffer;
136
+}
137
+
138
 static av_always_inline void bytestream2_skip(GetByteContext *g,
139
                                               unsigned int size)
140
 {
141
     g->buffer += FFMIN(g->buffer_end - g->buffer, size);
142
 }
143
 
144
+static av_always_inline void bytestream2_skipu(GetByteContext *g,
145
+                                               unsigned int size)
146
+{
147
+    g->buffer += size;
148
+}
149
+
150
+static av_always_inline void bytestream2_skip_p(PutByteContext *p,
151
+                                                unsigned int size)
152
+{
153
+    int size2;
154
+    if (p->eof)
155
+        return;
156
+    size2 = FFMIN(p->buffer_end - p->buffer, size);
157
+    if (size2 != size)
158
+        p->eof = 1;
159
+    p->buffer += size2;
160
+}
161
+
162
 static av_always_inline int bytestream2_tell(GetByteContext *g)
163
 {
164
     return (int)(g->buffer - g->buffer_start);
165
 }
166
 
167
-static av_always_inline int bytestream2_seek(GetByteContext *g, int offset,
168
+static av_always_inline int bytestream2_tell_p(PutByteContext *p)
169
+{
170
+    return (int)(p->buffer - p->buffer_start);
171
+}
172
+
173
+static av_always_inline int bytestream2_seek(GetByteContext *g,
174
+                                             int offset,
175
                                              int whence)
176
 {
177
     switch (whence) {
178
     case SEEK_CUR:
179
-        offset = av_clip(offset, -(g->buffer - g->buffer_start),
180
-                         g->buffer_end - g->buffer);
181
+        offset     = av_clip(offset, -(g->buffer - g->buffer_start),
182
+                             g->buffer_end - g->buffer);
183
         g->buffer += offset;
184
         break;
185
     case SEEK_END:
186
-        offset = av_clip(offset, -(g->buffer_end - g->buffer_start), 0);
187
+        offset    = av_clip(offset, -(g->buffer_end - g->buffer_start), 0);
188
         g->buffer = g->buffer_end + offset;
189
         break;
190
     case SEEK_SET:
191
-        offset = av_clip(offset, 0, g->buffer_end - g->buffer_start);
192
+        offset    = av_clip(offset, 0, g->buffer_end - g->buffer_start);
193
         g->buffer = g->buffer_start + offset;
194
         break;
195
     default:
196
@@ -158,6 +222,37 @@
197
     return bytestream2_tell(g);
198
 }
199
 
200
+static av_always_inline int bytestream2_seek_p(PutByteContext *p,
201
+                                               int offset,
202
+                                               int whence)
203
+{
204
+    p->eof = 0;
205
+    switch (whence) {
206
+    case SEEK_CUR:
207
+        if (p->buffer_end - p->buffer < offset)
208
+            p->eof = 1;
209
+        offset     = av_clip(offset, -(p->buffer - p->buffer_start),
210
+                             p->buffer_end - p->buffer);
211
+        p->buffer += offset;
212
+        break;
213
+    case SEEK_END:
214
+        if (offset > 0)
215
+            p->eof = 1;
216
+        offset    = av_clip(offset, -(p->buffer_end - p->buffer_start), 0);
217
+        p->buffer = p->buffer_end + offset;
218
+        break;
219
+    case SEEK_SET:
220
+        if (p->buffer_end - p->buffer_start < offset)
221
+            p->eof = 1;
222
+        offset    = av_clip(offset, 0, p->buffer_end - p->buffer_start);
223
+        p->buffer = p->buffer_start + offset;
224
+        break;
225
+    default:
226
+        return AVERROR(EINVAL);
227
+    }
228
+    return bytestream2_tell_p(p);
229
+}
230
+
231
 static av_always_inline unsigned int bytestream2_get_buffer(GetByteContext *g,
232
                                                             uint8_t *dst,
233
                                                             unsigned int size)
234
@@ -168,14 +263,78 @@
235
     return size2;
236
 }
237
 
238
-static av_always_inline unsigned int bytestream_get_buffer(const uint8_t **b, uint8_t *dst, unsigned int size)
239
+static av_always_inline unsigned int bytestream2_get_bufferu(GetByteContext *g,
240
+                                                             uint8_t *dst,
241
+                                                             unsigned int size)
242
+{
243
+    memcpy(dst, g->buffer, size);
244
+    g->buffer += size;
245
+    return size;
246
+}
247
+
248
+static av_always_inline unsigned int bytestream2_put_buffer(PutByteContext *p,
249
+                                                            const uint8_t *src,
250
+                                                            unsigned int size)
251
+{
252
+    int size2;
253
+    if (p->eof)
254
+        return 0;
255
+    size2 = FFMIN(p->buffer_end - p->buffer, size);
256
+    if (size2 != size)
257
+        p->eof = 1;
258
+    memcpy(p->buffer, src, size2);
259
+    p->buffer += size2;
260
+    return size2;
261
+}
262
+
263
+static av_always_inline unsigned int bytestream2_put_bufferu(PutByteContext *p,
264
+                                                             const uint8_t *src,
265
+                                                             unsigned int size)
266
+{
267
+    memcpy(p->buffer, src, size);
268
+    p->buffer += size;
269
+    return size;
270
+}
271
+
272
+static av_always_inline void bytestream2_set_buffer(PutByteContext *p,
273
+                                                    const uint8_t c,
274
+                                                    unsigned int size)
275
+{
276
+    int size2;
277
+    if (p->eof)
278
+        return;
279
+    size2 = FFMIN(p->buffer_end - p->buffer, size);
280
+    if (size2 != size)
281
+        p->eof = 1;
282
+    memset(p->buffer, c, size2);
283
+    p->buffer += size2;
284
+}
285
+
286
+static av_always_inline void bytestream2_set_bufferu(PutByteContext *p,
287
+                                                     const uint8_t c,
288
+                                                     unsigned int size)
289
+{
290
+    memset(p->buffer, c, size);
291
+    p->buffer += size;
292
+}
293
+
294
+static av_always_inline unsigned int bytestream2_get_eof(PutByteContext *p)
295
+{
296
+    return p->eof;
297
+}
298
+
299
+static av_always_inline unsigned int bytestream_get_buffer(const uint8_t **b,
300
+                                                           uint8_t *dst,
301
+                                                           unsigned int size)
302
 {
303
     memcpy(dst, *b, size);
304
     (*b) += size;
305
     return size;
306
 }
307
 
308
-static av_always_inline void bytestream_put_buffer(uint8_t **b, const uint8_t *src, unsigned int size)
309
+static av_always_inline void bytestream_put_buffer(uint8_t **b,
310
+                                                   const uint8_t *src,
311
+                                                   unsigned int size)
312
 {
313
     memcpy(*b, src, size);
314
     (*b) += size;
315
ffmpeg-0.10.2.tar.bz2/libavcodec/celp_filters.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/celp_filters.c Changed
20
 
1
@@ -133,9 +133,8 @@
2
         out2 -= val * old_out2;
3
         out3 -= val * old_out3;
4
 
5
-        old_out3 = out-5;
6
-
7
         for (i = 5; i <= filter_length; i += 2) {
8
+            old_out3 = out-i;
9
             val = filter_coeffsi-1;
10
 
11
             out0 -= val * old_out3;
12
@@ -154,7 +153,6 @@
13
 
14
             FFSWAP(float, old_out0, old_out2);
15
             old_out1 = old_out3;
16
-            old_out3 = out-i-2;
17
         }
18
 
19
         tmp0 = out0;
20
ffmpeg-0.10.2.tar.bz2/libavcodec/cook.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/cook.c Changed
13
 
1
@@ -1235,6 +1235,11 @@
2
         q->subpackets.gains2.now      = q->subpackets.gain_3;
3
         q->subpackets.gains2.previous = q->subpackets.gain_4;
4
 
5
+        if (q->num_subpackets + q->subpackets.num_channels > q->nb_channels) {
6
+            av_log(avctx, AV_LOG_ERROR, "Too many subpackets %d for channels %d\n", q->num_subpackets, q->nb_channels);
7
+            return AVERROR_INVALIDDATA;
8
+        }
9
+
10
         q->num_subpackets++;
11
         s++;
12
         if (s > MAX_SUBPACKETS) {
13
ffmpeg-0.10.2.tar.bz2/libavcodec/h261dec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h261dec.c Changed
12
 
1
@@ -286,6 +286,10 @@
2
 
3
     // Read mtype
4
     h->mtype = get_vlc2(&s->gb, h261_mtype_vlc.table, H261_MTYPE_VLC_BITS, 2);
5
+    if (h->mtype < 0) {
6
+        av_log(s->avctx, AV_LOG_ERROR, "illegal mtype %d\n", h->mtype);
7
+        return SLICE_ERROR;
8
+    }
9
     h->mtype = h261_mtype_maph->mtype;
10
 
11
     // Read mquant
12
ffmpeg-0.10.2.tar.bz2/libavcodec/h263dec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h263dec.c Changed
35
 
1
@@ -444,6 +444,13 @@
2
     if (ret < 0){
3
         av_log(s->avctx, AV_LOG_ERROR, "header damaged\n");
4
         return -1;
5
+    } else if ((s->width  != avctx->coded_width  ||
6
+                s->height != avctx->coded_height ||
7
+                (s->width  + 15) >> 4 != s->mb_width ||
8
+                (s->height + 15) >> 4 != s->mb_height) &&
9
+               (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))) {
10
+        av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0);
11
+        return AVERROR_PATCHWELCOME;   // width / height changed during parallelized decoding
12
     }
13
 
14
     avctx->has_b_frames= !s->low_delay;
15
@@ -571,7 +578,6 @@
16
     if (s->codec_id == CODEC_ID_MPEG4 && s->xvid_build>=0 && avctx->idct_algo == FF_IDCT_AUTO && (av_get_cpu_flags() & AV_CPU_FLAG_MMX)) {
17
         avctx->idct_algo= FF_IDCT_XVIDMMX;
18
         ff_dct_common_init(s);
19
-        s->picture_number=0;
20
     }
21
 #endif
22
 
23
@@ -585,11 +591,6 @@
24
         /* H.263 could change picture size any time */
25
         ParseContext pc= s->parse_context; //FIXME move these demuxng hack to avformat
26
 
27
-        if (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_FRAME)) {
28
-            av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0);
29
-            return -1;   // width / height changed during parallelized decoding
30
-        }
31
-
32
         s->parse_context.buffer=0;
33
         MPV_common_end(s);
34
         s->parse_context= pc;
35
ffmpeg-0.10.2.tar.bz2/libavcodec/h264.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h264.c Changed
13
 
1
@@ -2706,9 +2706,9 @@
2
             || s->avctx->bits_per_raw_sample != h->sps.bit_depth_luma
3
             || h->cur_chroma_format_idc != h->sps.chroma_format_idc
4
             || av_cmp_q(h->sps.sar, s->avctx->sample_aspect_ratio))) {
5
-        if(h != h0 || (s->avctx->active_thread_type & FF_THREAD_FRAME)) {
6
+        if(h != h0 || (HAVE_THREADS && h->s.avctx->active_thread_type & FF_THREAD_FRAME)) {
7
             av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0);
8
-            return -1;   // width / height changed during parallelized decoding
9
+            return AVERROR_PATCHWELCOME;   // width / height changed during parallelized decoding
10
         }
11
         free_tables(h, 0);
12
         flush_dpb(s->avctx);
13
ffmpeg-0.10.2.tar.bz2/libavcodec/h264_ps.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h264_ps.c Changed
11
 
1
@@ -515,6 +515,9 @@
2
     if(pps_id >= MAX_PPS_COUNT) {
3
         av_log(h->s.avctx, AV_LOG_ERROR, "pps_id (%d) out of range\n", pps_id);
4
         return -1;
5
+    } else if (h->sps.bit_depth_luma > 10) {
6
+        av_log(h->s.avctx, AV_LOG_ERROR, "Unimplemented luma bit depth=%d (max=10)\n", h->sps.bit_depth_luma);
7
+        return AVERROR_PATCHWELCOME;
8
     }
9
 
10
     pps= av_mallocz(sizeof(PPS));
11
ffmpeg-0.10.2.tar.bz2/libavcodec/h264_refs.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/h264_refs.c Changed
10
 
1
@@ -655,6 +655,8 @@
2
 
3
     if(err >= 0 && h->long_ref_count==0 && h->short_ref_count<=2 && h->pps.ref_count0<=1 + (s->picture_structure != PICT_FRAME) && s->current_picture_ptr->f.pict_type == AV_PICTURE_TYPE_I){
4
         s->current_picture_ptr->sync |= 1;
5
+        if(!h->s.avctx->has_b_frames)
6
+            h->sync = 2;
7
     }
8
 
9
     return (h->s.avctx->err_recognition & AV_EF_EXPLODE) ? err : 0;
10
ffmpeg-0.10.2.tar.bz2/libavcodec/iff.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/iff.c Changed
10
 
1
@@ -473,7 +473,7 @@
2
     } else if ((res = avctx->get_buffer(avctx, &s->frame)) < 0) {
3
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
4
         return res;
5
-    } else if (avctx->bits_per_coded_sample <= 8 && avctx->pix_fmt != PIX_FMT_GRAY8) {
6
+    } else if (avctx->bits_per_coded_sample <= 8 && avctx->pix_fmt == PIX_FMT_PAL8) {
7
         if ((res = ff_cmap_read_palette(avctx, (uint32_t*)s->frame.data1)) < 0)
8
             return res;
9
     }
10
ffmpeg-0.10.2.tar.bz2/libavcodec/indeo4.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/indeo4.c Changed
23
 
1
@@ -372,7 +372,8 @@
2
 
3
         if (!get_bits1(&ctx->gb) || ctx->frame_type == FRAMETYPE_INTRA) {
4
             transform_id = get_bits(&ctx->gb, 5);
5
-            if (!transformstransform_id.inv_trans) {
6
+            if (transform_id >= FF_ARRAY_ELEMS(transforms) ||
7
+                !transformstransform_id.inv_trans) {
8
                 av_log_ask_for_sample(avctx, "Unimplemented transform: %d!\n", transform_id);
9
                 return AVERROR_PATCHWELCOME;
10
             }
11
@@ -476,6 +477,11 @@
12
     mv_scale = (ctx->planes0.bands0.mb_size >> 3) - (band->mb_size >> 3);
13
     mv_x = mv_y = 0;
14
 
15
+    if (((tile->width + band->mb_size-1)/band->mb_size) * ((tile->height + band->mb_size-1)/band->mb_size) != tile->num_MBs) {
16
+        av_log(avctx, AV_LOG_ERROR, "num_MBs mismatch %d %d %d %d\n", tile->width, tile->height, band->mb_size, tile->num_MBs);
17
+        return -1;
18
+    }
19
+
20
     for (y = tile->ypos; y < tile->ypos + tile->height; y += band->mb_size) {
21
         mb_offset = offs;
22
 
23
ffmpeg-0.10.2.tar.bz2/libavcodec/lagarith.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/lagarith.c Changed
154
 
1
@@ -247,24 +247,26 @@
2
 {
3
     int L, TL;
4
 
5
-    /* Left pixel is actually prev_rowwidth */
6
-    L = bufwidth - stride - 1;
7
     if (!line) {
8
         /* Left prediction only for first line */
9
         L = l->dsp.add_hfyu_left_prediction(buf + 1, buf + 1,
10
                                             width - 1, buf0);
11
-        return;
12
-    } else if (line == 1) {
13
-        /* Second line, left predict first pixel, the rest of the line is median predicted
14
-         * NOTE: In the case of RGB this pixel is top predicted */
15
-        TL = l->avctx->pix_fmt == PIX_FMT_YUV420P ? buf-stride : L;
16
     } else {
17
-        /* Top left is 2 rows back, last pixel */
18
-        TL = bufwidth - (2 * stride) - 1;
19
-    }
20
+        /* Left pixel is actually prev_rowwidth */
21
+        L = bufwidth - stride - 1;
22
+
23
+        if (line == 1) {
24
+            /* Second line, left predict first pixel, the rest of the line is median predicted
25
+             * NOTE: In the case of RGB this pixel is top predicted */
26
+            TL = l->avctx->pix_fmt == PIX_FMT_YUV420P ? buf-stride : L;
27
+        } else {
28
+            /* Top left is 2 rows back, last pixel */
29
+            TL = bufwidth - (2 * stride) - 1;
30
+        }
31
 
32
-    add_lag_median_prediction(buf, buf - stride, buf,
33
-                              width, &L, &TL);
34
+        add_lag_median_prediction(buf, buf - stride, buf,
35
+                                  width, &L, &TL);
36
+    }
37
 }
38
 
39
 static int lag_decode_line(LagarithContext *l, lag_rac *rac,
40
@@ -310,13 +312,13 @@
41
 }
42
 
43
 static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst,
44
-                                    const uint8_t *src, int width,
45
-                                    int esc_count)
46
+                                    const uint8_t *src, const uint8_t *src_end,
47
+                                    int width, int esc_count)
48
 {
49
     int i = 0;
50
     int count;
51
     uint8_t zero_run = 0;
52
-    const uint8_t *start = src;
53
+    const uint8_t *src_start = src;
54
     uint8_t mask1 = -(esc_count < 2);
55
     uint8_t mask2 = -(esc_count < 3);
56
     uint8_t *end = dst + (width - 2);
57
@@ -333,6 +335,8 @@
58
         i = 0;
59
         while (!zero_run && dst + i < end) {
60
             i++;
61
+            if (src + i >= src_end)
62
+                return AVERROR_INVALIDDATA;
63
             zero_run =
64
                 !(srci | (srci + 1 & mask1) | (srci + 2 & mask2));
65
         }
66
@@ -348,9 +352,10 @@
67
         } else {
68
             memcpy(dst, src, i);
69
             src += i;
70
+            dst += i;
71
         }
72
     }
73
-    return start - src;
74
+    return src_start - src;
75
 }
76
 
77
 
78
@@ -366,6 +371,7 @@
79
     int esc_count = src0;
80
     GetBitContext gb;
81
     lag_rac rac;
82
+    const uint8_t *src_end = src + src_size;
83
 
84
     rac.avctx = l->avctx;
85
     l->zeros = 0;
86
@@ -396,10 +402,16 @@
87
         esc_count -= 4;
88
         if (esc_count > 0) {
89
             /* Zero run coding only, no range coding. */
90
-            for (i = 0; i < height; i++)
91
-                src += lag_decode_zero_run_line(l, dst + (i * stride), src,
92
-                                                width, esc_count);
93
+            for (i = 0; i < height; i++) {
94
+                int res = lag_decode_zero_run_line(l, dst + (i * stride), src,
95
+                                                   src_end, width, esc_count);
96
+                if (res < 0)
97
+                    return res;
98
+                src += res;
99
+            }
100
         } else {
101
+            if (src_size < width * height)
102
+                return AVERROR_INVALIDDATA; // buffer not big enough
103
             /* Plane is stored uncompressed */
104
             for (i = 0; i < height; i++) {
105
                 memcpy(dst + (i * stride), src, width);
106
@@ -500,11 +512,19 @@
107
         }
108
         for (i = 0; i < 4; i++)
109
             srcsi = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride;
110
+        if (offset_ry >= buf_size ||
111
+            offset_gu >= buf_size ||
112
+            offset_bv >= buf_size ||
113
+            offs3 >= buf_size) {
114
+            av_log(avctx, AV_LOG_ERROR,
115
+                    "Invalid frame offsets\n");
116
+            return AVERROR_INVALIDDATA;
117
+        }
118
         for (i = 0; i < 4; i++)
119
             lag_decode_arith_plane(l, srcsi,
120
                                    avctx->width, avctx->height,
121
                                    -l->rgb_stride, buf + offsi,
122
-                                   buf_size);
123
+                                   buf_size - offsi);
124
         dst = p->data0;
125
         for (i = 0; i < 4; i++)
126
             srcsi = l->rgb_planes + i * l->rgb_stride * avctx->height;
127
@@ -576,15 +596,23 @@
128
             return -1;
129
         }
130
 
131
+        if (offset_ry >= buf_size ||
132
+            offset_gu >= buf_size ||
133
+            offset_bv >= buf_size) {
134
+            av_log(avctx, AV_LOG_ERROR,
135
+                   "Invalid frame offsets\n");
136
+            return AVERROR_INVALIDDATA;
137
+        }
138
+
139
         lag_decode_arith_plane(l, p->data0, avctx->width, avctx->height,
140
                                p->linesize0, buf + offset_ry,
141
-                               buf_size);
142
+                               buf_size - offset_ry);
143
         lag_decode_arith_plane(l, p->data2, avctx->width / 2,
144
                                avctx->height / 2, p->linesize2,
145
-                               buf + offset_gu, buf_size);
146
+                               buf + offset_gu, buf_size - offset_gu);
147
         lag_decode_arith_plane(l, p->data1, avctx->width / 2,
148
                                avctx->height / 2, p->linesize1,
149
-                               buf + offset_bv, buf_size);
150
+                               buf + offset_bv, buf_size - offset_bv);
151
         break;
152
     default:
153
         av_log(avctx, AV_LOG_ERROR,
154
ffmpeg-0.10.2.tar.bz2/libavcodec/lagarithrac.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/lagarithrac.c Changed
20
 
1
@@ -32,15 +32,16 @@
2
 
3
 void lag_rac_init(lag_rac *l, GetBitContext *gb, int length)
4
 {
5
-    int i, j;
6
+    int i, j, left;
7
 
8
     /* According to reference decoder "1st byte is garbage",
9
      * however, it gets skipped by the call to align_get_bits()
10
      */
11
     align_get_bits(gb);
12
+    left                = get_bits_left(gb) >> 3;
13
     l->bytestream_start =
14
     l->bytestream       = gb->buffer + get_bits_count(gb) / 8;
15
-    l->bytestream_end   = l->bytestream_start + length;
16
+    l->bytestream_end   = l->bytestream_start + FFMIN(length, left);
17
 
18
     l->range        = 0x80;
19
     l->low          = *l->bytestream >> 1;
20
ffmpeg-0.10.2.tar.bz2/libavcodec/lzw.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/lzw.c Changed
19
 
1
@@ -101,9 +101,14 @@
2
     struct LZWState *s = (struct LZWState *)p;
3
 
4
     if(s->mode == FF_LZW_GIF) {
5
-        while(s->pbuf < s->ebuf && s->bs>0){
6
-            s->pbuf += s->bs;
7
-            s->bs = *s->pbuf++;
8
+        while (s->bs > 0) {
9
+            if (s->pbuf + s->bs >= s->ebuf) {
10
+                s->pbuf = s->ebuf;
11
+                break;
12
+            } else {
13
+                s->pbuf += s->bs;
14
+                s->bs = *s->pbuf++;
15
+            }
16
         }
17
     }else
18
         s->pbuf= s->ebuf;
19
ffmpeg-0.10.2.tar.bz2/libavcodec/mimic.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/mimic.c Changed
35
 
1
@@ -259,8 +259,8 @@
2
                         int index = (ctx->cur_index+backref)&15;
3
                         uint8_t *p = ctx->flipped_ptrsindex.data0;
4
 
5
-                        ff_thread_await_progress(&ctx->buf_ptrsindex, cur_row, 0);
6
-                        if(p) {
7
+                        if (index != ctx->cur_index && p) {
8
+                            ff_thread_await_progress(&ctx->buf_ptrsindex, cur_row, 0);
9
                             p += src -
10
                                 ctx->flipped_ptrsctx->prev_index.dataplane;
11
                             ctx->dsp.put_pixels_tab10(dst, p, stride, 8);
12
@@ -310,6 +310,7 @@
13
     int width, height;
14
     int quality, num_coeffs;
15
     int swap_buf_size = buf_size - MIMIC_HEADER_SIZE;
16
+    int res;
17
 
18
     if(buf_size < MIMIC_HEADER_SIZE) {
19
         av_log(avctx, AV_LOG_ERROR, "insufficient data\n");
20
@@ -376,10 +377,10 @@
21
                         swap_buf_size>>2);
22
     init_get_bits(&ctx->gb, ctx->swap_buf, swap_buf_size << 3);
23
 
24
-    if(!decode(ctx, quality, num_coeffs, !is_pframe)) {
25
-        if (avctx->active_thread_type&FF_THREAD_FRAME)
26
-            ff_thread_report_progress(&ctx->buf_ptrsctx->cur_index, INT_MAX, 0);
27
-        else {
28
+    res = decode(ctx, quality, num_coeffs, !is_pframe);
29
+    ff_thread_report_progress(&ctx->buf_ptrsctx->cur_index, INT_MAX, 0);
30
+    if (!res) {
31
+        if (!(avctx->active_thread_type & FF_THREAD_FRAME)) {
32
             ff_thread_release_buffer(avctx, &ctx->buf_ptrsctx->cur_index);
33
             return -1;
34
         }
35
ffmpeg-0.10.2.tar.bz2/libavcodec/mjpegdec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/mjpegdec.c Changed
20
 
1
@@ -316,9 +316,7 @@
2
         s->first_picture = 0;
3
     }
4
 
5
-    if (s->interlaced && (s->bottom_field == !s->interlace_polarity))
6
-        return 0;
7
-
8
+    if (!(s->interlaced && (s->bottom_field == !s->interlace_polarity))) {
9
     /* XXX: not complete test ! */
10
     pix_fmt_id = (s->h_count0 << 28) | (s->v_count0 << 24) |
11
                  (s->h_count1 << 20) | (s->v_count1 << 16) |
12
@@ -431,6 +429,7 @@
13
 
14
     if (len != (8 + (3 * nb_components)))
15
         av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) mismatch\n", len);
16
+    }
17
 
18
     /* totally blank picture as progressive JPEG will only add details to it */
19
     if (s->progressive) {
20
ffmpeg-0.10.2.tar.bz2/libavcodec/motionpixels.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/motionpixels.c Changed
28
 
1
@@ -191,10 +191,13 @@
2
             p = mp_get_yuv_from_rgb(mp, x - 1, y);
3
         } else {
4
             p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
5
+            p.y = av_clip(p.y, 0, 31);
6
             if ((x & 3) == 0) {
7
                 if ((y & 3) == 0) {
8
                     p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
9
+                    p.v = av_clip(p.v, -32, 31);
10
                     p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
11
+                    p.u = av_clip(p.u, -32, 31);
12
                     mp->hpt((y / 4) * mp->avctx->width + x) / 4 = p;
13
                 } else {
14
                     p.v = mp->hpt((y / 4) * mp->avctx->width + x) / 4.v;
15
@@ -218,9 +221,12 @@
16
             p = mp_get_yuv_from_rgb(mp, 0, y);
17
         } else {
18
             p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));
19
+            p.y = av_clip(p.y, 0, 31);
20
             if ((y & 3) == 0) {
21
                 p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));
22
+                p.v = av_clip(p.v, -32, 31);
23
                 p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));
24
+                p.u = av_clip(p.u, -32, 31);
25
             }
26
             mp->vpty = p;
27
             mp_set_rgb_from_yuv(mp, 0, y, &p);
28
ffmpeg-0.10.2.tar.bz2/libavcodec/mpegvideo.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/mpegvideo.c Changed
26
 
1
@@ -422,12 +422,12 @@
2
     // edge emu needs blocksize + filter length - 1
3
     // (= 17x17 for  halfpel / 21x21 for  h264)
4
     FF_ALLOCZ_OR_GOTO(s->avctx, s->edge_emu_buffer,
5
-                      (s->width + 64) * 2 * 21 * 2, fail);    // (width + edge + align)*interlaced*MBsize*tolerance
6
+                      (s->width + 95) * 2 * 21 * 4, fail);    // (width + edge + align)*interlaced*MBsize*tolerance
7
 
8
     // FIXME should be linesize instead of s->width * 2
9
     // but that is not known before get_buffer()
10
     FF_ALLOCZ_OR_GOTO(s->avctx, s->me.scratchpad,
11
-                      (s->width + 64) * 4 * 16 * 2 * sizeof(uint8_t), fail)
12
+                      (s->width + 95) * 4 * 16 * 2 * sizeof(uint8_t), fail)
13
     s->me.temp         = s->me.scratchpad;
14
     s->rd_scratchpad   = s->me.scratchpad;
15
     s->b_scratchpad    = s->me.scratchpad;
16
@@ -1394,8 +1394,7 @@
17
     s->avctx->coded_frame = (AVFrame *) s->current_picture_ptr;
18
 
19
     if (s->codec_id != CODEC_ID_H264 && s->current_picture.f.reference) {
20
-        ff_thread_report_progress((AVFrame *) s->current_picture_ptr,
21
-                                  s->mb_height - 1, 0);
22
+        ff_thread_report_progress((AVFrame *) s->current_picture_ptr, INT_MAX, 0);
23
     }
24
 }
25
 
26
ffmpeg-0.10.2.tar.bz2/libavcodec/pngenc.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/pngenc.c Changed
10
 
1
@@ -55,7 +55,7 @@
2
     uint8_t *d;
3
     const uint8_t *s;
4
 
5
-    mask = ff_png_pass_maskpass;
6
+    mask =  (int){0x80, 0x08, 0x88, 0x22, 0xaa, 0x55, 0xff}pass;
7
     switch(bits_per_pixel) {
8
     case 1:
9
         memset(dst, 0, row_size);
10
ffmpeg-0.10.2.tar.bz2/libavcodec/rawdec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/rawdec.c Changed
20
 
1
@@ -139,6 +139,7 @@
2
     int buf_size = avpkt->size;
3
     int linesize_align = 4;
4
     RawVideoContext *context = avctx->priv_data;
5
+    int res;
6
 
7
     AVFrame * frame = (AVFrame *) data;
8
     AVPicture * picture = (AVPicture *) data;
9
@@ -185,7 +186,9 @@
10
        avctx->codec_tag == MKTAG('A', 'V', 'u', 'p'))
11
         buf += buf_size - context->length;
12
 
13
-    avpicture_fill(picture, buf, avctx->pix_fmt, avctx->width, avctx->height);
14
+    if ((res = avpicture_fill(picture, buf, avctx->pix_fmt,
15
+                              avctx->width, avctx->height)) < 0)
16
+        return res;
17
     if((avctx->pix_fmt==PIX_FMT_PAL8 && buf_size < context->length) ||
18
        (avctx->pix_fmt!=PIX_FMT_PAL8 &&
19
         (av_pix_fmt_descriptorsavctx->pix_fmt.flags & PIX_FMT_PAL))){
20
ffmpeg-0.10.2.tar.bz2/libavcodec/smacker.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/smacker.c Changed
10
 
1
@@ -668,7 +668,7 @@
2
     }
3
     if(bits) { //decode 16-bit data
4
         for(i = stereo; i >= 0; i--)
5
-            predi = av_bswap16(get_bits(&gb, 16));
6
+            predi = sign_extend(av_bswap16(get_bits(&gb, 16)), 16);
7
         for(i = 0; i <= stereo; i++)
8
             *samples++ = predi;
9
         for(; i < unp_size / 2; i++) {
10
ffmpeg-0.10.2.tar.bz2/libavcodec/truemotion2.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/truemotion2.c Changed
344
 
1
@@ -25,6 +25,7 @@
2
  */
3
 
4
 #include "avcodec.h"
5
+#include "bytestream.h"
6
 #include "get_bits.h"
7
 #include "dsputil.h"
8
 
9
@@ -59,7 +60,9 @@
10
     int *clast;
11
 
12
     /* data for current and previous frame */
13
+    int *Y1_base, *U1_base, *V1_base, *Y2_base, *U2_base, *V2_base;
14
     int *Y1, *U1, *V1, *Y2, *U2, *V2;
15
+    int y_stride, uv_stride;
16
     int cur;
17
 } TM2Context;
18
 
19
@@ -130,7 +133,7 @@
20
 
21
     /* check for correct codes parameters */
22
     if((huff.val_bits < 1) || (huff.val_bits > 32) ||
23
-       (huff.max_bits < 0) || (huff.max_bits > 32)) {
24
+       (huff.max_bits < 0) || (huff.max_bits > 25)) {
25
         av_log(ctx->avctx, AV_LOG_ERROR, "Incorrect tree parameters - literal length: %i, max code length: %i\n",
26
                huff.val_bits, huff.max_bits);
27
         return -1;
28
@@ -251,13 +254,14 @@
29
 static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, int buf_size)
30
 {
31
     int i;
32
-    int cur = 0;
33
     int skip = 0;
34
-    int len, toks;
35
+    int len, toks, pos;
36
     TM2Codes codes;
37
+    GetByteContext gb;
38
 
39
     /* get stream length in dwords */
40
-    len = AV_RB32(buf); buf += 4; cur += 4;
41
+    bytestream2_init(&gb, buf, buf_size);
42
+    len  = bytestream2_get_be32(&gb);
43
     skip = len * 4 + 4;
44
 
45
     if(len == 0)
46
@@ -268,36 +272,37 @@
47
         return -1;
48
     }
49
 
50
-    toks = AV_RB32(buf); buf += 4; cur += 4;
51
+    toks = bytestream2_get_be32(&gb);
52
     if(toks & 1) {
53
-        len = AV_RB32(buf); buf += 4; cur += 4;
54
+        len = bytestream2_get_be32(&gb);
55
         if(len == TM2_ESCAPE) {
56
-            len = AV_RB32(buf); buf += 4; cur += 4;
57
+            len = bytestream2_get_be32(&gb);
58
         }
59
         if(len > 0) {
60
-            if (skip <= cur)
61
+            pos = bytestream2_tell(&gb);
62
+            if (skip <= pos)
63
                 return -1;
64
-            init_get_bits(&ctx->gb, buf, (skip - cur) * 8);
65
+            init_get_bits(&ctx->gb, buf + pos, (skip - pos) * 8);
66
             if(tm2_read_deltas(ctx, stream_id) == -1)
67
                 return -1;
68
-            buf += ((get_bits_count(&ctx->gb) + 31) >> 5) << 2;
69
-            cur += ((get_bits_count(&ctx->gb) + 31) >> 5) << 2;
70
+            bytestream2_skip(&gb, ((get_bits_count(&ctx->gb) + 31) >> 5) << 2);
71
         }
72
     }
73
     /* skip unused fields */
74
-    if(AV_RB32(buf) == TM2_ESCAPE) {
75
-        buf += 4; cur += 4; /* some unknown length - could be escaped too */
76
+    len = bytestream2_get_be32(&gb);
77
+    if(len == TM2_ESCAPE) { /* some unknown length - could be escaped too */
78
+        bytestream2_skip(&gb, 8); /* unused by decoder */
79
+    } else {
80
+        bytestream2_skip(&gb, 4); /* unused by decoder */
81
     }
82
-    buf += 4; cur += 4;
83
-    buf += 4; cur += 4; /* unused by decoder */
84
 
85
-    if (skip <= cur)
86
+    pos = bytestream2_tell(&gb);
87
+    if (skip <= pos)
88
         return -1;
89
-    init_get_bits(&ctx->gb, buf, (skip - cur) * 8);
90
+    init_get_bits(&ctx->gb, buf + pos, (skip - pos) * 8);
91
     if(tm2_build_huff_table(ctx, &codes) == -1)
92
         return -1;
93
-    buf += ((get_bits_count(&ctx->gb) + 31) >> 5) << 2;
94
-    cur += ((get_bits_count(&ctx->gb) + 31) >> 5) << 2;
95
+    bytestream2_skip(&gb, ((get_bits_count(&ctx->gb) + 31) >> 5) << 2);
96
 
97
     toks >>= 1;
98
     /* check if we have sane number of tokens */
99
@@ -308,21 +313,33 @@
100
     }
101
     ctx->tokensstream_id = av_realloc(ctx->tokensstream_id, toks * sizeof(int));
102
     ctx->tok_lensstream_id = toks;
103
-    len = AV_RB32(buf); buf += 4; cur += 4;
104
+    len = bytestream2_get_be32(&gb);
105
     if(len > 0) {
106
-        if (skip <= cur)
107
+        pos = bytestream2_tell(&gb);
108
+        if (skip <= pos)
109
             return -1;
110
-        init_get_bits(&ctx->gb, buf, (skip - cur) * 8);
111
+        init_get_bits(&ctx->gb, buf + pos, (skip - pos) * 8);
112
         for(i = 0; i < toks; i++) {
113
             if (get_bits_left(&ctx->gb) <= 0) {
114
                 av_log(ctx->avctx, AV_LOG_ERROR, "Incorrect number of tokens: %i\n", toks);
115
                 return -1;
116
             }
117
             ctx->tokensstream_idi = tm2_get_token(&ctx->gb, &codes);
118
+            if (stream_id <= TM2_MOT && ctx->tokensstream_idi >= TM2_DELTAS) {
119
+                av_log(ctx->avctx, AV_LOG_ERROR, "Invalid delta token index %d for type %d, n=%d\n",
120
+                       ctx->tokensstream_idi, stream_id, i);
121
+                return AVERROR_INVALIDDATA;
122
+            }
123
         }
124
     } else {
125
-        for(i = 0; i < toks; i++)
126
+        for(i = 0; i < toks; i++) {
127
             ctx->tokensstream_idi = codes.recode0;
128
+            if (stream_id <= TM2_MOT && ctx->tokensstream_idi >= TM2_DELTAS) {
129
+                av_log(ctx->avctx, AV_LOG_ERROR, "Invalid delta token index %d for type %d, n=%d\n",
130
+                       ctx->tokensstream_idi, stream_id, i);
131
+                return AVERROR_INVALIDDATA;
132
+            }
133
+        }
134
     }
135
     tm2_free_codes(&codes);
136
 
137
@@ -347,9 +364,9 @@
138
     int *Y, *U, *V;\
139
     int Ystride, Ustride, Vstride;\
140
 \
141
-    Ystride = ctx->avctx->width;\
142
-    Vstride = (ctx->avctx->width + 1) >> 1;\
143
-    Ustride = (ctx->avctx->width + 1) >> 1;\
144
+    Ystride = ctx->y_stride;\
145
+    Vstride = ctx->uv_stride;\
146
+    Ustride = ctx->uv_stride;\
147
     Y = (ctx->cur?ctx->Y2:ctx->Y1) + by * 4 * Ystride + bx * 4;\
148
     V = (ctx->cur?ctx->V2:ctx->V1) + by * 2 * Vstride + bx * 2;\
149
     U = (ctx->cur?ctx->U2:ctx->U1) + by * 2 * Ustride + bx * 2;\
150
@@ -637,6 +654,8 @@
151
 
152
     mx = GET_TOK(ctx, TM2_MOT);
153
     my = GET_TOK(ctx, TM2_MOT);
154
+    mx = av_clip(mx, -(bx * 4 + 4), ctx->avctx->width  - bx * 4);
155
+    my = av_clip(my, -(by * 4 + 4), ctx->avctx->height - by * 4);
156
 
157
     Yo += my * oYstride + mx;
158
     Uo += (my >> 1) * oUstride + (mx >> 1);
159
@@ -677,15 +696,12 @@
160
 static int tm2_decode_blocks(TM2Context *ctx, AVFrame *p)
161
 {
162
     int i, j;
163
-    int bw, bh;
164
+    int w = ctx->avctx->width, h = ctx->avctx->height, bw = w >> 2, bh = h >> 2, cw = w >> 1;
165
     int type;
166
     int keyframe = 1;
167
     int *Y, *U, *V;
168
     uint8_t *dst;
169
 
170
-    bw = ctx->avctx->width >> 2;
171
-    bh = ctx->avctx->height >> 2;
172
-
173
     for(i = 0; i < TM2_NUM_STREAMS; i++)
174
         ctx->tok_ptrsi = 0;
175
 
176
@@ -738,17 +754,54 @@
177
     U = (ctx->cur?ctx->U2:ctx->U1);
178
     V = (ctx->cur?ctx->V2:ctx->V1);
179
     dst = p->data0;
180
-    for(j = 0; j < ctx->avctx->height; j++){
181
-        for(i = 0; i < ctx->avctx->width; i++){
182
+    for(j = 0; j < h; j++){
183
+        for(i = 0; i < w; i++){
184
             int y = Yi, u = Ui >> 1, v = Vi >> 1;
185
             dst3*i+0 = av_clip_uint8(y + v);
186
             dst3*i+1 = av_clip_uint8(y);
187
             dst3*i+2 = av_clip_uint8(y + u);
188
         }
189
-        Y += ctx->avctx->width;
190
+
191
+        /* horizontal edge extension */
192
+        Y-4    = Y-3    = Y-2    = Y-1 = Y0;
193
+        Yw + 3 = Yw + 2 = Yw + 1 = Yw  = Yw - 1;
194
+
195
+        /* vertical edge extension */
196
+        if (j == 0) {
197
+            memcpy(Y - 4 - 1 * ctx->y_stride, Y - 4, ctx->y_stride);
198
+            memcpy(Y - 4 - 2 * ctx->y_stride, Y - 4, ctx->y_stride);
199
+            memcpy(Y - 4 - 3 * ctx->y_stride, Y - 4, ctx->y_stride);
200
+            memcpy(Y - 4 - 4 * ctx->y_stride, Y - 4, ctx->y_stride);
201
+        } else if (j == h - 1) {
202
+            memcpy(Y - 4 + 1 * ctx->y_stride, Y - 4, ctx->y_stride);
203
+            memcpy(Y - 4 + 2 * ctx->y_stride, Y - 4, ctx->y_stride);
204
+            memcpy(Y - 4 + 3 * ctx->y_stride, Y - 4, ctx->y_stride);
205
+            memcpy(Y - 4 + 4 * ctx->y_stride, Y - 4, ctx->y_stride);
206
+        }
207
+
208
+        Y += ctx->y_stride;
209
         if (j & 1) {
210
-            U += ctx->avctx->width >> 1;
211
-            V += ctx->avctx->width >> 1;
212
+            /* horizontal edge extension */
213
+            U-2     = U-1 = U0;
214
+            V-2     = V-1 = V0;
215
+            Ucw + 1 = Ucw = Ucw - 1;
216
+            Vcw + 1 = Vcw = Vcw - 1;
217
+
218
+            /* vertical edge extension */
219
+            if (j == 1) {
220
+                memcpy(U - 2 - 1 * ctx->uv_stride, U - 2, ctx->uv_stride);
221
+                memcpy(V - 2 - 1 * ctx->uv_stride, V - 2, ctx->uv_stride);
222
+                memcpy(U - 2 - 2 * ctx->uv_stride, U - 2, ctx->uv_stride);
223
+                memcpy(V - 2 - 2 * ctx->uv_stride, V - 2, ctx->uv_stride);
224
+            } else if (j == h - 1) {
225
+                memcpy(U - 2 + 1 * ctx->uv_stride, U - 2, ctx->uv_stride);
226
+                memcpy(V - 2 + 1 * ctx->uv_stride, V - 2, ctx->uv_stride);
227
+                memcpy(U - 2 + 2 * ctx->uv_stride, U - 2, ctx->uv_stride);
228
+                memcpy(V - 2 + 2 * ctx->uv_stride, V - 2, ctx->uv_stride);
229
+            }
230
+
231
+            U += ctx->uv_stride;
232
+            V += ctx->uv_stride;
233
         }
234
         dst += p->linesize0;
235
     }
236
@@ -765,7 +818,7 @@
237
                         AVPacket *avpkt)
238
 {
239
     const uint8_t *buf = avpkt->data;
240
-    int buf_size = avpkt->size;
241
+    int buf_size = avpkt->size & ~3;
242
     TM2Context * const l = avctx->priv_data;
243
     AVFrame * const p= (AVFrame*)&l->pic;
244
     int i, skip, t;
245
@@ -790,9 +843,12 @@
246
     }
247
 
248
     for(i = 0; i < TM2_NUM_STREAMS; i++){
249
-        t = tm2_read_stream(l, l->buffer + skip, tm2_stream_orderi, buf_size);
250
-        if(t == -1){
251
-            return -1;
252
+        if (skip >= buf_size) {
253
+            return AVERROR_INVALIDDATA;
254
+        }
255
+        t = tm2_read_stream(l, l->buffer + skip, tm2_stream_orderi, buf_size - skip);
256
+        if(t < 0){
257
+            return t;
258
         }
259
         skip += t;
260
     }
261
@@ -811,7 +867,7 @@
262
 
263
 static av_cold int decode_init(AVCodecContext *avctx){
264
     TM2Context * const l = avctx->priv_data;
265
-    int i;
266
+    int i, w = avctx->width, h = avctx->height;
267
 
268
     if((avctx->width & 3) || (avctx->height & 3)){
269
         av_log(avctx, AV_LOG_ERROR, "Width and height must be multiple of 4\n");
270
@@ -825,21 +881,46 @@
271
 
272
     dsputil_init(&l->dsp, avctx);
273
 
274
-    l->last = av_malloc(4 * sizeof(int) * (avctx->width >> 2));
275
-    l->clast = av_malloc(4 * sizeof(int) * (avctx->width >> 2));
276
+    l->last  = av_malloc(4 * sizeof(*l->last)  * (w >> 2));
277
+    l->clast = av_malloc(4 * sizeof(*l->clast) * (w >> 2));
278
 
279
     for(i = 0; i < TM2_NUM_STREAMS; i++) {
280
         l->tokensi = NULL;
281
         l->tok_lensi = 0;
282
     }
283
 
284
-    l->Y1 = av_malloc(sizeof(int) * avctx->width * avctx->height);
285
-    l->U1 = av_malloc(sizeof(int) * ((avctx->width + 1) >> 1) * ((avctx->height + 1) >> 1));
286
-    l->V1 = av_malloc(sizeof(int) * ((avctx->width + 1) >> 1) * ((avctx->height + 1) >> 1));
287
-    l->Y2 = av_malloc(sizeof(int) * avctx->width * avctx->height);
288
-    l->U2 = av_malloc(sizeof(int) * ((avctx->width + 1) >> 1) * ((avctx->height + 1) >> 1));
289
-    l->V2 = av_malloc(sizeof(int) * ((avctx->width + 1) >> 1) * ((avctx->height + 1) >> 1));
290
+    w += 8;
291
+    h += 8;
292
+    l->Y1_base = av_malloc(sizeof(*l->Y1_base) * w * h);
293
+    l->Y2_base = av_malloc(sizeof(*l->Y2_base) * w * h);
294
+    l->y_stride = w;
295
+    w = (w + 1) >> 1;
296
+    h = (h + 1) >> 1;
297
+    l->U1_base = av_malloc(sizeof(*l->U1_base) * w * h);
298
+    l->V1_base = av_malloc(sizeof(*l->V1_base) * w * h);
299
+    l->U2_base = av_malloc(sizeof(*l->U2_base) * w * h);
300
+    l->V2_base = av_malloc(sizeof(*l->V1_base) * w * h);
301
+    l->uv_stride = w;
302
     l->cur = 0;
303
+    if (!l->Y1_base || !l->Y2_base || !l->U1_base ||
304
+        !l->V1_base || !l->U2_base || !l->V2_base ||
305
+        !l->last    || !l->clast) {
306
+        av_freep(l->Y1_base);
307
+        av_freep(l->Y2_base);
308
+        av_freep(l->U1_base);
309
+        av_freep(l->U2_base);
310
+        av_freep(l->V1_base);
311
+        av_freep(l->V2_base);
312
+        av_freep(l->last);
313
+        av_freep(l->clast);
314
+        return AVERROR(ENOMEM);
315
+    }
316
+    l->Y1 = l->Y1_base + l->y_stride  * 4 + 4;
317
+    l->Y2 = l->Y2_base + l->y_stride  * 4 + 4;
318
+    l->U1 = l->U1_base + l->uv_stride * 2 + 2;
319
+    l->U2 = l->U2_base + l->uv_stride * 2 + 2;
320
+    l->V1 = l->V1_base + l->uv_stride * 2 + 2;
321
+    l->V2 = l->V2_base + l->uv_stride * 2 + 2;
322
 
323
     return 0;
324
 }
325
@@ -854,12 +935,12 @@
326
     for(i = 0; i < TM2_NUM_STREAMS; i++)
327
         av_free(l->tokensi);
328
     if(l->Y1){
329
-        av_free(l->Y1);
330
-        av_free(l->U1);
331
-        av_free(l->V1);
332
-        av_free(l->Y2);
333
-        av_free(l->U2);
334
-        av_free(l->V2);
335
+        av_free(l->Y1_base);
336
+        av_free(l->U1_base);
337
+        av_free(l->V1_base);
338
+        av_free(l->Y2_base);
339
+        av_free(l->U2_base);
340
+        av_free(l->V2_base);
341
     }
342
     av_freep(&l->buffer);
343
     l->buffer_size = 0;
344
ffmpeg-0.10.2.tar.bz2/libavcodec/tta.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/tta.c Changed
120
 
1
@@ -32,6 +32,7 @@
2
 #include <limits.h>
3
 #include "avcodec.h"
4
 #include "get_bits.h"
5
+#include "libavutil/crc.h"
6
 
7
 #define FORMAT_SIMPLE    1
8
 #define FORMAT_ENCRYPTED 2
9
@@ -58,8 +59,10 @@
10
     AVCodecContext *avctx;
11
     AVFrame frame;
12
     GetBitContext gb;
13
+    const AVCRC *crc_table;
14
 
15
-    int format, channels, bps, data_length;
16
+    int format, channels, bps;
17
+    unsigned data_length;
18
     int frame_length, last_frame_length, total_frames;
19
 
20
     int32_t *decode_buffer;
21
@@ -198,10 +201,23 @@
22
     AV_CH_LAYOUT_7POINT1_WIDE
23
 };
24
 
25
+static int tta_check_crc(TTAContext *s, const uint8_t *buf, int buf_size)
26
+{
27
+    uint32_t crc, CRC;
28
+
29
+    CRC = AV_RL32(buf + buf_size);
30
+    crc = av_crc(s->crc_table, 0xFFFFFFFFU, buf, buf_size);
31
+    if (CRC != (crc ^ 0xFFFFFFFFU)) {
32
+        av_log(s->avctx, AV_LOG_ERROR, "CRC error\n");
33
+        return AVERROR_INVALIDDATA;
34
+    }
35
+
36
+    return 0;
37
+}
38
+
39
 static av_cold int tta_decode_init(AVCodecContext * avctx)
40
 {
41
     TTAContext *s = avctx->priv_data;
42
-    int i;
43
 
44
     s->avctx = avctx;
45
 
46
@@ -212,8 +228,14 @@
47
     init_get_bits(&s->gb, avctx->extradata, avctx->extradata_size * 8);
48
     if (show_bits_long(&s->gb, 32) == AV_RL32("TTA1"))
49
     {
50
+        if (avctx->err_recognition & AV_EF_CRCCHECK) {
51
+            s->crc_table = av_crc_get_table(AV_CRC_32_IEEE_LE);
52
+            if (tta_check_crc(s, avctx->extradata, 18))
53
+                return AVERROR_INVALIDDATA;
54
+        }
55
+
56
         /* signature */
57
-        skip_bits(&s->gb, 32);
58
+        skip_bits_long(&s->gb, 32);
59
 
60
         s->format = get_bits(&s->gb, 16);
61
         if (s->format > 2) {
62
@@ -231,7 +253,7 @@
63
         s->bps = (avctx->bits_per_coded_sample + 7) / 8;
64
         avctx->sample_rate = get_bits_long(&s->gb, 32);
65
         s->data_length = get_bits_long(&s->gb, 32);
66
-        skip_bits(&s->gb, 32); // CRC32 of header
67
+        skip_bits_long(&s->gb, 32); // CRC32 of header
68
 
69
         if (s->channels == 0) {
70
             av_log(s->avctx, AV_LOG_ERROR, "Invalid number of channels\n");
71
@@ -258,7 +280,7 @@
72
         }
73
 
74
         // prevent overflow
75
-        if (avctx->sample_rate > 0x7FFFFF) {
76
+        if (avctx->sample_rate > 0x7FFFFFu) {
77
             av_log(avctx, AV_LOG_ERROR, "sample_rate too large\n");
78
             return AVERROR(EINVAL);
79
         }
80
@@ -275,9 +297,15 @@
81
             s->data_length, s->frame_length, s->last_frame_length, s->total_frames);
82
 
83
         // FIXME: seek table
84
-        for (i = 0; i < s->total_frames; i++)
85
-            skip_bits(&s->gb, 32);
86
-        skip_bits(&s->gb, 32); // CRC32 of seektable
87
+        if (avctx->extradata_size <= 26 || s->total_frames > INT_MAX / 4 ||
88
+            avctx->extradata_size - 26 < s->total_frames * 4)
89
+            av_log(avctx, AV_LOG_WARNING, "Seek table missing or too small\n");
90
+        else if (avctx->err_recognition & AV_EF_CRCCHECK) {
91
+            if (tta_check_crc(s, avctx->extradata + 22, s->total_frames * 4))
92
+                return AVERROR_INVALIDDATA;
93
+        }
94
+        skip_bits_long(&s->gb, 32 * s->total_frames);
95
+        skip_bits_long(&s->gb, 32); // CRC32 of seektable
96
 
97
         if(s->frame_length >= UINT_MAX / (s->channels * sizeof(int32_t))){
98
             av_log(avctx, AV_LOG_ERROR, "frame_length too large\n");
99
@@ -313,6 +341,11 @@
100
     int cur_chan = 0, framelen = s->frame_length;
101
     int32_t *p;
102
 
103
+    if (avctx->err_recognition & AV_EF_CRCCHECK) {
104
+        if (buf_size < 4 || tta_check_crc(s, buf, buf_size - 4))
105
+            return AVERROR_INVALIDDATA;
106
+    }
107
+
108
     init_get_bits(&s->gb, buf, buf_size*8);
109
 
110
     // FIXME: seeking
111
@@ -416,7 +449,7 @@
112
 
113
     if (get_bits_left(&s->gb) < 32)
114
         return -1;
115
-    skip_bits(&s->gb, 32); // frame crc
116
+    skip_bits_long(&s->gb, 32); // frame crc
117
 
118
         // convert to output buffer
119
         switch(s->bps) {
120
ffmpeg-0.10.2.tar.bz2/libavcodec/utvideo.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/utvideo.c Changed
67
 
1
@@ -358,13 +358,12 @@
2
 {
3
     const uint8_t *buf = avpkt->data;
4
     int buf_size = avpkt->size;
5
-    const uint8_t *buf_end = buf + buf_size;
6
     UtvideoContext *c = avctx->priv_data;
7
-    const uint8_t *ptr;
8
     int i, j;
9
     const uint8_t *plane_start5;
10
     int plane_size, max_slice_size = 0, slice_start, slice_end, slice_size;
11
     int ret;
12
+    GetByteContext gb;
13
 
14
     if (c->pic.data0)
15
         ff_thread_release_buffer(avctx, &c->pic);
16
@@ -379,20 +378,21 @@
17
     ff_thread_finish_setup(avctx);
18
 
19
     /* parse plane structure to retrieve frame flags and validate slice offsets */
20
-    ptr = buf;
21
+    bytestream2_init(&gb, buf, buf_size);
22
     for (i = 0; i < c->planes; i++) {
23
-        plane_starti = ptr;
24
-        if (buf_end - ptr < 256 + 4 * c->slices) {
25
+        plane_starti = gb.buffer;
26
+        if (bytestream2_get_bytes_left(&gb) < 256 + 4 * c->slices) {
27
             av_log(avctx, AV_LOG_ERROR, "Insufficient data for a plane\n");
28
             return AVERROR_INVALIDDATA;
29
         }
30
-        ptr += 256;
31
+        bytestream2_skipu(&gb, 256);
32
         slice_start = 0;
33
         slice_end   = 0;
34
         for (j = 0; j < c->slices; j++) {
35
-            slice_end   = bytestream_get_le32(&ptr);
36
+            slice_end   = bytestream2_get_le32u(&gb);
37
             slice_size  = slice_end - slice_start;
38
-            if (slice_size < 0) {
39
+            if (slice_end <= 0 || slice_size <= 0 ||
40
+                bytestream2_get_bytes_left(&gb) < slice_end) {
41
                 av_log(avctx, AV_LOG_ERROR, "Incorrect slice size\n");
42
                 return AVERROR_INVALIDDATA;
43
             }
44
@@ -400,18 +400,14 @@
45
             max_slice_size = FFMAX(max_slice_size, slice_size);
46
         }
47
         plane_size = slice_end;
48
-        if (buf_end - ptr < plane_size) {
49
-            av_log(avctx, AV_LOG_ERROR, "Plane size is bigger than available data\n");
50
-            return AVERROR_INVALIDDATA;
51
-        }
52
-        ptr += plane_size;
53
+        bytestream2_skipu(&gb, plane_size);
54
     }
55
-    plane_startc->planes = ptr;
56
-    if (buf_end - ptr < c->frame_info_size) {
57
+    plane_startc->planes = gb.buffer;
58
+    if (bytestream2_get_bytes_left(&gb) < c->frame_info_size) {
59
         av_log(avctx, AV_LOG_ERROR, "Not enough data for frame information\n");
60
         return AVERROR_INVALIDDATA;
61
     }
62
-    c->frame_info = AV_RL32(ptr);
63
+    c->frame_info = bytestream2_get_le32u(&gb);
64
     av_log(avctx, AV_LOG_DEBUG, "frame information flags %X\n", c->frame_info);
65
 
66
     c->frame_pred = (c->frame_info >> 8) & 3;
67
ffmpeg-0.10.2.tar.bz2/libavcodec/vc1.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/vc1.c Changed
10
 
1
@@ -493,7 +493,7 @@
2
                 int nr, dr;
3
                 nr = get_bits(gb, 8);
4
                 dr = get_bits(gb, 4);
5
-                if (nr && nr < 8 && dr && dr < 3) {
6
+                if (nr > 0 && nr < 8 && dr > 0 && dr < 3) {
7
                     v->s.avctx->time_base.num = ff_vc1_fps_drdr - 1;
8
                     v->s.avctx->time_base.den = ff_vc1_fps_nrnr - 1 * 1000;
9
                 }
10
ffmpeg-0.10.2.tar.bz2/libavcodec/vc1data.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/vc1data.c Changed
10
 
1
@@ -84,7 +84,7 @@
2
     }
3
 };
4
 
5
-const int ff_vc1_fps_nr5 = { 24, 25, 30, 50, 60 },
6
+const int ff_vc1_fps_nr7 = { 24, 25, 30, 50, 60, 48, 72 },
7
           ff_vc1_fps_dr2 = { 1000, 1001 };
8
 const uint8_t ff_vc1_pquant_table332 = {
9
     /* Implicit quantizer */
10
ffmpeg-0.10.2.tar.bz2/libavcodec/vc1data.h -> ffmpeg-0.10.3.tar.bz2/libavcodec/vc1data.h Changed
10
 
1
@@ -41,7 +41,7 @@
2
 extern const uint8_t ff_vc1_mv_pmode_table25;
3
 extern const uint8_t ff_vc1_mv_pmode_table224;
4
 
5
-extern const int ff_vc1_fps_nr5, ff_vc1_fps_dr2;
6
+extern const int ff_vc1_fps_nr7, ff_vc1_fps_dr2;
7
 extern const uint8_t ff_vc1_pquant_table332;
8
 
9
 /* MBMODE table for interlaced frame P-picture */
10
ffmpeg-0.10.2.tar.bz2/libavcodec/vc1dec.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/vc1dec.c Changed
93
 
1
@@ -2512,6 +2512,7 @@
2
     int16_t *dc_val;
3
     int mb_pos = s->mb_x + s->mb_y * s->mb_stride;
4
     int q1, q2 = 0;
5
+    int dqscale_index;
6
 
7
     wrap = s->block_wrapn;
8
     dc_val = s->dc_val0 + s->block_indexn;
9
@@ -2524,15 +2525,18 @@
10
     a = dc_val - wrap;
11
     /* scale predictors if needed */
12
     q1 = s->current_picture.f.qscale_tablemb_pos;
13
+    dqscale_index = s->y_dc_scale_tableq1 - 1;
14
+    if (dqscale_index < 0)
15
+        return 0;
16
     if (c_avail && (n != 1 && n != 3)) {
17
         q2 = s->current_picture.f.qscale_tablemb_pos - 1;
18
         if (q2 && q2 != q1)
19
-            c = (c * s->y_dc_scale_tableq2 * ff_vc1_dqscales->y_dc_scale_tableq1 - 1 + 0x20000) >> 18;
20
+            c = (c * s->y_dc_scale_tableq2 * ff_vc1_dqscaledqscale_index + 0x20000) >> 18;
21
     }
22
     if (a_avail && (n != 2 && n != 3)) {
23
         q2 = s->current_picture.f.qscale_tablemb_pos - s->mb_stride;
24
         if (q2 && q2 != q1)
25
-            a = (a * s->y_dc_scale_tableq2 * ff_vc1_dqscales->y_dc_scale_tableq1 - 1 + 0x20000) >> 18;
26
+            a = (a * s->y_dc_scale_tableq2 * ff_vc1_dqscaledqscale_index + 0x20000) >> 18;
27
     }
28
     if (a_avail && c_avail && (n != 3)) {
29
         int off = mb_pos;
30
@@ -2542,7 +2546,7 @@
31
             off -= s->mb_stride;
32
         q2 = s->current_picture.f.qscale_tableoff;
33
         if (q2 && q2 != q1)
34
-            b = (b * s->y_dc_scale_tableq2 * ff_vc1_dqscales->y_dc_scale_tableq1 - 1 + 0x20000) >> 18;
35
+            b = (b * s->y_dc_scale_tableq2 * ff_vc1_dqscaledqscale_index + 0x20000) >> 18;
36
     }
37
 
38
     if (a_avail && c_avail) {
39
@@ -2959,6 +2963,8 @@
40
                 q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
41
                 q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
42
 
43
+                if (q1 < 1)
44
+                    return AVERROR_INVALIDDATA;
45
                 if (dc_pred_dir) { // left
46
                     for (k = 1; k < 8; k++)
47
                         blockk << v->left_blk_sh += (ac_valk * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
48
@@ -3001,6 +3007,8 @@
49
                 if (q2 && q1 != q2) {
50
                     q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
51
                     q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
52
+                    if (q1 < 1)
53
+                        return AVERROR_INVALIDDATA;
54
                     for (k = 1; k < 8; k++)
55
                         ac_val2k = (ac_val2k * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
56
                 }
57
@@ -3011,6 +3019,8 @@
58
                 if (q2 && q1 != q2) {
59
                     q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
60
                     q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
61
+                    if (q1 < 1)
62
+                        return AVERROR_INVALIDDATA;
63
                     for (k = 1; k < 8; k++)
64
                         ac_val2k + 8 = (ac_val2k + 8 * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
65
                 }
66
@@ -3169,6 +3179,8 @@
67
                 q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
68
                 q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
69
 
70
+                if (q1 < 1)
71
+                    return AVERROR_INVALIDDATA;
72
                 if (dc_pred_dir) { // left
73
                     for (k = 1; k < 8; k++)
74
                         blockk << v->left_blk_sh += (ac_valk * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
75
@@ -3211,6 +3223,8 @@
76
                 if (q2 && q1 != q2) {
77
                     q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
78
                     q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
79
+                    if (q1 < 1)
80
+                        return AVERROR_INVALIDDATA;
81
                     for (k = 1; k < 8; k++)
82
                         ac_val2k = (ac_val2k * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
83
                 }
84
@@ -3221,6 +3235,8 @@
85
                 if (q2 && q1 != q2) {
86
                     q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;
87
                     q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;
88
+                    if (q1 < 1)
89
+                        return AVERROR_INVALIDDATA;
90
                     for (k = 1; k < 8; k++)
91
                         ac_val2k + 8 = (ac_val2k + 8 * q2 * ff_vc1_dqscaleq1 - 1 + 0x20000) >> 18;
92
                 }
93
ffmpeg-0.10.2.tar.bz2/libavcodec/vqavideo.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/vqavideo.c Changed
446
 
1
@@ -70,10 +70,10 @@
2
 #include "libavutil/intreadwrite.h"
3
 #include "libavutil/imgutils.h"
4
 #include "avcodec.h"
5
+#include "bytestream.h"
6
 
7
 #define PALETTE_COUNT 256
8
 #define VQA_HEADER_SIZE 0x2A
9
-#define CHUNK_PREAMBLE_SIZE 8
10
 
11
 /* allocate the maximum vector space, regardless of the file version:
12
  * (0xFF00 codebook vectors + 0x100 solid pixel vectors) * (4x4 pixels/block) */
13
@@ -94,9 +94,7 @@
14
 
15
     AVCodecContext *avctx;
16
     AVFrame frame;
17
-
18
-    const unsigned char *buf;
19
-    int size;
20
+    GetByteContext gb;
21
 
22
     uint32_t palettePALETTE_COUNT;
23
 
24
@@ -123,7 +121,6 @@
25
 static av_cold int vqa_decode_init(AVCodecContext *avctx)
26
 {
27
     VqaContext *s = avctx->priv_data;
28
-    unsigned char *vqa_header;
29
     int i, j, codebook_index;
30
 
31
     s->avctx = avctx;
32
@@ -136,21 +133,20 @@
33
     }
34
 
35
     /* load up the VQA parameters from the header */
36
-    vqa_header = (unsigned char *)s->avctx->extradata;
37
-    s->vqa_version = vqa_header0;
38
+    s->vqa_version = s->avctx->extradata0;
39
     if (s->vqa_version < 1 || s->vqa_version > 3) {
40
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: unsupported version %d\n", s->vqa_version);
41
         return -1;
42
     }
43
-    s->width = AV_RL16(&vqa_header6);
44
-    s->height = AV_RL16(&vqa_header8);
45
+    s->width = AV_RL16(&s->avctx->extradata6);
46
+    s->height = AV_RL16(&s->avctx->extradata8);
47
     if(av_image_check_size(s->width, s->height, 0, avctx)){
48
         s->width= s->height= 0;
49
         return -1;
50
     }
51
-    s->vector_width = vqa_header10;
52
-    s->vector_height = vqa_header11;
53
-    s->partial_count = s->partial_countdown = vqa_header13;
54
+    s->vector_width = s->avctx->extradata10;
55
+    s->vector_height = s->avctx->extradata11;
56
+    s->partial_count = s->partial_countdown = s->avctx->extradata13;
57
 
58
     /* the vector dimensions have to meet very stringent requirements */
59
     if ((s->vector_width != 4) ||
60
@@ -159,6 +155,11 @@
61
         return -1;
62
     }
63
 
64
+    if (s->width % s->vector_width || s->height % s->vector_height) {
65
+        av_log(avctx, AV_LOG_ERROR, "Image size not multiple of block size\n");
66
+        return AVERROR_INVALIDDATA;
67
+    }
68
+
69
     /* allocate codebooks */
70
     s->codebook_size = MAX_CODEBOOK_SIZE;
71
     s->codebook = av_malloc(s->codebook_size);
72
@@ -194,90 +195,88 @@
73
         av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: next op would overflow dest_index\n"); \
74
         av_log(NULL, AV_LOG_ERROR, "  VQA video: current dest_index = %d, count = %d, dest_size = %d\n", \
75
             dest_index, count, dest_size); \
76
-        return; \
77
+        return AVERROR_INVALIDDATA; \
78
     }
79
 
80
-static void decode_format80(const unsigned char *src, int src_size,
81
+#define CHECK_COPY(idx) \
82
+    if (idx < 0 || idx + count > dest_size) { \
83
+        av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: next op would overflow dest_index\n"); \
84
+        av_log(NULL, AV_LOG_ERROR, "  VQA video: current src_pos = %d, count = %d, dest_size = %d\n", \
85
+            src_pos, count, dest_size); \
86
+        return AVERROR_INVALIDDATA; \
87
+    }
88
+
89
+
90
+static int decode_format80(GetByteContext *gb, int src_size,
91
     unsigned char *dest, int dest_size, int check_size) {
92
 
93
-    int src_index = 0;
94
     int dest_index = 0;
95
-    int count;
96
+    int count, opcode, start;
97
     int src_pos;
98
     unsigned char color;
99
     int i;
100
 
101
-    while (src_index < src_size) {
102
-
103
-        av_dlog(NULL, "      opcode %02X: ", srcsrc_index);
104
+    start = bytestream2_tell(gb);
105
+    while (bytestream2_tell(gb) - start < src_size) {
106
+        opcode = bytestream2_get_byte(gb);
107
+        av_dlog(NULL, "      opcode %02X: ", opcode);
108
 
109
         /* 0x80 means that frame is finished */
110
-        if (srcsrc_index == 0x80)
111
-            return;
112
+        if (opcode == 0x80)
113
+            return 0;
114
 
115
         if (dest_index >= dest_size) {
116
             av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: dest_index (%d) exceeded dest_size (%d)\n",
117
                 dest_index, dest_size);
118
-            return;
119
+            return AVERROR_INVALIDDATA;
120
         }
121
 
122
-        if (srcsrc_index == 0xFF) {
123
+        if (opcode == 0xFF) {
124
 
125
-            src_index++;
126
-            count = AV_RL16(&srcsrc_index);
127
-            src_index += 2;
128
-            src_pos = AV_RL16(&srcsrc_index);
129
-            src_index += 2;
130
+            count   = bytestream2_get_le16(gb);
131
+            src_pos = bytestream2_get_le16(gb);
132
             av_dlog(NULL, "(1) copy %X bytes from absolute pos %X\n", count, src_pos);
133
             CHECK_COUNT();
134
-            if (src_pos + count > dest_size)
135
-                return;
136
+            CHECK_COPY(src_pos);
137
             for (i = 0; i < count; i++)
138
                 destdest_index + i = destsrc_pos + i;
139
             dest_index += count;
140
 
141
-        } else if (srcsrc_index == 0xFE) {
142
+        } else if (opcode == 0xFE) {
143
 
144
-            src_index++;
145
-            count = AV_RL16(&srcsrc_index);
146
-            src_index += 2;
147
-            color = srcsrc_index++;
148
+            count = bytestream2_get_le16(gb);
149
+            color = bytestream2_get_byte(gb);
150
             av_dlog(NULL, "(2) set %X bytes to %02X\n", count, color);
151
             CHECK_COUNT();
152
             memset(&destdest_index, color, count);
153
             dest_index += count;
154
 
155
-        } else if ((srcsrc_index & 0xC0) == 0xC0) {
156
+        } else if ((opcode & 0xC0) == 0xC0) {
157
 
158
-            count = (srcsrc_index++ & 0x3F) + 3;
159
-            src_pos = AV_RL16(&srcsrc_index);
160
-            src_index += 2;
161
+            count = (opcode & 0x3F) + 3;
162
+            src_pos = bytestream2_get_le16(gb);
163
             av_dlog(NULL, "(3) copy %X bytes from absolute pos %X\n", count, src_pos);
164
             CHECK_COUNT();
165
-            if (src_pos + count > dest_size)
166
-                return;
167
+            CHECK_COPY(src_pos);
168
             for (i = 0; i < count; i++)
169
                 destdest_index + i = destsrc_pos + i;
170
             dest_index += count;
171
 
172
-        } else if (srcsrc_index > 0x80) {
173
+        } else if (opcode > 0x80) {
174
 
175
-            count = srcsrc_index++ & 0x3F;
176
+            count = opcode & 0x3F;
177
             av_dlog(NULL, "(4) copy %X bytes from source to dest\n", count);
178
             CHECK_COUNT();
179
-            memcpy(&destdest_index, &srcsrc_index, count);
180
-            src_index += count;
181
+            bytestream2_get_buffer(gb, &destdest_index, count);
182
             dest_index += count;
183
 
184
         } else {
185
 
186
-            count = ((srcsrc_index & 0x70) >> 4) + 3;
187
-            src_pos = AV_RB16(&srcsrc_index) & 0x0FFF;
188
-            src_index += 2;
189
+            count = ((opcode & 0x70) >> 4) + 3;
190
+            src_pos = bytestream2_get_byte(gb) | ((opcode & 0x0F) << 8);
191
             av_dlog(NULL, "(5) copy %X bytes from relpos %X\n", count, src_pos);
192
             CHECK_COUNT();
193
-            if (dest_index < src_pos)
194
-                return;
195
+            CHECK_COPY(dest_index - src_pos);
196
             for (i = 0; i < count; i++)
197
                 destdest_index + i = destdest_index - src_pos + i;
198
             dest_index += count;
199
@@ -292,9 +291,11 @@
200
         if (dest_index < dest_size)
201
             av_log(NULL, AV_LOG_ERROR, "  VQA video: decode_format80 problem: decode finished with dest_index (%d) < dest_size (%d)\n",
202
                 dest_index, dest_size);
203
+
204
+    return 0; // let's display what we decoded anyway
205
 }
206
 
207
-static void vqa_decode_chunk(VqaContext *s)
208
+static int vqa_decode_chunk(VqaContext *s)
209
 {
210
     unsigned int chunk_type;
211
     unsigned int chunk_size;
212
@@ -303,6 +304,7 @@
213
     int i;
214
     unsigned char r, g, b;
215
     int index_shift;
216
+    int res;
217
 
218
     int cbf0_chunk = -1;
219
     int cbfz_chunk = -1;
220
@@ -322,17 +324,11 @@
221
     int hibytes = s->decode_buffer_size / 2;
222
 
223
     /* first, traverse through the frame and find the subchunks */
224
-    while (index + CHUNK_PREAMBLE_SIZE <= s->size) {
225
-        unsigned next_index;
226
+    while (bytestream2_get_bytes_left(&s->gb) >= 8) {
227
 
228
-        chunk_type = AV_RB32(&s->bufindex);
229
-        chunk_size = AV_RB32(&s->bufindex + 4);
230
-        byte_skip = chunk_size & 0x01;
231
-        next_index = index + CHUNK_PREAMBLE_SIZE + chunk_size + byte_skip;
232
-        if (next_index > s->size) {
233
-            av_log(s->avctx, AV_LOG_ERROR, "Dropping incomplete chunk\n");
234
-            break;
235
-        }
236
+        chunk_type = bytestream2_get_be32u(&s->gb);
237
+        index      = bytestream2_tell(&s->gb);
238
+        chunk_size = bytestream2_get_be32u(&s->gb);
239
 
240
         switch (chunk_type) {
241
 
242
@@ -373,7 +369,9 @@
243
             chunk_type);
244
             break;
245
         }
246
-        index = next_index;
247
+
248
+        byte_skip = chunk_size & 0x01;
249
+        bytestream2_skip(&s->gb, chunk_size + byte_skip);
250
     }
251
 
252
     /* next, deal with the palette */
253
@@ -381,7 +379,7 @@
254
 
255
         /* a chunk should not have both chunk types */
256
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found both CPL0 and CPLZ chunks\n");
257
-        return;
258
+        return AVERROR_INVALIDDATA;
259
     }
260
 
261
     /* decompress the palette chunk */
262
@@ -394,19 +392,19 @@
263
     /* convert the RGB palette into the machine's endian format */
264
     if (cpl0_chunk != -1) {
265
 
266
-        chunk_size = AV_RB32(&s->bufcpl0_chunk + 4);
267
+        bytestream2_seek(&s->gb, cpl0_chunk, SEEK_SET);
268
+        chunk_size = bytestream2_get_be32(&s->gb);
269
         /* sanity check the palette size */
270
-        if (chunk_size / 3 > 256) {
271
+        if (chunk_size / 3 > 256 || chunk_size > bytestream2_get_bytes_left(&s->gb)) {
272
             av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found a palette chunk with %d colors\n",
273
                 chunk_size / 3);
274
-            return;
275
+            return AVERROR_INVALIDDATA;
276
         }
277
-        cpl0_chunk += CHUNK_PREAMBLE_SIZE;
278
         for (i = 0; i < chunk_size / 3; i++) {
279
             /* scale by 4 to transform 6-bit palette -> 8-bit */
280
-            r = s->bufcpl0_chunk++ * 4;
281
-            g = s->bufcpl0_chunk++ * 4;
282
-            b = s->bufcpl0_chunk++ * 4;
283
+            r = bytestream2_get_byteu(&s->gb) * 4;
284
+            g = bytestream2_get_byteu(&s->gb) * 4;
285
+            b = bytestream2_get_byteu(&s->gb) * 4;
286
             s->palettei = 0xFF << 24 | r << 16 | g << 8 | b;
287
             s->palettei |= s->palettei >> 6 & 0x30303;
288
         }
289
@@ -417,31 +415,32 @@
290
 
291
         /* a chunk should not have both chunk types */
292
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found both CBF0 and CBFZ chunks\n");
293
-        return;
294
+        return AVERROR_INVALIDDATA;
295
     }
296
 
297
     /* decompress the full codebook chunk */
298
     if (cbfz_chunk != -1) {
299
 
300
-        chunk_size = AV_RB32(&s->bufcbfz_chunk + 4);
301
-        cbfz_chunk += CHUNK_PREAMBLE_SIZE;
302
-        decode_format80(&s->bufcbfz_chunk, chunk_size,
303
-            s->codebook, s->codebook_size, 0);
304
+        bytestream2_seek(&s->gb, cbfz_chunk, SEEK_SET);
305
+        chunk_size = bytestream2_get_be32(&s->gb);
306
+        if ((res = decode_format80(&s->gb, chunk_size, s->codebook,
307
+                                   s->codebook_size, 0)) < 0)
308
+            return res;
309
     }
310
 
311
     /* copy a full codebook */
312
     if (cbf0_chunk != -1) {
313
 
314
-        chunk_size = AV_RB32(&s->bufcbf0_chunk + 4);
315
+        bytestream2_seek(&s->gb, cbf0_chunk, SEEK_SET);
316
+        chunk_size = bytestream2_get_be32(&s->gb);
317
         /* sanity check the full codebook size */
318
         if (chunk_size > MAX_CODEBOOK_SIZE) {
319
             av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: CBF0 chunk too large (0x%X bytes)\n",
320
                 chunk_size);
321
-            return;
322
+            return AVERROR_INVALIDDATA;
323
         }
324
-        cbf0_chunk += CHUNK_PREAMBLE_SIZE;
325
 
326
-        memcpy(s->codebook, &s->bufcbf0_chunk, chunk_size);
327
+        bytestream2_get_buffer(&s->gb, s->codebook, chunk_size);
328
     }
329
 
330
     /* decode the frame */
331
@@ -449,13 +448,14 @@
332
 
333
         /* something is wrong if there is no VPTZ chunk */
334
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: no VPTZ chunk found\n");
335
-        return;
336
+        return AVERROR_INVALIDDATA;
337
     }
338
 
339
-    chunk_size = AV_RB32(&s->bufvptz_chunk + 4);
340
-    vptz_chunk += CHUNK_PREAMBLE_SIZE;
341
-    decode_format80(&s->bufvptz_chunk, chunk_size,
342
-        s->decode_buffer, s->decode_buffer_size, 1);
343
+    bytestream2_seek(&s->gb, vptz_chunk, SEEK_SET);
344
+    chunk_size = bytestream2_get_be32(&s->gb);
345
+    if ((res = decode_format80(&s->gb, chunk_size,
346
+                               s->decode_buffer, s->decode_buffer_size, 1)) < 0)
347
+        return res;
348
 
349
     /* render the final PAL8 frame */
350
     if (s->vector_height == 4)
351
@@ -519,17 +519,17 @@
352
     if ((cbp0_chunk != -1) && (cbpz_chunk != -1)) {
353
         /* a chunk should not have both chunk types */
354
         av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found both CBP0 and CBPZ chunks\n");
355
-        return;
356
+        return AVERROR_INVALIDDATA;
357
     }
358
 
359
     if (cbp0_chunk != -1) {
360
 
361
-        chunk_size = AV_RB32(&s->bufcbp0_chunk + 4);
362
-        cbp0_chunk += CHUNK_PREAMBLE_SIZE;
363
+        bytestream2_seek(&s->gb, cbp0_chunk, SEEK_SET);
364
+        chunk_size = bytestream2_get_be32(&s->gb);
365
 
366
         /* accumulate partial codebook */
367
-        memcpy(&s->next_codebook_buffers->next_codebook_buffer_index,
368
-            &s->bufcbp0_chunk, chunk_size);
369
+        bytestream2_get_buffer(&s->gb, &s->next_codebook_buffers->next_codebook_buffer_index,
370
+                               chunk_size);
371
         s->next_codebook_buffer_index += chunk_size;
372
 
373
         s->partial_countdown--;
374
@@ -547,39 +547,39 @@
375
 
376
     if (cbpz_chunk != -1) {
377
 
378
-        chunk_size = AV_RB32(&s->bufcbpz_chunk + 4);
379
-        cbpz_chunk += CHUNK_PREAMBLE_SIZE;
380
+        bytestream2_seek(&s->gb, cbpz_chunk, SEEK_SET);
381
+        chunk_size = bytestream2_get_be32(&s->gb);
382
 
383
         /* accumulate partial codebook */
384
-        memcpy(&s->next_codebook_buffers->next_codebook_buffer_index,
385
-            &s->bufcbpz_chunk, chunk_size);
386
+        bytestream2_get_buffer(&s->gb, &s->next_codebook_buffers->next_codebook_buffer_index,
387
+                               chunk_size);
388
         s->next_codebook_buffer_index += chunk_size;
389
 
390
         s->partial_countdown--;
391
         if (s->partial_countdown == 0) {
392
+            GetByteContext gb;
393
 
394
+            bytestream2_init(&gb, s->next_codebook_buffer, s->next_codebook_buffer_index);
395
             /* decompress codebook */
396
-            decode_format80(s->next_codebook_buffer,
397
-                s->next_codebook_buffer_index,
398
-                s->codebook, s->codebook_size, 0);
399
+            if ((res = decode_format80(&gb, s->next_codebook_buffer_index,
400
+                                       s->codebook, s->codebook_size, 0)) < 0)
401
+                return res;
402
 
403
             /* reset accounting */
404
             s->next_codebook_buffer_index = 0;
405
             s->partial_countdown = s->partial_count;
406
         }
407
     }
408
+
409
+    return 0;
410
 }
411
 
412
 static int vqa_decode_frame(AVCodecContext *avctx,
413
                             void *data, int *data_size,
414
                             AVPacket *avpkt)
415
 {
416
-    const uint8_t *buf = avpkt->data;
417
-    int buf_size = avpkt->size;
418
     VqaContext *s = avctx->priv_data;
419
-
420
-    s->buf = buf;
421
-    s->size = buf_size;
422
+    int res;
423
 
424
     if (s->frame.data0)
425
         avctx->release_buffer(avctx, &s->frame);
426
@@ -589,7 +589,9 @@
427
         return -1;
428
     }
429
 
430
-    vqa_decode_chunk(s);
431
+    bytestream2_init(&s->gb, avpkt->data, avpkt->size);
432
+    if ((res = vqa_decode_chunk(s)) < 0)
433
+        return res;
434
 
435
     /* make the palette available on the way out */
436
     memcpy(s->frame.data1, s->palette, PALETTE_COUNT * 4);
437
@@ -599,7 +601,7 @@
438
     *(AVFrame*)data = s->frame;
439
 
440
     /* report that the buffer was completely consumed */
441
-    return buf_size;
442
+    return avpkt->size;
443
 }
444
 
445
 static av_cold int vqa_decode_end(AVCodecContext *avctx)
446
ffmpeg-0.10.2.tar.bz2/libavcodec/wmavoice.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/wmavoice.c Changed
20
 
1
@@ -1440,8 +1440,7 @@
2
     int pitchMAX_BLOCKS, last_block_pitch;
3
 
4
     /* Parse frame type ("frame header"), see frame_descs */
5
-    int bd_idx = s->vbm_treeget_vlc2(gb, frame_type_vlc.table, 6, 3),
6
-        block_nsamples = MAX_FRAMESIZE / frame_descsbd_idx.n_blocks;
7
+    int bd_idx = s->vbm_treeget_vlc2(gb, frame_type_vlc.table, 6, 3), block_nsamples;
8
 
9
     if (bd_idx < 0) {
10
         av_log(ctx, AV_LOG_ERROR,
11
@@ -1449,6 +1448,8 @@
12
         return -1;
13
     }
14
 
15
+    block_nsamples = MAX_FRAMESIZE / frame_descsbd_idx.n_blocks;
16
+
17
     /* Pitch calculation for ACB_TYPE_ASYMMETRIC ("pitch-per-frame") */
18
     if (frame_descsbd_idx.acb_type == ACB_TYPE_ASYMMETRIC) {
19
         /* Pitch is provided per frame, which is interpreted as the pitch of
20
ffmpeg-0.10.2.tar.bz2/libavcodec/x86/cabac.h -> ffmpeg-0.10.3.tar.bz2/libavcodec/x86/cabac.h Changed
42
 
1
@@ -107,8 +107,8 @@
2
 {
3
     x86_reg tmp;
4
     __asm__ volatile(
5
-        "movl %4, %k1                           \n\t"
6
-        "movl %2, %%eax                         \n\t"
7
+        "movl %a5(%2), %k1                      \n\t"
8
+        "movl %a3(%2), %%eax                    \n\t"
9
         "shl $17, %k1                           \n\t"
10
         "add %%eax, %%eax                       \n\t"
11
         "sub %k1, %%eax                         \n\t"
12
@@ -119,20 +119,23 @@
13
         "sub %%edx, %%ecx                       \n\t"
14
         "test %%ax, %%ax                        \n\t"
15
         " jnz 1f                                \n\t"
16
-        "mov  %3, %1                            \n\t"
17
+        "mov  %a4(%2), %1                       \n\t"
18
         "subl $0xFFFF, %%eax                    \n\t"
19
         "movzwl (%1), %%edx                     \n\t"
20
         "bswap %%edx                            \n\t"
21
         "shrl $15, %%edx                        \n\t"
22
         "add  $2, %1                            \n\t"
23
         "addl %%edx, %%eax                      \n\t"
24
-        "mov  %1, %3                            \n\t"
25
+        "mov  %1, %a4(%2)                       \n\t"
26
         "1:                                     \n\t"
27
-        "movl %%eax, %2                         \n\t"
28
+        "movl %%eax, %a3(%2)                    \n\t"
29
 
30
-        :"+c"(val), "=&r"(tmp), "+m"(c->low), "+m"(c->bytestream)
31
-        :"m"(c->range)
32
-        : "%eax", "%edx"
33
+        : "+c"(val), "=&r"(tmp)
34
+        : "r"(c),
35
+          "i"(offsetof(CABACContext, low)),
36
+          "i"(offsetof(CABACContext, bytestream)),
37
+          "i"(offsetof(CABACContext, range))
38
+        : "%eax", "%edx", "memory"
39
     );
40
     return val;
41
 }
42
ffmpeg-0.10.2.tar.bz2/libavcodec/x86/dsputil_yasm.asm -> ffmpeg-0.10.3.tar.bz2/libavcodec/x86/dsputil_yasm.asm Changed
10
 
1
@@ -475,7 +475,7 @@
2
     shufps  xmm0, xmm0, 1
3
     addss   xmm0, xmm1
4
 %ifndef ARCH_X86_64
5
-    movd    r0m,  xmm0
6
+    movss   r0m,  xmm0
7
     fld     dword r0m
8
 %endif
9
     RET
10
ffmpeg-0.10.2.tar.bz2/libavcodec/x86/dsputilenc_mmx.c -> ffmpeg-0.10.3.tar.bz2/libavcodec/x86/dsputilenc_mmx.c Changed
9
 
1
@@ -823,6 +823,7 @@
2
 
3
 static void diff_bytes_mmx(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w){
4
     x86_reg i=0;
5
+    if(w>=16)
6
     __asm__ volatile(
7
         "1:                             \n\t"
8
         "movq  (%2, %0), %%mm0          \n\t"
9
ffmpeg-0.10.2.tar.bz2/libavfilter/vf_fade.c -> ffmpeg-0.10.3.tar.bz2/libavfilter/vf_fade.c Changed
13
 
1
@@ -191,9 +191,9 @@
2
     fade->alpha = fade->alpha ? ff_fmt_is_in(inlink->format, alpha_pix_fmts) : 0;
3
     fade->is_packed_rgb = ff_fill_rgba_map(fade->rgba_map, inlink->format) >= 0;
4
 
5
-    /* CCIR601/709 black level unless input is RGB or has alpha */
6
+    /* use CCIR601/709 black level for studio-level pixel non-alpha components */
7
     fade->black_level =
8
-            ff_fmt_is_in(inlink->format, studio_level_pix_fmts) || fade->alpha ? 0 : 16;
9
+            ff_fmt_is_in(inlink->format, studio_level_pix_fmts) && !fade->alpha ? 16 : 0;
10
     /* 32768 = 1 << 15, it is an integer representation
11
      * of 0.5 and is for rounding. */
12
     fade->black_level_scaled = (fade->black_level << 16) + 32768;
13
ffmpeg-0.10.2.tar.bz2/libavformat/4xm.c -> ffmpeg-0.10.3.tar.bz2/libavformat/4xm.c Changed
12
 
1
@@ -129,6 +129,10 @@
2
     for (i = 0; i < header_size - 8; i++) {
3
         fourcc_tag = AV_RL32(&headeri);
4
         size = AV_RL32(&headeri + 4);
5
+        if (size > header_size - i - 8 && (fourcc_tag == vtrk_TAG || fourcc_tag == strk_TAG)) {
6
+            av_log(s, AV_LOG_ERROR, "chunk larger than array %d>%d\n", size, header_size - i - 8);
7
+            return AVERROR_INVALIDDATA;
8
+        }
9
 
10
         if (fourcc_tag == std__TAG) {
11
             fourxm->fps = av_int2float(AV_RL32(&headeri + 12));
12
ffmpeg-0.10.2.tar.bz2/libavformat/asfdec.c -> ffmpeg-0.10.3.tar.bz2/libavformat/asfdec.c Changed
10
 
1
@@ -1100,6 +1100,8 @@
2
             //printf("packet %d %d\n", asf_st->pkt.size, asf->packet_frag_size);
3
             asf_st->pkt.size = 0;
4
             asf_st->pkt.data = 0;
5
+            asf_st->pkt.side_data_elems = 0;
6
+            asf_st->pkt.side_data = NULL;
7
             break; // packet completed
8
         }
9
     }
10
ffmpeg-0.10.2.tar.bz2/libavformat/avidec.c -> ffmpeg-0.10.3.tar.bz2/libavformat/avidec.c Changed
13
 
1
@@ -954,6 +954,11 @@
2
             st = s->streamsn;
3
             ast = st->priv_data;
4
 
5
+            if (!ast) {
6
+                av_log(s, AV_LOG_WARNING, "Skiping foreign stream %d packet\n", n);
7
+                continue;
8
+            }
9
+
10
             if(s->nb_streams>=2){
11
                 AVStream *st1  = s->streams1;
12
                 AVIStream *ast1= st1->priv_data;
13
ffmpeg-0.10.2.tar.bz2/libavformat/id3v2.c -> ffmpeg-0.10.3.tar.bz2/libavformat/id3v2.c Changed
32
 
1
@@ -464,21 +464,21 @@
2
 
3
     unsync = flags & 0x80;
4
 
5
-    /* Extended header present, just skip over it */
6
-    if (isv34 && flags & 0x40) {
7
-        int size = get_size(s->pb, 4);
8
-        if (size < 6) {
9
-            reason = "extended header too short.";
10
+    if (isv34 && flags & 0x40) { /* Extended header present, just skip over it */
11
+        int extlen = get_size(s->pb, 4);
12
+        if (version == 4)
13
+            extlen -= 4;     // in v2.4 the length includes the length field we just read
14
+
15
+        if (extlen < 0) {
16
+            reason = "invalid extended header length";
17
             goto error;
18
         }
19
-        len -= size;
20
+        avio_skip(s->pb, extlen);
21
+        len -= extlen + 4;
22
         if (len < 0) {
23
             reason = "extended header too long.";
24
             goto error;
25
         }
26
-        /* already seeked past size, skip the reset */
27
-        size -= 4;
28
-        avio_skip(s->pb, size);
29
     }
30
 
31
     while (len >= taghdrlen) {
32
ffmpeg-0.10.2.tar.bz2/libavformat/mm.c -> ffmpeg-0.10.3.tar.bz2/libavformat/mm.c Changed
9
 
1
@@ -175,7 +175,6 @@
2
         case MM_TYPE_AUDIO :
3
             if (av_get_packet(s->pb, pkt, length)<0)
4
                 return AVERROR(ENOMEM);
5
-            pkt->size = length;
6
             pkt->stream_index = 1;
7
             pkt->pts = mm->audio_pts++;
8
             return 0;
9
ffmpeg-0.10.2.tar.bz2/libavformat/mov.c -> ffmpeg-0.10.3.tar.bz2/libavformat/mov.c Changed
63
 
1
@@ -160,7 +160,7 @@
2
         uint8_t t, c = avio_r8(pb);
3
         if (c < 0x80 && p < end)
4
             *p++ = c;
5
-        else
6
+        else if (p < end)
7
             PUT_UTF8(mac_to_unicodec-0x80, t, if (p < end) *p++ = t;);
8
     }
9
     *p = 0;
10
@@ -1767,6 +1767,7 @@
11
     unsigned int stps_index = 0;
12
     unsigned int i, j;
13
     uint64_t stream_size = 0;
14
+    AVIndexEntry *mem;
15
 
16
     /* adjust first dts according to edit list */
17
     if ((sc->empty_duration || sc->start_time) && mov->time_scale > 0) {
18
@@ -1796,12 +1797,13 @@
19
 
20
         if (!sc->sample_count)
21
             return;
22
-        if (sc->sample_count >= UINT_MAX / sizeof(*st->index_entries))
23
+        if (sc->sample_count >= UINT_MAX / sizeof(*st->index_entries) - st->nb_index_entries)
24
             return;
25
-        st->index_entries = av_malloc(sc->sample_count*sizeof(*st->index_entries));
26
-        if (!st->index_entries)
27
+        mem = av_realloc(st->index_entries, (st->nb_index_entries + sc->sample_count) * sizeof(*st->index_entries));
28
+        if (!mem)
29
             return;
30
-        st->index_entries_allocated_size = sc->sample_count*sizeof(*st->index_entries);
31
+        st->index_entries = mem;
32
+        st->index_entries_allocated_size = (st->nb_index_entries + sc->sample_count) * sizeof(*st->index_entries);
33
 
34
         for (i = 0; i < sc->chunk_count; i++) {
35
             current_offset = sc->chunk_offsetsi;
36
@@ -1885,12 +1887,13 @@
37
         }
38
 
39
         av_dlog(mov->fc, "chunk count %d\n", total);
40
-        if (total >= UINT_MAX / sizeof(*st->index_entries))
41
+        if (total >= UINT_MAX / sizeof(*st->index_entries) - st->nb_index_entries)
42
             return;
43
-        st->index_entries = av_malloc(total*sizeof(*st->index_entries));
44
-        if (!st->index_entries)
45
+        mem = av_realloc(st->index_entries, (st->nb_index_entries + total) * sizeof(*st->index_entries));
46
+        if (!mem)
47
             return;
48
-        st->index_entries_allocated_size = total*sizeof(*st->index_entries);
49
+        st->index_entries = mem;
50
+        st->index_entries_allocated_size = (st->nb_index_entries + total) * sizeof(*st->index_entries);
51
 
52
         // populate index
53
         for (i = 0; i < sc->chunk_count; i++) {
54
@@ -2831,7 +2834,7 @@
55
 
56
     pkt->stream_index = sc->ffindex;
57
     pkt->dts = sample->timestamp;
58
-    if (sc->ctts_data) {
59
+    if (sc->ctts_data && sc->ctts_index < sc->ctts_count) {
60
         pkt->pts = pkt->dts + sc->dts_shift + sc->ctts_datasc->ctts_index.duration;
61
         /* update ctts context */
62
         sc->ctts_sample++;
63
ffmpeg-0.10.2.tar.bz2/libavformat/mxfdec.c -> ffmpeg-0.10.3.tar.bz2/libavformat/mxfdec.c Changed
11
 
1
@@ -1725,6 +1725,9 @@
2
             /* next partition pack - keep going, seek to previous partition or stop */
3
             if(mxf_parse_handle_partition_or_eof(mxf) <= 0)
4
                 break;
5
+            else if (mxf->parsing_backward)
6
+                continue;
7
+            /* we're still parsing forward. proceed to parsing this partition pack */
8
         }
9
 
10
         for (metadata = mxf_metadata_read_table; metadata->read; metadata++) {
11
ffmpeg-0.10.2.tar.bz2/libavformat/xmv.c -> ffmpeg-0.10.3.tar.bz2/libavformat/xmv.c Changed
10
 
1
@@ -300,7 +300,7 @@
2
     xmv->current_stream = 0;
3
     if (!xmv->video.frame_count) {
4
         xmv->video.frame_count = 1;
5
-        xmv->current_stream    = 1;
6
+        xmv->current_stream    = xmv->stream_count > 1;
7
     }
8
 
9
     /* Packet audio header */
10
ffmpeg-0.10.2.tar.bz2/libavformat/xwma.c -> ffmpeg-0.10.3.tar.bz2/libavformat/xwma.c Changed
19
 
1
@@ -115,6 +115,17 @@
2
         }
3
     }
4
 
5
+    if (!st->codec->channels) {
6
+        av_log(s, AV_LOG_WARNING, "Invalid channel count: %d\n",
7
+               st->codec->channels);
8
+        return AVERROR_INVALIDDATA;
9
+    }
10
+    if (!st->codec->bits_per_coded_sample) {
11
+        av_log(s, AV_LOG_WARNING, "Invalid bits_per_coded_sample: %d\n",
12
+               st->codec->bits_per_coded_sample);
13
+        return AVERROR_INVALIDDATA;
14
+    }
15
+
16
     /* set the sample rate */
17
     avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate);
18
 
19
ffmpeg-0.10.2.tar.bz2/tests/ref/fate/vqa-cc -> ffmpeg-0.10.3.tar.bz2/tests/ref/fate/vqa-cc Changed
9
 
1
@@ -68,7 +68,6 @@
2
 1, 218996, 2940, 0xac8bb6c8
3
 0, 222000, 192000, 0xb58c1566
4
 1, 224996, 2940, 0xa503c73b
5
-0, 228000, 192000, 0xb58c1566
6
 1, 230996, 2940, 0x7cd588a3
7
 1, 236996, 2940, 0xa6974b04
8
 1, 242996, 2940, 0xbf448241
9
Refresh

No build results available

Refresh

No rpmlint results available

Request History
Cristian Morales Vega's avatar

RedDwarf created request over 11 years ago

- Update to 0.10.3


Manfred Tremmel's avatar

mantre accepted request almost 13 years ago

Ok, thanks