FFmpeg

Commit Graph

Author	SHA1	Message	Date
Reimar Döffinger	0f199f0ad0	mss2: Fix buffer overflow. Reported as https://trac.mplayerhq.hu/ticket/2264 but have not been able to reproduce with FFmpeg-only. I have no idea what coded_height is used for here exactly, so this might not be the best fix. Fixes the following chain of events: ff_mss12_decode_init sets coded_height while not setting height. ff_mpv_decode_init then copies coded_height into MpegEncContext height. This is then used by init_context_frame to allocate the data structures. However the wmv9rects are validated/initialized based on avctx->height, not avctx->coded_height. Thus the decode_wmv9 function will try to decode a larger video that we allocated data structures for, causing out-of-bounds writes. Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>	9 years ago
Michael Niedermayer	f8ff76199c	avcodec/mss12: Use av_malloc_array() Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	10 years ago
Diego Biurrun	cc8163e1a3	avcodec: more correct printf specifiers	11 years ago
Michael Niedermayer	ee9151b616	ff_mss12_decode_init: check dimensions Fixes assertion failure Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	12 years ago
Michael Niedermayer	b12d92efd6	avoid "0xFF << 24" as it is considered a integer overflow in C99 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	12 years ago
Alberto Delmás	344fbc47c7	mss12: merge decode_pixel() and decode_top_left_pixel() No meaningful generated code differences using gcc -O3. Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>	12 years ago
Alberto Delmás	626c1a33ed	mss12: reduce SliceContext size from 1067 to 164 KB Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>	12 years ago
Alberto Delmás	a97ee41bee	mss12: move SliceContexts out of the common context into the codec contexts Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>	12 years ago
Alberto Delmás	ede3d6400d	MSS1 and MSS2: set final pixel format after common stuff has been initialised This way it won't interfere with WMV9 initialisation inside MSS2 decoder and avplay will play it fine. Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>	12 years ago
Alberto Delmás	ee769c6a7c	MSS2 decoder Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>	12 years ago
Kostya Shishkov	0de4a563e4	mss1: move code that will be reused by MSS2 decoder into separate file	12 years ago
Kostya Shishkov	49df339f4b	mss1: merge decode_intra() and decode_inter() They have most of their code in common.	12 years ago
Anton Khirnov	36ef5369ee	Replace all CODEC_ID_* with AV_CODEC_ID_*	12 years ago
Paul B Mahol	6ad4560031	mss1: improve check if decoded pivot is invalid The pivot has to lie between 0 and base. Check of ==base is insufficient. Thus replace it by a proper check. Fixes out of array write. Fixes bug #1531. Found-by: Piotr Bandurski <ami_stuff@o2.pl> Signed-off-by: Paul B Mahol <onemda@gmail.com>	13 years ago
Kostya Shishkov	ed219ed366	mss1: fix decoding masked regions in interframes Spotted by Alberto Delmás	13 years ago
Kostya Shishkov	15358ade15	mss1: validate number of changeable palette entries	13 years ago
Kostya Shishkov	8f5d573a83	mss1: report palette changed when some additional colours were decoded	13 years ago
Carl Eugen Hoyos	c77bcbbb32	Signal MSS1 palette change. Reviewed-by: Paul B Mahol	13 years ago
Paul B Mahol	e3c2670539	mss1: check number of free colours Prevents out of array write. Signed-off-by: Paul B Mahol <onemda@gmail.com>	13 years ago
Carl Eugen Hoyos	bec21ce7f4	Make MSS1 palette opaque.	13 years ago
Kostya Shishkov	005c80b645	MS Screen 1 decoder	13 years ago

15 Commits (3f1b5ca22ec372bc6d4a45694e3070b8f5d05ad3)