FFmpeg

Commit Graph

Author	SHA1	Message	Date
Alex Converse	b57d262412	mjpegbdec: Fix overflow in SOS. Based in part by a fix from Michael Niedermayer <michaelni@gmx.at> Fixes CVE-2011-3947 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind	13 years ago
Paul B Mahol	324e818093	8bps: K&R formatting cosmetics Signed-off-by: Diego Biurrun <diego@biurrun.de>	13 years ago
Alex Converse	a8ae00b68c	qdm2: Check data block size for bytes to bits overflow. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit `dac56d9ce0`) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	22eef8d738	snowenc: dont crash with gray but exit with an error msg. Fixes Ticket839 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	9decfc17bb	h264_sei: Fix infinite loop. Fixes not yet fixed parts of CVE-2011-3946. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Alex Converse	9adf25c1cf	smacker: Sanity check huffman tables found in the headers. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org	13 years ago
Alex Converse	90c0c83e14	smacker: remove dead store	13 years ago
Alex Converse	dac56d9ce0	qdm2: Check data block size for bytes to bits overflow. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org	13 years ago
Michael Niedermayer	7ed6b1a128	mpeg1videoenc: disable slice threads It doesnt work (and as far as i tested also didnt in the past) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	70dba1e3c8	kvmc: Check palsize. Fixes: CVE-2011-3952 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	92115bb685	dpcm: Round output buffer size up. Fixes: CVE-2011-3951 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	ddf0c1d86a	diracdec: Check num_refs. Fixes: CVE-2011-3950 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	e2291ea153	diracdec: Check dirac_unpack_idwt_params parameters before storing them. Fixes CVE-2011-3949 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Hendrik Leppkes	feaa40020b	vc1: always read the bfraction element for interlaced fields Previously, it would not be read if refdist_flag was not set, however according to the spec and the reference decoder, it should always be read. Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>	13 years ago
Michael Niedermayer	46095f427e	mp3dec: Check for memcpy size to be positive. No, ive no testcase. Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Thierry Foucu	10e9d1f76b	Fix a heap-buffer-overflow In some case, what left to read from ptr is smaller than EXTRABYTES. Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	01e5e97026	mjpegbdec: Fix incorrect bitstream buffer size. Fixes CVE-2011-3947 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Paul B Mahol	dd453f197c	r210, r10k and avrp encoder Signed-off-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	807a045ab7	kgv1dec: Increase offsets array size so it is large enough. Fixes CVE-2011-3945 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	1285baaab5	smackerdec: Check that the last indexes are within the table. Fixes CVE-2011-3944 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Alex Converse	d78bb1a4b2	wma: Clip WMA1 and WMA2 frame length to 11 bits. The MDCT buffers in the decoder are only sized for up to 11 bits. The reverse engineered documentation for WMA1/2 headers say that that for all samplerates above 32kHz 11 bits are used. 12 and 13 bit support were added for WMAPro. I was unable to make any Microsoft tools generate a test file at a samplerate above 48kHz. Discovered by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org	13 years ago
Michael Niedermayer	247d30a7db	vp3: Copy all 3 frames for thread updates. This fixes a double release of the current frame on deinit. Fixes CVE-2011-3934 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Hendrik Leppkes	6071644287	indeo3: fix motion vector validation The index of the motion vector has to be checked before being multiplied by 2 for the array index. Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Janne Grunau	c3e10ae412	rv20: prevent calling ff_h263_decode_mba() with unset height/width Prevents a crash of VLC during playback of a invalid matroska file, found by John Villamil <johnv@matasano.com>. CC: libav-stable@libav.org	13 years ago
Diego Biurrun	07a873a277	build: Automatically include architecture-specific library Makefile snippets.	13 years ago
Janne Grunau	366ac22ea5	indeo5: prevent null pointer dereference on broken files Found by John Villamil <johnv@matasano.com>	13 years ago
Diego Biurrun	33ad8c3cab	cosmetics: Remove some unnecessary block braces.	13 years ago
Ronald S. Bultje	c3af52fa8b	dsputil: use vertical component for drawing bottom edge. Current code only writes 8 pixels of vertical edge for YUV422, which causes MC artifacts when subsequent frames use data from that edge.	13 years ago
Michael Niedermayer	59e95fa4a8	h263dec: Disallow width/height changing with frame threads. Fixes CVE-2011-3937 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Carl Eugen Hoyos	7988dd1b9a	Fix multi-channel encoding with libfaac.	13 years ago
Alex Converse	efe68076da	aacenc: Fix identification padding when the bitstream is already aligned.	13 years ago
Michael Niedermayer	cdfe94c5ab	aacenc: Write correct length for long identification strings. When the length is the escape value (15), the new length is calculated by 15 + get_bits(8) - 1. Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago
Michael Niedermayer	c77be3a35a	error concealment: initialize block index. Fixes CVE-2011-3941 (out of bounds write) Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Justin Ruggles	02e7dbf5ad	adpcm_ima_ws: fix stereo decoding Stereo ADPCM IMA WS is planar for VQA version 3 and 2-sample interleaved for VQA version 2.	13 years ago
Justin Ruggles	220506d23f	avcodec: add a new codec_id for CRYO APC IMA ADPCM. The stereo layout and extradata is significantly different from that in Westwood IMA ADPCM, so a separate codec_id is warranted.	13 years ago
Anton Khirnov	1381e9bc92	lavc: postpone the removal of AVCodecContext.request_channels. Although it has been deprecated for a long time, its intended replacement (request_channel_layout) is not actually used anywhere, so request_channels is currently the only way to access that functionality.	13 years ago
Anton Khirnov	af0292f33a	lavc: postpone removing old audio encoding and decoding API It has been deprecated only recently.	13 years ago
Michael Niedermayer	beb19a0444	h264: Disallow w/h/pixfmt changes for frame threads. Previously this was just checked in case of slice threads, but frame threads do not support this either currently. Making them support this is of course the long term goal Fixes bug155 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	b2be1dabb1	mpegvideo: Draw edges based on the pictures linesize instead of the contexts. Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	b955d4072e	Revert "Fix multi-channel AAC encoding." This reverts commit `b3452771c4`. A better solution was implemented by Nathan Caldwell. Conflicts: libavcodec/aacenc.c	13 years ago
Janne Grunau	1d3a9e63e0	rv10: verify slice offsets against buffer size Found by John Villamil <johnv@matasano.com> in fuzzed rv20 in mkv files.	13 years ago
Nathan Caldwell	9292fe4a1d	aacenc: Simplify windowing Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago
Nathan Caldwell	7946a5acfb	aacenc: Move saved overlap samples to the beginning of the same buffer as incoming samples. Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago
Nathan Caldwell	9b8e2a8709	aacenc: Deinterleave input samples before processing. Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago
Nathan Caldwell	04af2efaae	aacenc: Store channel count in AACEncContext. Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago
Nathan Caldwell	80d44277e6	aacenc: Move Q^3/4 calculation to it's own table This should be moved to tablegen at some point. Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago
Nathan Caldwell	025ccf1f8b	aacenc: Request normalized float samples instead of converting s16 samples to float. Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago
Nathan Caldwell	6381f913d1	aacpsy: Replace an if with FFMAX in LAME windowing. Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago
Nathan Caldwell	207bf44d16	aacenc: cosmetics, replace 'rd' with 'bits' in codebook_trellis_rate to make it more clear what is being calculated. Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago
Nathan Caldwell	843cd4a3ed	aacpsy: cosmetics, change a FIXME to a NOTE about subshort comparisons Also fix a typo. Signed-off-by: Alex Converse <alex.converse@gmail.com>	13 years ago

... 4 5 6 7 8 ...

17575 Commits (8c6ebab747ca8311b81ff4d0a7c17ef60b372f32)