FFmpeg

Commit Graph

Author	SHA1	Message	Date
Michael Niedermayer	44874b4f5e	avcodec/truemotion2: Fix integer overflows in tm2_high_chroma() Fixes: runtime error: signed integer overflow: -1408475220 + -1408475220 cannot be represented in type 'int' Fixes: 3336/clusterfuzz-testcase-minimized-5656839179993088 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	7 years ago
Michael Niedermayer	3c716682a8	avcodec/truemotion2: Move skip computation after checks Fixes: runtime error: signed integer overflow: 630067357 * 4 cannot be represented in type 'int' Fixes: 2233/clusterfuzz-testcase-minimized-5943031318446080 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Michael Niedermayer	c901627918	avcodec/truemotion2: Fix passing null pointer to memset() Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Michael Niedermayer	c9e884f3d9	avcodec/truemotion2: Fix runtime error: left shift of 1 by 31 places cannot be represented in type 'int' Fixes part of: 1888/clusterfuzz-testcase-minimized-5237704826552320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	8 years ago
Luca Barbato	73fc82f343	vlc: Add header #include when the types are used Do not rely on indirectly including it from bitstream.h. Signed-off-by: Diego Biurrun <diego@biurrun.de>	8 years ago
Diego Biurrun	a25dac976a	Use bitstream_init8() where appropriate	8 years ago
Alexandra Hájková	9ab1a3e283	truemotion2: Convert to the new bitstream reader	8 years ago
Michael Niedermayer	782c4ab4ed	avcodec/truemotion2: Cleanup in case of tm2_read_stream() failure Fixes memleaks Fixes: 245dae71bc28fe8f3f454300277e575a/signal_sigabrt_7ffff6ae7cb7_5062_f7d9dfa385454806586076f9db48c0bf.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	9 years ago
Luca Barbato	de41b555cd	truemotion2: Fix the buffer check The variable skip contains the expected size in bytes. Bug-Id: 906 CC: libav-stable@libav.org Signed-off-by: Luca Barbato <lu_zero@gentoo.org>	9 years ago
Vittorio Giovara	059a934806	lavc: Consistently prefix input buffer defines Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>	9 years ago
Vittorio Giovara	def97856de	lavc: AV-prefix all codec capabilities Express bitfields more simply. Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>	9 years ago
Vittorio Giovara	e1ea365f7e	truemotion2: Check memory allocation	10 years ago
Michael Niedermayer	beec818d99	avcodec/truemotion2: Use av_freep() to avoid leaving stale pointers in memory Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	10 years ago
Diego Biurrun	c67b449beb	dsputil: Split bswap*_buf() off into a separate context	11 years ago
Michael Niedermayer	bc3234062d	avcodec/truemotion2: replace impossible condition by av_assert2 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	11 years ago
Diego Biurrun	cc8163e1a3	avcodec: more correct printf specifiers	11 years ago
Anton Khirnov	32f7cf9bc3	truemotion2: use the AVFrame API properly.	11 years ago
Diego Biurrun	b2bed9325d	cosmetics: Group .name and .long_name together in codec/format declarations	11 years ago
Martin Storsjö	c39f7eba01	truemotion2: Use av_freep properly in an error path Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st>	11 years ago
Paul B Mahol	6e07bb3639	avcodec/truemotion2: use av_reallocp_array() and check return value Also reset tok_lens if reallocation fails. Fixes #2946. Signed-off-by: Paul B Mahol <onemda@gmail.com>	11 years ago
Paul B Mahol	cd6241b5df	avcodec/truemotion2: use av_calloc() & av_malloc_array() Signed-off-by: Paul B Mahol <onemda@gmail.com>	11 years ago
Michael Niedermayer	c54aa2fb0f	avcodec/truemotion2: Fix av_freep arguments Fixes null pointer dereference Fixes Ticket2944 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	11 years ago
Paul B Mahol	d49f2603be	truemotion2: check return value of av_malloc(z) Signed-off-by: Paul B Mahol <onemda@gmail.com>	11 years ago
Paul B Mahol	e999f2339a	truemotion2: make code independent of sizeof(AVFrame) Signed-off-by: Paul B Mahol <onemda@gmail.com>	11 years ago
Diego Biurrun	12e25ed284	avcodec: av_log_missing_feature(1) ---> avpriv_request_sample()	12 years ago
Clément Bœsch	1ec94b0f06	lavc: factorize ff_{thread_,re,}get_buffer error messages. Coccinelle profile used: @@ expression r, ctx, f, loglevel, str, flags; @@ -if ((r = ff_get_buffer(ctx, f, flags)) < 0) { - av_log(ctx, loglevel, str); - return r; -} +if ((r = ff_get_buffer(ctx, f, flags)) < 0) + return r; @@ expression r, ctx, f, loglevel, str; @@ -if ((r = ff_reget_buffer(ctx, f)) < 0) { - av_log(ctx, loglevel, str); - return r; -} +if ((r = ff_reget_buffer(ctx, f)) < 0) + return r; @@ expression r, ctx, f, loglevel, str, flags; @@ -if ((r = ff_thread_get_buffer(ctx, f, flags)) < 0) { - av_log(ctx, loglevel, str); - return r; -} +if ((r = ff_thread_get_buffer(ctx, f, flags)) < 0) + return r; ...along with some manual patches for the remaining ones.	12 years ago
Anton Khirnov	3b199d29cd	lavc decoders: properly initialize AVFrame.	12 years ago
Anton Khirnov	759001c534	lavc decoders: work with refcounted frames.	12 years ago
Michael Niedermayer	713dea584b	truemotion2: use av_mallocz() Fixes use of uninitialized values. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	12 years ago
Michael Niedermayer	e49c2aab80	truemotion2: clear the token array if its initialization fails. Fixes use of uninitialized and half initialized values, which can occur on several error pathes Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	12 years ago
Anton Khirnov	60a42ef44c	truemotion2: cosmetics, reformat	12 years ago
Anton Khirnov	df9036830b	truemotion2: return meaningful error codes.	12 years ago
Diego Biurrun	117f79de2d	truemotion2: Sanitize tm2_read_header() Also give a variable a more sensible name.	12 years ago
Anton Khirnov	df9b956751	lavc: fix decode_frame() third parameter semantics for video decoders It's got_frame, not data size	12 years ago
Michael Niedermayer	2fc0cbd9a6	truemotion2: Fix av_log level and context Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	12 years ago
Michael Niedermayer	31fce39942	tm2: check for invalid vlcs, fix out of array read Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	12 years ago
Michael Niedermayer	ba8adf9be5	truemotion2: remove unused variable Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	12 years ago
Paul B Mahol	efb0e4e7af	truemotion2: use more meaningful return codes Signed-off-by: Paul B Mahol <onemda@gmail.com>	12 years ago
Paul B Mahol	caa7e24eb1	truemotion2: remove unreachable code Fixes CID610345. Signed-off-by: Paul B Mahol <onemda@gmail.com>	12 years ago
Anton Khirnov	716d413c13	Replace PIX_FMT_* -> AV_PIX_FMT_*, PixelFormat -> AVPixelFormat	12 years ago
Diego Biurrun	2dc1310484	truemotion2: Request samples for old TM2 headers	12 years ago
Anton Khirnov	36ef5369ee	Replace all CODEC_ID_* with AV_CODEC_ID_*	12 years ago
Martin Storsjö	00c3b67b8a	cosmetics: Align codec declarations Also break some long lines, remove codec function placeholder comments and add spaces in sample/pixel format lists. Signed-off-by: Martin Storsjö <martin@martin.st>	13 years ago
Michael Niedermayer	3768445be8	tm2dec: fix overread Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Ronald S. Bultje	b7b1509d06	truemotion: forbid invalid VLC bitsizes and token values. SHOW_UBITS() is only defined up to n_bits is 25, therefore forbid values larger than this in get_vlc2() (max_bits). tokens[][] can be used as an index in deltas[], which has a size of 64, so ensure the values are smaller than that. This prevents crashes on corrupt bitstreams. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org	13 years ago
Ronald S. Bultje	bf39d3b59d	truemotion2: handle out-of-frame motion vectors through edge extension. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org	13 years ago
Ronald S. Bultje	bd508d435b	truemotion2: convert packet header reading to bytestream2. Also use correct buffer sizes in calls to tm2_read_stream(). Together, this prevents overreads. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org	13 years ago
Michael Niedermayer	d0dafebb75	tm2: Fix overread of token array. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	9879b506b0	truemotion2dec: Fix overread of input. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago
Michael Niedermayer	2b693546ad	truemotion2: check motion vectors for validity Fixes out of array read Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>	13 years ago

1 2 3

125 Commits (9f00fa536938130e3c7ad2640a61795770d419a1)