Laurent Aimar
a68a6a4fb1
xxan: check for out of bound accesses
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
e182de9a98
txd: check for out of bound reads.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
a4ed7c3fe9
qtrle: check for invalid line offset
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
6d45702f7f
vqavideo: check for out of bound reads.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
b226af3910
vqavideo: check for invalid/unsupported version
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
6c1fb3e763
eamad: release the reference frame on video size changes
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
da35797359
eamad: check for out of bound reads when doing MC
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
6e20554a6d
eamad: avoid NULL derefence when missing the reference frame.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
6bfe0d4c3d
eatgv: fix pointer arithmetic overflows.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
09302a897d
eatgv: fix out of bound reads on corrupted motions vectors.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
74b9c59839
eamad: clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffer
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
31ac9b30ae
atrac1: give a valid context pointer to av_log().
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Themaister
a3e11fa43c
Start adding pixel definitions for planar rgb.
13 years ago
Mohamed Naufal
0ef2e660c1
libstagefright: reindent after previous commit
13 years ago
Mans Rullgard
bb59156606
vp8: fix signed overflows
...
In addition to avoiding undefined behaviour, an unsigned type
makes more sense for packing multiple 8-bit values.
Signed-off-by: Mans Rullgard <mans@mansr.com>
13 years ago
Mans Rullgard
e708afd3c0
motion_est: fix some signed overflows
...
Signed-off-by: Mans Rullgard <mans@mansr.com>
13 years ago
Mans Rullgard
559c244d42
dca: fix signed overflow in shift
...
Signed-off-by: Mans Rullgard <mans@mansr.com>
13 years ago
Mans Rullgard
d12294304a
aacdec: fix undefined shifts
...
Since nnz can be zero, this is needed to avoid a shift by 32.
Signed-off-by: Mans Rullgard <mans@mansr.com>
13 years ago
Michael Niedermayer
db27bef747
dct-test: document the number of bits we use for testing.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Michael Niedermayer
3d5971d9f7
dct-test: better term for meximum error.
...
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
a00676e48e
bink: Check for various out of bound writes
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
24adf7832b
bink: Check for out of bound writes when building tree
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Mans Rullgard
ac6eab1496
put_bits: fix invalid shift by 32 in flush_put_bits()
...
If flush_put_bits() is called when the 32-bit buffer is empty,
e.g. after writing a multiple of 32 bits, and invalid shift by
32 is performed. Since flush_put_bits() is called infrequently,
this additional check should have negligible performance impact.
Signed-off-by: Mans Rullgard <mans@mansr.com>
13 years ago
Michael Niedermayer
74f77eb048
H264: set colorspace and full range to values indicating unspecified by default
...
Code based on ffdshow
Author unknown
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Clément Bœsch
3775af0fec
bintext: reset x and y pos after each frame decode.
...
This makes successive frames decode possible.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
13 years ago
Laurent Aimar
9bd854b1ff
mpc8: Check out of bound bands limit
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
7d17a794f0
xan: Prevent NULL dereference with missing palette
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
3db3fdf4c6
xan: Check for out of bound reads in xan_huffman_decode()
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
3e0757c2a8
xan: Fixed out of bound accesses in xan_unpack()
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
1cd0a55163
motionpixels: Prevent calling init_vlc() with invalid parameters
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
5f05cf4ea9
shorten: Fix out of bound writes in fix_bitshift()
...
The data pointers s->decoded[*] already take into account s->nwrap.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
1720603287
dsicinav: Check for out of bounds writes
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
64263dd526
tiertexseqv: Check for out of bound reads
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
4fd56f842c
quickdraw: Check for out of bound reads
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
e3ca9b93d9
dsicinav: Check for out of bounds reads
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
210c80331e
motionpixels: Fix the size of workspace buffers
...
Some buffers must be mod 4 in width and/or height.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
d337dd3a90
motionpixels: Clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffer
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
d99427cb8b
wmavoice: Check for corrupted extra data
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
1c1449b548
wmavoice: Check for out of bound writes
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
06be075cda
xan: Prevent NULL dereferences with missing reference frame
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
c7e631986b
bink: Prevent NULL dereferences with missing reference frame
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
2c6cf13940
wavpack: Reset internal state on corrupted blocks
...
wavpack_decode_block() supposes that it is called back with the exact
same buffer unless it has returned with an error. With multi-channels
files, wavpack_decode_frame() was breaking this assumption.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
2c1ba79941
wmapro: Validate the number of audio channels before using it
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
95010d18b2
shorten: Prevent block size from increasing
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Laurent Aimar
124a16f678
xan: Prevent out of bound accesses
...
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
13 years ago
Mohamed Naufal
a85996d834
libstagefright: start decode_thread() only after decode_frame() is called at least once.
...
This prevents the situation where EOS is passed as the first frame to the
h/w decoder and thus avoids a potential crash.
13 years ago
Mohamed Naufal
fedbf9177c
libstagefright: mark the dummy frame as keyframe.
...
This makes sure decoder->read() returns if it is the first frame fed.
13 years ago
Mohamed Naufal
295f13953d
libstagefright: limit the output queue size
13 years ago
Mohamed Naufal
23ea48f2f7
libstagefright: return EOS if CustomSource::read() is called after decode_thread() returns
13 years ago
Mohamed Naufal
09a49e8919
libstagefright: set the correct frame size
13 years ago