summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* MAINTAINERS: Remove myself as leaderrelease/0.8Michael Niedermayer2015-07-311-1/+0
| | | | | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit f2c58931e629343f7d68258cc2b2d62c5f501ba5) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* arm: Don't clobber callee saved registers in scalarproductMartin Storsjö2013-12-211-6/+6
| | | | | | | | q4-q7/d8-d15 are supposed to not be clobbered by the callee. CC: libav-stable@libav.org Signed-off-by: Martin Storsjö <martin@martin.st> (cherry picked from commit d307e408d4a9ada22df443cc38be77cc5e492694)
* avformat/utils: do not override pts in h264 when they are provided from the ↵Michael Niedermayer2013-10-271-2/+4
| | | | | | | | | demuxer Fixes Ticket2143 Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 1e5271a9fd6ddcceb083f2185a4bbd8d44c9a813)
* update for 0.8.15n0.8.15Michael Niedermayer2013-10-063-3/+3
| | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* avcodec/ffv1enc: update buffer check for 16bpsMichael Niedermayer2013-10-061-1/+1
| | | | | | | | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 3728603f1854b5c79d1a64dd3b41b80640ef1e7f) Conflicts: libavcodec/ffv1enc.c (cherry picked from commit c900c6e5c26cd86cf34f9c8d4347cedbd01f3935)
* avcodec/dsputil: fix signedness in sizeof() comparissionsMichael Niedermayer2013-10-061-2/+2
| | | | | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 454a11a1c9c686c78aa97954306fb63453299760) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* avcodec/pngdsp: fix (un)signed type in end comparissionMichael Niedermayer2013-10-061-1/+1
| | | | | | | | | | | | | | | Fixes out of array accesses Fixes Ticket2919 Found_by: ami_stuff Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 86736f59d6a527d8bc807d09b93f971c0fe0bb07) Conflicts: libavcodec/pngdsp.c Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* matroska_read_seek: Fix used streams for subtitle index compensationMichael Niedermayer2013-10-061-4/+5
| | | | | | | | | Might fix Ticket1907 (I have no testcase so i cant test) Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 4758e32a6c48044f77102a49110c79b4f338f648) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* jpeg2000: check log2_cblk dimensionsMichael Niedermayer2013-10-061-0/+8
| | | | | | | | | | | | | | | | | | | | | Fixes out of array access Fixes Ticket2895 Found-by: Piotr Bandurski <ami_stuff@o2.pl> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 9a271a9368eaabf99e6c2046103acb33957e63b7) Conflicts: libavcodec/jpeg2000dec.c Signed-off-by: Michael Niedermayer <michaelni@gmx.at> Conflicts: libavcodec/j2kdec.c Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* avcodec/rpza: Perform pointer advance and checks before using the pointersMichael Niedermayer2013-10-061-4/+4
| | | | | | | | | | Fixes out of array accesses Fixes Ticket2850 Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 3819db745da2ac7fb3faacb116788c32f4753f34) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* update all trac links to use the trac subdomainMichael Niedermayer2013-10-061-1/+1
| | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* doc/APIchanges: List merge commit hashes and version numbersMichael Niedermayer2013-10-061-58/+58
| | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* apichanges: fix 2 wrong hashesMichael Niedermayer2013-10-061-2/+2
| | | | | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 2f3bc5122822687dc388f7352c92cf6db456cf7c) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* avcodec/parser: reset indexes on realloc failureMichael Niedermayer2013-09-261-3/+7
| | | | | | | | | Fixes Ticket2982 Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit f31011e9abfb2ae75bb32bc44e2c34194c8dc40a) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* Merge remote-tracking branch 'qatar/release/0.7' into release/0.8Michael Niedermayer2013-09-228-3/+23
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * qatar/release/0.7: Update changelog for 0.7.8 release aac: check the maximum number of channels oggdec: fix faulty cleanup prototype qdm2: check that the FFT size is a power of 2 rv10: check that extradata is large enough lavf: make sure stream probe data gets freed. dfa: check for invalid access in decode_wdlt(). avfiltergraph: check for sws opts being non-NULL before using them. Conflicts: Changelog libavformat/utils.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * Update changelog for 0.7.8 releaseReinhard Tartler2013-05-111-0/+29
| |
| * aac: check the maximum number of channelsReinhard Tartler2013-05-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Broken bitstreams could report a larger than specified number of channels and cause outbound writes. CC:libav-stable@libav.org (cherry picked from commit a943a132f36f4df8fe2f749744677b71984abce7) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> Conflicts: libavcodec/aacdec.c
| * oggdec: fix faulty cleanup prototypeLuca Barbato2013-05-091-1/+1
| | | | | | | | | | | | (cherry picked from commit fba8e5b608577fc660989d0057a55818254a3744) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * qdm2: check that the FFT size is a power of 2Anton Khirnov2013-05-091-0/+4
| | | | | | | | | | | | | | | | Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org (cherry picked from commit 34f87a58532ed652a6e0283c1d044ee5df0aef0b) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * rv10: check that extradata is large enoughAnton Khirnov2013-05-091-0/+5
| | | | | | | | | | | | | | | | | | | | | | Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org (cherry picked from commit 01d376f598fe95478036f5d1e3e5e14ffe32d4bf) Conflicts: libavcodec/rv10.c
| * lavf: make sure stream probe data gets freed.Anton Khirnov2013-05-091-0/+1
| | | | | | | | | | | | | | | | Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit dbb1425811a672eddf4acf0513237cdf20f83756) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * dfa: check for invalid access in decode_wdlt().Anton Khirnov2013-05-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | This can happen when the number of skipped lines is not consistent with the number of coded lines. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 3623589edc7b1257bb45aa9e52c9631e133f22b6) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * avfiltergraph: check for sws opts being non-NULL before using them.Anton Khirnov2013-05-092-2/+8
| | | | | | | | | | | | | | | | | | Avoid snprintfing a NULL pointer. CC: libav-stable@libav.org (cherry picked from commit 6e3c13a559e9ff300b5ca60e1d503e594d7f055c) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
* | Merge commit 'f844cb9bced3148fca2db5bbb092929526108005' into release/0.8Michael Niedermayer2013-09-226-10/+20
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | * commit 'f844cb9bced3148fca2db5bbb092929526108005': iff: validate CMAP palette size wmaprodec: require block_align to be set. lzo: fix overflow checking in copy_backptr() flacdec: simplify bounds checking in flac_probe() atrac3: avoid oversized shifting in decode_bytes() lavf: fix arithmetic overflows in avformat_seek_file() Conflicts: libavformat/iff.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * iff: validate CMAP palette sizeKostya Shishkov2013-05-091-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes CVE-2013-2495 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Luca Barbato <lu_zero@gentoo.org> CC: libav-stable@libav.org (cherry picked from commit 50c449ac24fbb4c03c15d2e2026cef2204b80385) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 31a77177ff323ef83944c60a8654891213ab6691) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * wmaprodec: require block_align to be set.Anton Khirnov2013-05-091-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Avoids an infinite loop in the calling programs with decoder not consuming any input and not returning output. CC:libav-stable@libav.org (cherry picked from commit cacad1c058f66558ec727faac3b277d2dee264d4) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 20373a66ec68d958c266f643a7d0e5ec254c0fcc) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * lzo: fix overflow checking in copy_backptr()Xi Wang2013-05-091-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The check `src > dst' in the form `&c->out[-back] > c->out' invokes pointer overflow, which is undefined behavior in C. Remove the check. Also replace `&c->out[-back] < c->out_start' with a safe form `c->out - c->out_start < back' to avoid overflow. CC: libav-stable@libav.org Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit ca6c3f2c53be70aa3c38e8f1292809db89ea1ba6) Conflicts: libavutil/lzo.c
| * flacdec: simplify bounds checking in flac_probe()Xi Wang2013-05-091-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Simplify `p->buf > p->buf + p->buf_size - 4' as `p->buf_size < 4'. Avoid a possible out-of-bounds pointer, which is undefined behavior in C. CC: libav-stable@libav.org Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit 8425d693eefbedbb41f91735614d41067695aa37)
| * atrac3: avoid oversized shifting in decode_bytes()Xi Wang2013-05-091-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When `off' is 0, `0x537F6103 << 32' in the following expression invokes undefined behavior, the result of which is not necessarily 0. (0x537F6103 >> (off * 8)) | (0x537F6103 << (32 - (off * 8))) Avoid oversized shifting. CC: libav-stable@libav.org Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit eba1ff31304e407db3cefd7532108408f364367b) Conflicts: libavcodec/atrac3.c
| * lavf: fix arithmetic overflows in avformat_seek_file()Mans Rullgard2013-05-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The values compared here can be more than INT64_MAX apart. Since the difference is always positive, converting to uint64_t before subtracting gives the correct result without overflows. Signed-off-by: Mans Rullgard <mans@mansr.com> (cherry picked from commit 91ac403b1316d59b4f43c4ea0f237e24cec2819a) Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* | Merge commit '9c713f30e4913a28d93eb37ea5db7f62be4c0ef6' into release/0.8Michael Niedermayer2013-09-223-9/+19
|\ \ | |/ | | | | | | | | | | | | | | * commit '9c713f30e4913a28d93eb37ea5db7f62be4c0ef6': parser: fix large overreads dsputil: fix invalid array indexing shorten: use the unsigned type where needed Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * parser: fix large overreadsMichael Niedermayer2013-05-091-1/+3
| | | | | | | | | | | | | | | | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com> (cherry picked from commit 096abfa15052977eed93f0b5e01afd2d47c53c1f) Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| * dsputil: fix invalid array indexingMans Rullgard2013-05-091-6/+10
| | | | | | | | | | | | | | | | | | | | Indexing outside an array is invalid and causes errors with gcc 4.8. Signed-off-by: Mans Rullgard <mans@mansr.com> (cherry picked from commit 0a07f2b346433a9a2677c69c6b29a1a827e39109) Signed-off-by: Diego Biurrun <diego@biurrun.de>
| * shorten: use the unsigned type where neededLuca Barbato2013-05-091-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | get_uint returns an unsigned value, use an unsigned to store blocksize to make sure the comparison logic is correct and report correctly the error for the channel count not supported. CC: libav-stable@libav.org (cherry picked from commit 5cf7c72757779a740e897a97710aac044fe5258c) (cherry picked from commit 88089eecfd7e604d40d078b4f4206c647cb2e2b4) (cherry picked from commit f42d03746afe491dd02bb6372961e85e78299864) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> Signed-off-by: Reinhard Tartler <siretart@tauware.de> Conflicts: libavcodec/shorten.c
* | Merge commit '5ebb5a32bdd910a8afb316c51ed0b322f5600ae5' into release/0.8Michael Niedermayer2013-09-221-8/+9
|\ \ | |/ | | | | | | | | | | | | * commit '5ebb5a32bdd910a8afb316c51ed0b322f5600ae5': shorten: report meaningful errors shorten: set invalid channels count to 0 Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * shorten: report meaningful errorsReinhard Tartler2013-05-091-8/+8
| | | | | | | | | | | | | | | | | | | | (cherry picked from commit 4c364eb2b856fc33cf7b42f7c7b979e69fde5f3a) (cherry picked from commit 0daf1428e82926dc5a8c72a0ff4c93aaa8a84ed9) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> Conflicts: libavcodec/shorten.c
| * shorten: set invalid channels count to 0Reinhard Tartler2013-05-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prevent the loop shorten_decode_close from writing and freeing out of the array boundary. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Luca Barbato <lu_zero@gentoo.org> CC: libav-stable@libav.org (cherry picked from commit c10da30d8426a1f681d99a780b6e311f7fb4e5c5) (cherry picked from commit 21d568be179c54a1596d1377b4da7fbe755bfe7f) Signed-off-by: Luca Barbato <lu_zero@gentoo.org> Conflicts: libavcodec/shorten.c
* | Merge commit 'd785f6940144eb6ce4c24309ed034056b81395bc' into release/0.8Michael Niedermayer2013-09-225-3/+14
|\ \ | |/ | | | | | | | | | | | | | | | | | | * commit 'd785f6940144eb6ce4c24309ed034056b81395bc': shorten: validate that the channel count in the header is not <= 0 matroskadec: request a read buffer for the wav header h264: check for luma and chroma bit depth being equal xxan: fix invalid memory access in xan_decode_frame_type0() wmadec: require block_align to be set. Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * shorten: validate that the channel count in the header is not <= 0Justin Ruggles2013-05-091-1/+1
| | | | | | | | | | | | | | | | | | (cherry picked from commit 4c53f4aed3edfa58360c7a2a468782eae31d3176) Signed-off-by: Reinhard Tartler <siretart@tauware.de> Conflicts: libavcodec/shorten.c
| * matroskadec: request a read buffer for the wav headerLuca Barbato2013-05-091-1/+1
| | | | | | | | | | | | | | | | | | | | Solve an infiniloop. CC: libav-stable@libav.org (cherry picked from commit 37cb3b180a1dc3d6f123f68e0806585ebc2578b6) Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| * h264: check for luma and chroma bit depth being equalReinhard Tartler2013-05-091-0/+6
| | | | | | | | | | | | | | | | | | | | The decoder assumes a single bit depth for all the planes while the specification allows different bit depths for luma and chroma. Avoid the possible problems described in CVE-2013-2277 Conflicts: libavcodec/h264.c
| * xxan: fix invalid memory access in xan_decode_frame_type0()Reinhard Tartler2013-05-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The loop a few lines below the xan_unpack() call accesses up to dec_size * 2 bytes into y_buffer, so dec_size must be limited to buffer_size / 2. CC:libav-stable@libav.org (cherry picked from commit 8a49d2bcbe7573bb4b765728b2578fac0d19763f) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 62a657de168cf501acb23d48cc1aa00793dc83f3) Signed-off-by: Reinhard Tartler <siretart@tauware.de> Conflicts: libavcodec/xxan.c
| * wmadec: require block_align to be set.Anton Khirnov2013-05-091-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Avoids an infinite loop in the calling programs with decoder not consuming any input and not returning output. CC:libav-stable@libav.org (cherry picked from commit ea1136baafb1fe271cb56c3f4d7bff0267e3c70f) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit c1f479e8df24284237c80ad959619fc85e29a26d) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
* | Merge commit '5025dbc577c9a9e0109cb363ac630a9eeda6dc1d' into release/0.8Michael Niedermayer2013-09-227-4/+34
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | * commit '5025dbc577c9a9e0109cb363ac630a9eeda6dc1d': wmaprodec: return an error, not 0, when the input is too small. vorbisdec: Error on bark_map_size equal to 0. Update RELEASE file for 0.7.8 update year to 2013 oggdec: make sure the private parse data is cleaned up indeo5: update AVCodecContext width/height on size change doc: filters: Correct BNF FILTER description Conflicts: RELEASE Merged-by: Michael Niedermayer <michaelni@gmx.at>
| * wmaprodec: return an error, not 0, when the input is too small.Anton Khirnov2013-05-091-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Returning 0 may result in an infinite loop in valid calling programs. A decoder should never return 0 without producing any output. CC:libav-stable@libav.org (cherry picked from commit 4c0080b7e7d501e2720d2a61f5186a18377f9d63) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 60dd8b5733f9ec4919fbc732ace1be8184dde880) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * vorbisdec: Error on bark_map_size equal to 0.Michael Niedermayer2013-05-091-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The value is used to calculate output LSP curve and a division by zero and out of array accesses would occur. CVE-2013-0894 CC: libav-stable@libav.org Reported-by: Dale Curtis <dalecurtis@chromium.org> Found-by: inferno@chromium.org Signed-off-by: Michael Niedermayer <michaelni@gmx.at> Signed-off-by: Luca Barbato <lu_zero@gentoo.org> (cherry picked from commit 11dcecfcca0eca1a571792c4fa3c21fb2cfddddc) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 494ddd377ada76ed555f7a3f49391455daa099c9) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * Update RELEASE file for 0.7.8Reinhard Tartler2013-05-091-1/+1
| |
| * update year to 2013Reinhard Tartler2013-05-091-1/+1
| | | | | | | | Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * oggdec: make sure the private parse data is cleaned upLuca Barbato2013-05-093-1/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Related to CVE-2012-2882 (cherry picked from commit d894f74762bc95310ba23f804b7ba8dffc8f6646) Conflicts: libavformat/oggdec.h libavformat/oggparsevorbis.c (cherry picked from commit b0240165d93d4a08d15d244953219a4d4e725d3f) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * indeo5: update AVCodecContext width/height on size changeMichael Niedermayer2013-05-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes CVE-2012-2787 Note that in 0.7, there is only indeo 5, no indeo 4 decoder Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit b146d74730ab9ec5abede9066f770ad851e45fbc) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 2bc1e4fcb96c470e2ccb2a0a78a415d5eab960c8) Conflicts: libavcodec/ivi_common.c
View Lorry Controller Status