The 32-bit integer accumulator in MSE computation can overflow for 8-bit frame data.
(e.g., for 1080p white frame compared to a black frame can give sum of 255*255*1080*1920 > 2^32).
Signed-off-by: Neil Birkbeck <neil.birkbeck@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
h264: remove an unused static constant
Merge only for metadata as the constant us not unused in ffmpeg
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'b97b1adb3f807e1acd00d56319ee6cb41cc727e4':
rtmpproto: Add a comment explaining the logic in handle_notify
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '83c285f88016b087c2f0f4b9ef356ad8ef12d947':
wtv: Add more sanity checks for a length read from the file
Conflicts:
libavformat/wtv.c
See: c42efad3c3
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'd8b68660145c76a23fc9665f96932449514ecad2':
yop: Clear all references to the AVBuffer in the local AVPacket
Conflicts:
libavformat/yop.c
See: 551f683861
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '3185a80259ce1f8f8111073dbd14a69a396e03a3':
fraps: Make the input buffer size checks more strict
Conflicts:
libavcodec/fraps.c
The added checks are mostly to handle duplicate frames, which
we discard, thus there are also no P frames for example.
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '82e266c6d3fbf3cc74e515b883e66543381a0f2c':
segafilm: Validate the number of audio channels
Merge only for metadata as the change is incorrect, checking audio
parameters in video only files
See: 192db16b9c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Prior to this on msvc/icl there was no handling of deprecated functions
and the deprecated warning was disabled.
After enabling there are a number of warnings relating to the CRT and
the use of the non-secure versions of several functions. Defining
_CRT_SECURE_NO_WARNINGS silences these warnings.
Signed-off-by: Martin Storsjö <martin@martin.st>
* commit '601c2015bc16f0b281160292a6a760cbbbb0eacb':
svq3: Avoid a division by zero
Conflicts:
libavcodec/svq3.c
See: 4fa706a4a6
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '7a5a55722749a3ab77941914707277b147322cbe':
qpeg: Add checks for running out of rows in qpeg_decode_inter
Conflicts:
libavcodec/qpeg.c
See: 4299dfa5de
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'e9d61de96c113ee0ef8082833c7e682df0e23eec':
mpegaudiodec: Validate that the number of channels fits at the given offset
Conflicts:
libavcodec/mpegaudiodec.c
See: 51fcf276f8
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'f50803354c6acb4575379d7c54ca48ec5d36dd61':
asvdec: Verify the amount of extradata
See: 605f2b6b00
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '72fe16a13e3ebd5396ac173bf84c8b20085c16d5':
movenc: Use null buffers for measuring the amount of data to be written
Conflicts:
libavformat/movenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '09f3c937ed6fd7c5bd64450d45f73b0f4975f4c9':
asfenc: remember send time and offset of the index entries
Conflicts:
libavformat/asfenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '1eb932803037a3c9f98f66aeb80024dfa3c5c743':
asfenc: add ASF_Reserved_4 as defined in section 10.10 of the ASF spec
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '5f408333601a827054335f309defcb246a532b21':
asfdec: substract preroll time from marker presentation time
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Minor change to fix for Trac #1003 to avoid squawking about files
with valid keyframes that aren't marked (as opposed to frames that are
marked as keyframes and aren't).
Change correctly surpresses the spurious warnings, while still complaining
about (and handling) the genuinely broken file attached to bug #1003.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Also make sure the existing length check can't overflow.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
This makes sure that it doesn't try to free an AVBuffer belonging
to an earlier packet when we free the local packet at the end.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
