Commit Graph
89 Commits
Author SHA1 Message Date
Laurent AimarandJanne Grunau 4c7a232fc8 h264: reset h->ref_count in case of errors in ff_h264_decode_ref_pic_list_reordering()
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:37:36 +02:00
Laurent AimarandJanne Grunau e8ac80fb2c error_resilience: fix the check for missing references in ff_er_frame_end() for H264
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:37:36 +02:00
Laurent AimarandJanne Grunau 1b1182ce97 4xm: prevent NULL dereference with invalid huffman table
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:37:36 +02:00
Laurent AimarandJanne Grunau 79964745b3 4xmdemux: prevent use of uninitialized memory
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:37:35 +02:00
Laurent AimarandJanne Grunau 8d518a9c4f 4xm: clear FF_INPUT_BUFFER_PADDING_SIZE bytes in temporary buffers
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:37:35 +02:00
Laurent AimarandJanne Grunau dc64f203a6 ptx: check for out of bound reads
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:37:15 +02:00
Laurent AimarandJanne Grunau 04a845caa7 tiffdec: fix out of bound reads/writes
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:36:13 +02:00
Laurent AimarandJanne Grunau 46cb2f6a29 eacmv: check for out of bound reads
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:36:13 +02:00
Laurent AimarandJanne Grunau 8df8a87e3f eacmv: fix potential pointer arithmetic overflows
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:36:12 +02:00
Laurent AimarandJanne Grunau c7f89064e2 adpcm: fix out of bound reads due to integer overflow
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:36:12 +02:00
Laurent AimarandJanne Grunau 2475f1a83c anm: prevent infinite loop
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:36:12 +02:00
Laurent AimarandJanne Grunau 6de33611c9 avsdemux: check for out of bound writes
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:36:12 +02:00
Laurent AimarandJanne Grunau de049a95f4 avs: check for out of bound reads
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:36:12 +02:00
Laurent AimarandJanne Grunau 76c6971a64 avsdemux: check for corrupted data
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-10 21:27:04 +02:00
Laurent AimarandJanne Grunau a00676e48e bink: Check for various out of bound writes
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-08 16:32:01 +02:00
Laurent AimarandJanne Grunau 24adf7832b bink: Check for out of bound writes when building tree
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-08 16:25:56 +02:00
Laurent AimarandJanne Grunau 9bd854b1ff mpc8: Check out of bound bands limit
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 17:15:45 +02:00
Laurent AimarandJanne Grunau 7d17a794f0 xan: Prevent NULL dereference with missing palette
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 17:15:31 +02:00
Laurent AimarandJanne Grunau 3db3fdf4c6 xan: Check for out of bound reads in xan_huffman_decode()
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:32 +02:00
Laurent AimarandJanne Grunau 3e0757c2a8 xan: Fixed out of bound accesses in xan_unpack()
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:32 +02:00
Laurent AimarandJanne Grunau 1cd0a55163 motionpixels: Prevent calling init_vlc() with invalid parameters
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:32 +02:00
Laurent AimarandJanne Grunau 5f05cf4ea9 shorten: Fix out of bound writes in fix_bitshift()
The data pointers s->decoded[*] already take into account s->nwrap.

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau 1720603287 dsicinav: Check for out of bounds writes
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau 64263dd526 tiertexseqv: Check for out of bound reads
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau 4fd56f842c quickdraw: Check for out of bound reads
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau e3ca9b93d9 dsicinav: Check for out of bounds reads
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau 210c80331e motionpixels: Fix the size of workspace buffers
Some buffers must be mod 4 in width and/or height.

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau d337dd3a90 motionpixels: Clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffer
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau d99427cb8b wmavoice: Check for corrupted extra data
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau 1c1449b548 wmavoice: Check for out of bound writes
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau 06be075cda xan: Prevent NULL dereferences with missing reference frame
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau c7e631986b bink: Prevent NULL dereferences with missing reference frame
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau 2c6cf13940 wavpack: Reset internal state on corrupted blocks
wavpack_decode_block() supposes that it is called back with the exact
same buffer unless it has returned with an error. With multi-channels
files, wavpack_decode_frame() was breaking this assumption.

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:31 +02:00
Laurent AimarandJanne Grunau 2c1ba79941 wmapro: Validate the number of audio channels before using it
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:30 +02:00
Laurent AimarandJanne Grunau 1e3336de69 mpc8: Fix return value on EOF
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 16:25:30 +02:00
Laurent AimarandJanne Grunau a72cad0a6c vp6: Reset the internal state when aborting key frames header parsing
It prevents leaving the state only half initialized.

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 00:37:32 +02:00
Laurent AimarandJanne Grunau 3d09d0017d vp56: Release old pictures after a resolution changes
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 00:27:24 +02:00
Laurent AimarandJanne Grunau 066fff755a vp6: Check for huffman tree build errors
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 00:27:03 +02:00
Laurent AimarandJanne Grunau 0ec6d6e9b6 vp56: Check for missing reference frame data
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-07 00:25:43 +02:00
Laurent AimarandJanne Grunau d239d4b447 cinepak: Fix invalid read access on extra data
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-06 23:35:29 +02:00
Laurent AimarandJanne Grunau c0cbe36b18 vmd: fix segfaults on corruped streams
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-06 23:33:09 +02:00
Laurent AimarandJanne Grunau 3a742470a8 cook: Fix js_vlc_bits value validation for joint stereo
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-06 23:31:06 +02:00
Laurent AimarandJanne Grunau 762ffa6861 segafilm: Fix potential division by 0 on corrupted streams in the demuxer
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-06 23:01:45 +02:00
Laurent AimarandJanne Grunau 790f4dd5c9 Fixed segfault on corrupted sega streams in the demuxer.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-06 22:32:02 +02:00
Laurent AimarandJanne Grunau 69a0bce753 Fixed deference of NULL pointer in motionpixels decoder.
Some of the arguments given to init_vlc() come from the stream
and can be corrupted.

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
2011-10-06 22:29:12 +02:00
Laurent AimarandJustin Ruggles 5a19acb17c Fix out of bound reads in the QDM2 decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
2011-10-03 21:34:19 -04:00
Laurent AimarandJustin Ruggles 291d74a46d Check for out of bound writes in the QDM2 decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
2011-10-03 21:34:19 -04:00
Laurent AimarandAnton Khirnov d1186ff72d h264: check for out of bounds reads in ff_h264_decode_extradata().
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-25 15:04:58 +02:00
Laurent AimarandMartin Storsjö 2b4e49d428 flvdec: Fix invalid pointer deferences when parsing index
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-24 18:08:39 +03:00
Laurent AimarandMartin Storsjö fe476e5a9b rv34: Check for invalid slices offsets
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-22 10:35:06 +03:00
Laurent AimarandMartin Storsjö 4cc7732386 rv34: Check for invalid slice offsets
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-20 10:29:55 +03:00
Laurent AimarandMartin Storsjö f06068bbd6 rmdec: Reject invalid deinterleaving parameters
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-19 15:45:22 +03:00
Laurent AimarandMartin Storsjö b4ed3d78cb rv34: Fix potential overreads
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-19 15:44:22 +03:00
Laurent AimarandMartin Storsjö d2213b6493 rv34: Fix buffer size used for MC of B frames after a resolution change
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-19 15:44:22 +03:00
Laurent AimarandMartin Storsjö d0f6ab0298 rv34: Avoid NULL dereference on corrupted bitstream
rv34_decode_slice() can return without allocating any pictures.

Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-19 15:44:22 +03:00
Laurent AimarandMartin Storsjö 4a29b47186 rv10: Reject slices that does not have the same type as the first one
This prevents crashes with some corrupted bitstreams.

Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-19 14:58:33 +03:00
Laurent AimarandAnton Khirnov 3e033da847 rmdec: use the deinterleaving mode and not the codec when creating audio packets.
It prevents crashes due to non initialized fields.

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-19 12:37:31 +02:00
Laurent AimarandLuca Barbato 0e7efb9d23 oggdec: fix out of bound write in the ogg demuxer
Between ogg_save() and ogg_restore() calls, the number of streams
could have been reduced.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2011-09-17 09:41:02 -07:00
Laurent AimarandAlex Converse b59efc9434 Fixed size given to init_get_bits().
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
2011-09-15 13:23:04 -07:00
Laurent AimarandMartin Storsjö 6489455495 Check for invalid VLC value in smacker decoder.
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-14 10:40:31 +03:00
Laurent AimarandMartin Storsjö 9676ffba83 Check and propagate errors when VLC trees cannot be built in smacker decoder.
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-14 10:38:49 +03:00
Laurent AimarandMartin Storsjö a92d0fa5d2 Fixed off by one packet size allocation in the smacker demuxer.
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-12 23:44:51 +03:00
Laurent AimarandMartin Storsjö e055932f56 Check for invalid packet size in the smacker demuxer.
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-12 23:43:52 +03:00
Laurent AimarandAnton Khirnov 273aab99bf ape demuxer: fix segfault on memory allocation failure.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-09-12 21:12:31 +02:00
Laurent AimarandAlex Converse 393d5031c6 Fixed size given to init_get_bits() in xan decoder. 2011-09-12 11:18:57 -07:00
Laurent AimarandMartin Storsjö 8bfea4ab4e Fixed segfault with wavpack decoder on corrupted decorrelation terms sub-blocks.
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-10 18:58:57 +03:00
Laurent AimarandAlex Converse 46b004959b ffv1: Fixed size given to init_get_bits() in decoder.
init_get_bits() takes a number of bits and not a number of bytes as
its size argument.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
2011-09-09 15:00:28 -07:00
Laurent AimarandMartin Storsjö 55354b7de2 Fixed invalid access in wavpack decoder on corrupted bitstream.
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-08 12:04:06 +03:00
Laurent AimarandMartin Storsjö 0aedab0340 Fixed invalid writes in wavpack decoder on corrupted bitstreams.
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-08 12:00:13 +03:00
Laurent AimarandMartin Storsjö beefafda63 Fixed invalid access in wavpack decoder on corrupted extra bits sub-blocks.
Signed-off-by: Martin Storsjö <martin@martin.st>
2011-09-08 11:57:13 +03:00
Laurent Aimar 8bdf11815c Fixed mpeg12 top field first flag value with field picture encoding.
The relevent extract of the iso 13818-2 about the value of the syntaxical
element top_field_first of the Picture Coding Extension is:

"top_field_first -- The meaning of this element depends upon picture_structure,
progressive_sequence and repeat_first_field.
[...]
In a field picture top_field_first shall have the value '0', and the only field
output by the decoding process is the decoded field picture."

Originally committed as revision 24853 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-08-20 18:28:42 +00:00
Laurent Aimar 164aab02a0 MPEG-2 DXVA2 implementation
It allows VLD MPEG-2 decoding using DXVA2 (GPU assisted decoding API under
VISTA and Windows 7).
 It is implemented by using AVHWAccel API.

Originally committed as revision 23644 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-06-18 20:07:43 +00:00
Laurent Aimar 48962f2eb7 Reindent after last commit on dxva2 h264 AVHWAccel.
Originally committed as revision 23141 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-05-14 23:09:08 +00:00
Laurent Aimar efb816ef64 Fixed h264 long term support with dxva2 AVHWAccel.
Based on a commit for vaapi(r22869).

Originally committed as revision 23140 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-05-14 23:08:23 +00:00
Laurent Aimar 6c389ddbd3 Fixed DXVA2 H264 hwaccel after luma/chroma_weight changes.
Originally committed as revision 22211 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-03-04 19:12:20 +00:00
Laurent Aimar b8fb21e902 Fixed buffer overread in flashsv decoder.
Originally committed as revision 22210 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-03-04 19:10:44 +00:00
Laurent Aimar 19a9846f3d Fixed DXVA2 H264 hwaccel compilation.
Originally committed as revision 22180 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-03-03 19:54:12 +00:00
Laurent Aimar a9837b58e1 Fixed overreads in TTA decoder with corrupted bistreams.
Originally committed as revision 22176 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-03-03 19:31:46 +00:00
Laurent Aimar 4e06acbde4 Fixed a segfault in the DCA decoder with corrupted streams.
It happens when the number of channels defined by DCAContext:acmod is lower
than DCAContext:prim_channels. In this case, dca_subsubframe() will call
qmf_32_subbands() using s->channel_order_tab[] entries equal to -1.

Originally committed as revision 22083 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-02-26 18:50:01 +00:00
Laurent Aimar f0f86627fe VC-1/WMV3 DXVA2 implementation
It allows VLD VC-1/WMV3 decoding using DXVA2 (GPU assisted decoding API under
VISTA and Windows 7).
 It is implemented by using AVHWAccel API.

Originally committed as revision 21424 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-24 17:27:00 +00:00
Laurent Aimar 34fecc9afd Added a few missing consts in dxva_h264.
Originally committed as revision 21422 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-24 16:40:58 +00:00
Laurent Aimar 0dc343d4cb Added a missing const to ff_h264_get_slice_type().
Originally committed as revision 21421 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-24 16:37:12 +00:00
Laurent Aimar 8880c8bcc3 Added missing const to get_bits_count().
Originally committed as revision 21419 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-24 16:22:09 +00:00
Laurent Aimar 85167c46ef Moved reusable functions from dxva2_h264.c to dxva2.c
Originally committed as revision 21407 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-23 18:17:57 +00:00
Laurent Aimar e4833b5d71 Added ff_dxva2_ prefix to get_surface(_index) and commit_buffer functions.
Originally committed as revision 21403 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-23 18:01:28 +00:00
Laurent Aimar 8cf9bbb6dc Reindent the content of one if(){} in ff_dxva2_common_end_frame.
Originally committed as revision 21402 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-23 18:00:51 +00:00
Laurent Aimar 8db7ee09c3 Moved reusable code from dxva2_h264.c:end_frame to ff_dxva2_common_end_frame.
Originally committed as revision 21401 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-23 17:59:08 +00:00
Laurent Aimar 8d821b0181 Added myself as dxva2 maintainer.
Originally committed as revision 21354 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-20 18:55:38 +00:00
Laurent Aimar 92c6a099ba H264 DXVA2 implementation
It allows VLD H264 decoding using DXVA2 (GPU assisted decoding API under
VISTA and Windows 7).
 It is implemented by using AVHWAccel API. It has been tested successfully
for some time in VLC using an nvidia card on Windows 7.

 To compile it, you need to have the system header dxva2api.h (either from
microsoft or using http://downloads.videolan.org/pub/videolan/testing/contrib/dxva2api.h)
 The generated libavcodec.dll does not depend directly on any new lib as
the necessary objects are given by the application using FFmpeg.

Originally committed as revision 21353 to svn://svn.ffmpeg.org/ffmpeg/trunk
2010-01-20 18:54:51 +00:00