Commit Graph
100 Commits
Author SHA1 Message Date
Alex Converse c1df37e59b hls: Re-add legacy applehttp name to preserve interface compatibility. 2012-02-14 12:13:46 -08:00
Alex Converse 9e1db721c4 svq3: Prevent illegal reads while parsing extradata.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
2012-02-10 09:57:39 -08:00
Alex Converse 81749f30cd dv: Move tables from dvdata.h to dvdata.c 2012-02-09 19:16:15 -08:00
Alex Converse 8dbdc2d840 dv: Move a table used only by the demuxer out of a shared header. 2012-02-09 19:16:15 -08:00
Alex Converse 89c9a8d3fd dv: Move functions used only by the encoder out of a shared header. 2012-02-09 19:16:15 -08:00
Alex Converse 3746072712 dv: Split dvdata.h into dvdata.h and dvquant.h 2012-02-09 19:16:15 -08:00
Alex Converse 0ab3687924 dv: Fix small overread in audio frequency table.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
2012-02-09 19:16:15 -08:00
Alex Converse 7b05025856 aacdec: Unify preconfigured layout and PCE layout. 2012-02-09 13:33:07 -08:00
Alex Converse f1ecd0802d aacdec: Support native channel layout when requested. 2012-02-09 13:33:07 -08:00
Alex Converse 37bed6ff3f aacdec: Try to sniff a reasonable channel layout for PCE based configurations.
This changes the output order of multichannel PCE based streams.
2012-02-09 13:33:06 -08:00
Alex Converse 314af0ff94 aacdec: Use correct speaker order for 7.1.
The spec says the following speaker mapping is default:
center front speaker
left, right center front speakers,
left, right outside front speakers,
left surround, right surround rear speakers,
front low frequency effects speaker
2012-02-08 09:56:37 -08:00
Alex Converse 8ece266213 aacdec: Remove incorrect comment.
It was only correct when element ids met very specific criteria.
2012-02-08 09:56:37 -08:00
Alex Converse e600a1e44a aacdec: Simplify output configuration. 2012-02-08 09:56:37 -08:00
Alex Converse 29a20ac4a1 movdec: Avoid av_malloc(0) in stss
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
2012-02-03 10:44:04 -08:00
Alex Converse 2d1c0dea5f dv: Fix small stack overread related to CVE-2011-3929 and CVE-2011-3936.
Found with asan.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Alex Converse <alex.converse@gmail.com>
2012-01-31 18:32:13 -08:00
Alex Converse c0bc7bd1e7 swfdec: Simplify sample rate calculation. 2012-01-31 15:55:46 -08:00
Alex Converse f372ce119b mp3dec: Fix a heap-buffer-overflow
In some cases, what is left to read from ptr is smaller than EXTRABYTES.

Based on a patch by Thierry Foucu <tfoucu@gmail.com>.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
2012-01-30 16:49:15 -08:00
Alex Converse 48f1e5212c wmadec: Verify bitstream size makes sense before calling init_get_bits.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
2012-01-30 10:54:24 -08:00
Alex Converse ae35210a5d kmvc: Log into a context at a log level constant. 2012-01-30 10:54:24 -08:00
Alex Converse dfa37fe8a3 mpeg12: Pad framerate tab to 16 entries.
There are many places where we read an unchecked 4-bit index into it.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
2012-01-30 10:19:01 -08:00
Alex Converse 386741f887 kmvc: Check palsize.
Fixes: CVE-2011-3952

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Based on fix by Michael Niedermayer
2012-01-30 10:16:17 -08:00
Alex Converse c898431ca5 nsvdec: Propagate errors
Related to CVE-2011-3940.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
2012-01-30 10:15:41 -08:00
Alex Converse 8fd8a48263 nsvdec: Be more careful with av_malloc().
Check results for av_malloc() and fix an overflow in one call.

Related to CVE-2011-3940.

Based in part on work from Michael Niedermayer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
2012-01-30 10:15:19 -08:00
Alex Converse 7181c4edee cosmetics: Remove extra newlines at EOF 2012-01-27 17:19:09 -08:00
Alex Converse 08628b6afb Revert "sws/pixfmt/pixdesc: add support for yuva444p"
This reverts commit fc115c80b7.

Tests are broken.
2012-01-26 18:06:57 -08:00
Alex Converse b57d262412 mjpegbdec: Fix overflow in SOS.
Based in part by a fix from Michael Niedermayer <michaelni@gmx.at>

Fixes CVE-2011-3947

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
2012-01-26 15:47:36 -08:00
Alex Converse 9adf25c1cf smacker: Sanity check huffman tables found in the headers.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

CC: libav-stable@libav.org
2012-01-26 10:18:00 -08:00
Alex Converse 90c0c83e14 smacker: remove dead store 2012-01-26 10:17:04 -08:00
Alex Converse dac56d9ce0 qdm2: Check data block size for bytes to bits overflow.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

CC: libav-stable@libav.org
2012-01-26 10:17:04 -08:00
Alex Converse d2ee8c1779 matroskadec: Pad AAC extradata.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

CC: libav-stable@libav.org
2012-01-25 14:46:06 -08:00
Alex Converse d78bb1a4b2 wma: Clip WMA1 and WMA2 frame length to 11 bits.
The MDCT buffers in the decoder are only sized for up to 11 bits. The
reverse engineered documentation for WMA1/2 headers say that that for
all samplerates above 32kHz 11 bits are used. 12 and 13 bit support
were added for WMAPro. I was unable to make any Microsoft tools generate
a test file at a samplerate above 48kHz.

Discovered by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

CC: libav-stable@libav.org
2012-01-25 12:31:37 -08:00
Alex Converse efe68076da aacenc: Fix identification padding when the bitstream is already aligned. 2012-01-24 12:55:21 -08:00
Alex Converse d7420e0ac9 mov: Remove dead stores for spherical coordinates for channel position. 2012-01-18 10:54:25 -08:00
Alex Converse 4df30f7114 utils: Check for extradata size overflows. 2012-01-12 13:26:13 -08:00
Alex Converse b5fc571e4f latmdec: Check AudioSpecificConfig length before decoding extradata.
This is different than a normal get_bits() over read because
decode_audio_specific_config() creates its own GetBitContext.

Fixes Bug 170.
2012-01-11 14:40:47 -08:00
Alex Converse 17ce52912f aacsbr: prevent out of bounds memcpy().
Fixes Libav Bug 195.

This doesn't make the code handle sample rate or upsample/downsample
change properly but this is still a good sanity check.

Based on change by Michael Niedermayer.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
2012-01-10 13:13:34 -08:00
Alex Converse 9de3cbc182 aacps: Add missing newline in error message. 2012-01-09 11:06:14 -08:00
Alex Converse cd6e34d369 fate: Add tests for vc1/wmapro in ism. 2012-01-09 11:04:17 -08:00
Alex Converse 46ef355c65 aacdec: Add a fate test for 5.1 channel SBR. 2012-01-09 11:04:05 -08:00
Alex Converse 4acd43a295 aacdec: Turn off PS for multichannel files that use PCE based configs.
Fixes al_sbr_cm_48_5.1.mp4.
2012-01-09 11:04:05 -08:00
Alex Converse ce23b2af18 fate: Add missing reference file from 9b4767e4. 2012-01-05 11:14:23 -08:00
Alex Converse 4274e481c0 mov: Support MOV_CH_LAYOUT_USE_DESCRIPTIONS for labeled descriptions. 2012-01-05 10:34:06 -08:00
Alex Converse 4bf3c8f226 mov: Don't stick the QuickTime field ordering atom in extradata.
The 'fiel' atoms can be found in H.264 tracks clobbering the extradata.
MJPEG supports non field based extradata, and this data should be
preserved when copying.
2011-12-21 22:04:37 -08:00
Alex Converse 021914e27f aacdec: Cleanup decode_ics_info.
Remove unused function argument.
Return an AVERROR.
Don't zero out ICS on failure.
2011-12-20 18:32:41 -08:00
Alex Converse 41bdd4adc4 mpegts: Suppress invalid timebase warnings on DMB streams.
timestamp_len and timestamp_res intialize to zero.
2011-12-20 09:52:05 -08:00
Alex Converse d9b89b23df mpegts: Fix typo in handling sections in the PMT.
This was an error rebasing 4682a1dc3a for
commit. The "pes" variable guaranteed to be NULL in that block.
2011-12-20 09:52:04 -08:00
Alex Converse d3b8bde2f1 movenc: Rudimentary IODs support. 2011-12-15 14:06:13 -08:00
Alex Converse 5cd56e193f aacdec: Use intfloat.h rather than local punning union. 2011-12-12 21:36:54 -08:00
Alex Converse 52401b82bd mov: Don't av_malloc(0).
malloc() is allowed to return NULL when zero is the argument. This
causes us to think malloc has failed and return AVERROR(ENOMEM). In
addition OS X malloc() returns an unfreeable non-NULL pointer for size
zero when alignment is greater than 16.
2011-12-05 09:51:35 -08:00
Alex Converse 6d23d19729 mov: Allow empty stts atom.
Fixes regressions caused by 30c3d976
2011-12-04 15:20:48 -08:00
Alex Converse fdab793a46 avconv: Handle audio sync for non-S16 sample formats.
Also fix reporting of the number of samples added/dropped.
2011-11-28 22:18:09 -08:00
Alex Converse ac47e014bb adtsenc: Check frame size.
Inspired by work from: Michael Niedermayer <michaelni@gmx.at>.

Signed-off-by: Alex Converse <alex.converse@gmail.com>
2011-11-28 11:22:40 -08:00
Alex Converse a27805189b txd: Fix order of operations. 2011-11-28 11:22:36 -08:00
Alex Converse 2b45222b6a md5proto: Fix order of operations. 2011-11-27 16:16:44 -08:00
Alex Converse 999e7ebd23 dca: Replace oversized unused get_bits() with skip_bits_long(). 2011-11-27 15:57:38 -08:00
Alex Converse 028a2375e2 mov: Make format string match variable type. 2011-11-26 19:41:54 -08:00
Alex Converse f11b0e9543 wmavoice: Make format string match variable type. 2011-11-26 19:40:34 -08:00
Alex Converse 963f685535 aacdec: Fix PS in ADTS.
Fixes File1.aac and Bug 80.
2011-11-22 14:33:11 -08:00
Alex Converse 105ab61c5f avconv: Consistently use PIX_FMT_NONE.
Use PIX_FMT_NONE instead of -1 when dealing with PixelFormat variables.
2011-11-22 14:33:11 -08:00
Alex Converse 9f8c190bb0 mov: Remove some redundant and obsolete comments. 2011-11-22 09:39:45 -08:00
Alex Converse bb4b0ad83b vp5: Fix illegal read.
Found with Address Sanitizer
2011-11-17 11:58:49 -08:00
Alex Converse c9e5ac3380 aes: Avoid illegal read and don't generate more key than we use. 2011-11-10 10:15:59 -08:00
Alex Converse 88b2436911 mpc7: Fix memset call in mpc7_decode_frame function 2011-11-10 09:30:49 -08:00
Alex Converse 1149fbc763 indeo3: Fix a fencepost error.
Found with asan and the venerable 1-dog.avi sample.
2011-11-08 10:59:52 -08:00
Alex Converse 735e601be1 mxfdec: Fix comparison of unsigned expression < 0.
'size' is populated by functions returning int64_t and int that return
negative error codes.
2011-11-08 10:59:52 -08:00
Alex Converse 090aaaf752 mpeg12enc: Remove write-only variables. 2011-11-07 10:53:55 -08:00
Alex Converse 7c5dfc174b mpeg12enc: Don't set up run-level info for level 0.
run: The number of zero coefficients preceding a non-zero coefficient,
in the scan order. The absolute value of the non-zero coefficient is
called "level".

The run-level code makes illegal reads when trying to set up tables for
nonsense level 0.
2011-11-07 10:50:48 -08:00
Alex Converse a1684cf82d msmpeg4: Don't set up run-level info for level 0.
run: The number of zero coefficients preceding a non-zero coefficient,
in the scan order. The absolute value of the non-zero coefficient is
called "level".

The run-level code makes illegal reads when trying to set up tables for
nonsense level 0.
2011-11-07 10:48:53 -08:00
Alex Converse 2a6eb06254 vp6: Fix illegal read. 2011-11-03 16:40:34 -07:00
Alex Converse 0d7a16a946 avfilter: Don't copy garbage from the stack when setting up video pictures. 2011-11-03 15:54:04 -07:00
Alex Converse 61856d06eb probe: Restore identification of files with very large id3 tags and no extension.
Restore behavior of identifying files with huge id3 tags as
mp3 at AVPROBE_SCORE_MAX/4. This was broken in r25378 and subsequently
removed in r25929.
2011-10-28 15:44:10 -07:00
Alex Converse 7a773d4d59 probe: Remove id3 tag presence as a criteria to do file extension checking.
This only encourages our users to put id3v2 tags on non-mp3 files to opt
into extension based probing.
2011-10-28 15:44:09 -07:00
Alex Converse ca65932bbf mpegts: MP4 SL support 2011-10-28 14:54:14 -07:00
Alex Converse c530267024 mpegts: MP4 OD support 2011-10-28 14:54:14 -07:00
Alex Converse 4682a1dc3a mpegts: Add support for Sections in PMT 2011-10-28 14:54:14 -07:00
Alex Converse fec2836483 mpegts: Replace the MP4 descriptor parser with a recursive parser. 2011-10-28 14:54:14 -07:00
Alex Converse c3bc6096f2 mpegts: Add support for multiple mp4 descriptors 2011-10-28 14:54:13 -07:00
Alex Converse 476d04a56a mpegts: Parse mpeg2 SL descriptors. 2011-10-28 14:54:13 -07:00
Alex Converse 77b5c82b49 isom: Add MPEG4SYSTEMS dummy object type indication. 2011-10-28 14:54:13 -07:00
Alex Converse ab2940691b avio: Check for invalid buffer length. 2011-10-16 23:56:21 -07:00
Alex Converse 7ad06beb2c mov: 10l: Terminate string with 0 not '0' 2011-10-14 10:38:42 -07:00
Alex Converse 8fb22c3d47 mov: Prevent illegal writes when chapter titles are very short. 2011-10-14 10:36:18 -07:00
Alex Converse 0c46e958d1 mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions. 2011-10-10 09:40:26 -07:00
Alex Converse 98ef887a75 mpegps: Use av_get_packet() instead of poorly emulating it. 2011-10-07 17:04:14 -07:00
Alex Converse fcbe421cee prores: Handle 0 or fewer bits left
show_bits() is undefined when the number of bits is less than or equal to
zero.
2011-09-29 09:45:57 -07:00
Alex Converse fe21f78d2b mpeg probe: check the 2/4-bit synchronization value found after a pack_start_code. 2011-09-29 09:45:57 -07:00
Alex Converse daf9890811 avconv: Reformat s16 volume adjustment. 2011-09-28 12:33:51 -07:00
Alex Converse 4bb0b31f76 avconv: Initialize return value for codec copy path. 2011-09-27 19:32:26 -07:00
Alex Converse a9a033773a avconv: Fix volume adjustment for non-s16 sample formats 2011-09-27 14:10:12 -07:00
Alex Converse fe332cf5b9 avconv: Make samples void*.
Different sample formats are different sizes.
2011-09-27 14:10:12 -07:00
Alex Converse af3c06b4db avconv: Use the size of the decode sample format when allocating the audio samples buffer. 2011-09-27 14:10:12 -07:00
Alex Converse 9fba8ebe0a mpegps: Handle buffer exhaustion when reading packets. 2011-09-23 16:36:16 -07:00
Alex Converse 1c2e07b811 mp4: Don't read an empty Decoder Config Descriptor 2011-09-22 10:09:04 -07:00
Alex Converse 05fc9e40a4 swfdec: Add support for sample_rate_code 0 (5512 Hz) 2011-09-21 09:42:35 -07:00
Alex Converse 940173d4d1 lavf utils: Remove write-only variable 2011-09-14 10:35:46 -07:00
Alex Converse 4439caa482 lavf utils: Rename shadowing variable 2011-09-14 10:35:42 -07:00
Alex Converse 0872bb23b4 xan: Add some buffer checks 2011-09-12 11:18:57 -07:00
Alex Converse 350f57bd7b xan: Remove extra trailing newline 2011-09-12 11:18:57 -07:00
Alex Converse 0c1f5b93d9 cljr: init_get_bits size in bits instead of bytes 2011-09-09 15:01:00 -07:00
Alex Converse b7ce4f1d1c indeo2: fail if input buffer too small 2011-09-09 15:01:00 -07:00