Michael Niedermayer | 1 Oct 01:24 2011

mpegvideo: increase emu edge buffer size

ffmpeg | branch: master | Michael Niedermayer <michaelni <at> gmx.at> | Sat Oct  1 00:58:01 2011 +0200|
[7322483d72d4abefae9f5c08c611f521de7236a5] | committer: Michael Niedermayer

mpegvideo: increase emu edge buffer size
This fixes a crash with 422 H.264

Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7322483d72d4abefae9f5c08c611f521de7236a5
---

 libavcodec/mpegvideo.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c
index 9dfd26e..fbcd42c 100644
--- a/libavcodec/mpegvideo.c
+++ b/libavcodec/mpegvideo.c
 <at>  <at>  -377,8 +377,8  <at>  <at>  static int init_duplicate_context(MpegEncContext *s, MpegEncContext *base){
     int i;

     // edge emu needs blocksize + filter length - 1 (=17x17 for halfpel / 21x21 for h264)
-    FF_ALLOCZ_OR_GOTO(s->avctx, s->allocated_edge_emu_buffer, (s->width+64)*2*21*2, fail);
//(width + edge + align)*interlaced*MBsize*tolerance
-    s->edge_emu_buffer= s->allocated_edge_emu_buffer + (s->width+64)*2*21;
+    FF_ALLOCZ_OR_GOTO(s->avctx, s->allocated_edge_emu_buffer, (s->width+64)*2*21*2*2, fail);
//(width + edge + align)*interlaced*MBsize*tolerance
+    s->edge_emu_buffer= s->allocated_edge_emu_buffer + (s->width+64)*2*21*2;

      //FIXME should be linesize instead of s->width*2 but that is not known before get_buffer()
(Continue reading)

Michael Niedermayer | 1 Oct 01:24 2011

swr: minor fixes to get planar audio working

ffmpeg | branch: master | Michael Niedermayer <michaelni <at> gmx.at> | Thu Sep 29 04:53:50 2011 +0200|
[a75b254c74d71414f15764979e718e74cd90f5aa] | committer: Michael Niedermayer

swr: minor fixes to get planar audio working

Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a75b254c74d71414f15764979e718e74cd90f5aa
---

 libswresample/swresample.c |   32 ++++++++++++++++++++++----------
 1 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/libswresample/swresample.c b/libswresample/swresample.c
index 20a1e64..519cadf 100644
--- a/libswresample/swresample.c
+++ b/libswresample/swresample.c
 <at>  <at>  -39,10 +39,10  <at>  <at>  static const AVOption options[]={
 {"och", "output channel count", OFFSET(out.ch_count   ), FF_OPT_TYPE_INT, {.dbl=2}, 1, SWR_CH_MAX, 0},
 {"isr",  "input sample rate"  , OFFSET( in_sample_rate), FF_OPT_TYPE_INT, {.dbl=48000}, 1, INT_MAX, 0},
 {"osr", "output sample rate"  , OFFSET(out_sample_rate), FF_OPT_TYPE_INT, {.dbl=48000}, 1, INT_MAX, 0},
-{"ip" ,  "input planar"       , OFFSET( in.planar     ), FF_OPT_TYPE_INT, {.dbl=0},    0,       1, 0},
-{"op" , "output planar"       , OFFSET(out.planar     ), FF_OPT_TYPE_INT, {.dbl=0},    0,       1, 0},
-{"isf",  "input sample format", OFFSET( in_sample_fmt ), FF_OPT_TYPE_INT,
{.dbl=AV_SAMPLE_FMT_S16}, 0, AV_SAMPLE_FMT_NB-1, 0},
-{"osf", "output sample format", OFFSET(out_sample_fmt ), FF_OPT_TYPE_INT,
{.dbl=AV_SAMPLE_FMT_S16}, 0, AV_SAMPLE_FMT_NB-1, 0},
+//{"ip" ,  "input planar"       , OFFSET( in.planar     ), FF_OPT_TYPE_INT, {.dbl=0},    0,       1, 0},
+//{"op" , "output planar"       , OFFSET(out.planar     ), FF_OPT_TYPE_INT, {.dbl=0},    0,       1, 0},
+{"isf",  "input sample format", OFFSET( in_sample_fmt ), FF_OPT_TYPE_INT,
(Continue reading)

Michael Niedermayer | 1 Oct 01:24 2011

swr_test: test planar audio

ffmpeg | branch: master | Michael Niedermayer <michaelni <at> gmx.at> | Thu Sep 29 04:55:53 2011 +0200|
[17d51938d23c5f60f1ae0f4944724944c1b9dfdd] | committer: Michael Niedermayer

swr_test: test planar audio

Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=17d51938d23c5f60f1ae0f4944724944c1b9dfdd
---

 libswresample/swresample_test.c |   61 +++++++++++++++++++++++++++++++-------
 1 files changed, 49 insertions(+), 12 deletions(-)

diff --git a/libswresample/swresample_test.c b/libswresample/swresample_test.c
index e8683cd..61e1b09 100644
--- a/libswresample/swresample_test.c
+++ b/libswresample/swresample_test.c
 <at>  <at>  -28,7 +28,16  <at>  <at> 

 #define ASSERT_LEVEL 2

-static double get(const void *p, int index, enum AVSampleFormat f){
+static double get(const uint8_t *a[], int ch, int index, int ch_count, enum AVSampleFormat f){
+    const uint8_t *p;
+    if(f>=0x100){
+        f&=0xFF;
+        p= a[ch];
+    }else{
+        p= a[0];
+        index= ch + index*ch_count;
(Continue reading)

Michael Niedermayer | 1 Oct 01:51 2011

oggenc: favor av_freep()

ffmpeg | branch: master | Michael Niedermayer <michaelni <at> gmx.at> | Sat Oct  1 01:26:55 2011 +0200|
[3b6c0ba382cc261b81f1451366e56a7878d4919a] | committer: Michael Niedermayer

oggenc: favor av_freep()

Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3b6c0ba382cc261b81f1451366e56a7878d4919a
---

 libavformat/oggenc.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavformat/oggenc.c b/libavformat/oggenc.c
index 21b3501..a527ab3 100644
--- a/libavformat/oggenc.c
+++ b/libavformat/oggenc.c
 <at>  <at>  -516,11 +516,11  <at>  <at>  static int ogg_write_trailer(AVFormatContext *s)
         OGGStreamContext *oggstream = st->priv_data;
         if (st->codec->codec_id == CODEC_ID_FLAC ||
             st->codec->codec_id == CODEC_ID_SPEEX) {
-            av_free(oggstream->header[0]);
-            av_free(oggstream->header[1]);
+            av_freep(&oggstream->header[0]);
+            av_freep(&oggstream->header[1]);
         }
         else
-            av_free(oggstream->header[1]);
+            av_freep(&oggstream->header[1]);
         av_freep(&st->priv_data);
(Continue reading)

Michael Niedermayer | 1 Oct 01:51 2011

avformat_free_context: favor av_freep()

ffmpeg | branch: master | Michael Niedermayer <michaelni <at> gmx.at> | Sat Oct  1 01:29:30 2011 +0200|
[2a93f28a4b6eef8b93046e0b4e3225f2ff1e7324] | committer: Michael Niedermayer

avformat_free_context: favor av_freep()

Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2a93f28a4b6eef8b93046e0b4e3225f2ff1e7324
---

 libavformat/utils.c |   16 ++++++++--------
 1 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/libavformat/utils.c b/libavformat/utils.c
index 0d88991..93a3f69 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
 <at>  <at>  -2713,13 +2713,13  <at>  <at>  void avformat_free_context(AVFormatContext *s)
             av_free_packet(&st->cur_pkt);
         }
         av_dict_free(&st->metadata);
-        av_free(st->index_entries);
-        av_free(st->codec->extradata);
-        av_free(st->codec->subtitle_header);
-        av_free(st->codec);
-        av_free(st->priv_data);
-        av_free(st->info);
-        av_free(st);
+        av_freep(&st->index_entries);
+        av_freep(&st->codec->extradata);
(Continue reading)

Michael Niedermayer | 1 Oct 01:51 2011

swresample: check for invalid sample formats.

ffmpeg | branch: master | Michael Niedermayer <michaelni <at> gmx.at> | Sat Oct  1 01:39:17 2011 +0200|
[834b3760a7ca112573e813bd6c3573a8c0daf4ed] | committer: Michael Niedermayer

swresample: check for invalid sample formats.

Bug-Found-by: Justin Ruggles
Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=834b3760a7ca112573e813bd6c3573a8c0daf4ed
---

 libswresample/swresample.c |   10 +++++++++-
 1 files changed, 9 insertions(+), 1 deletions(-)

diff --git a/libswresample/swresample.c b/libswresample/swresample.c
index 519cadf..7276c7a 100644
--- a/libswresample/swresample.c
+++ b/libswresample/swresample.c
 <at>  <at>  -144,7 +144,15  <at>  <at>  int swr_init(SwrContext *s){
     s-> in_sample_fmt &= 0xFF;
     s->out_sample_fmt &= 0xFF;

-    //We assume AVOptions checked the various values and the defaults where allowed
+    if(s-> in_sample_fmt >= AV_SAMPLE_FMT_NB){
+        av_log(s, AV_LOG_ERROR, "Requested sample format %s is invalid\n", av_get_sample_fmt_name(s->in_sample_fmt));
+        return AVERROR(EINVAL);
+    }
+    if(s->out_sample_fmt >= AV_SAMPLE_FMT_NB){
+        av_log(s, AV_LOG_ERROR, "Requested sample format %s is invalid\n", av_get_sample_fmt_name(s->out_sample_fmt));
+        return AVERROR(EINVAL);
(Continue reading)

Laurent Aimar | 1 Oct 02:42 2011

Check for corrupted data in avs demuxer.

ffmpeg | branch: master | Laurent Aimar <fenrir <at> videolan.org> | Sat Oct  1 00:44:54 2011 +0200|
[1cce7def0a8eff2e7db294b7d195a0fb1a5043b0] | committer: Michael Niedermayer

Check for corrupted data in avs demuxer.

Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1cce7def0a8eff2e7db294b7d195a0fb1a5043b0
---

 libavformat/avs.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/libavformat/avs.c b/libavformat/avs.c
index 89b2642..7b90f85 100644
--- a/libavformat/avs.c
+++ b/libavformat/avs.c
 <at>  <at>  -163,6 +163,8  <at>  <at>  static int avs_read_packet(AVFormatContext * s, AVPacket * pkt)
             sub_type = avio_r8(s->pb);
             type = avio_r8(s->pb);
             size = avio_rl16(s->pb);
+            if (size < 4)
+                return AVERROR_INVALIDDATA;
             avs->remaining_frame_size -= size;

             switch (type) {
Laurent Aimar | 1 Oct 02:42 2011

Fix potential pointer arithmetic overflows in the Electronic Arts CMV decoder .

ffmpeg | branch: master | Laurent Aimar <fenrir <at> videolan.org> | Sat Oct  1 00:44:59 2011 +0200|
[e9064c9ce8ed18c3a3aab61e58e663b8f5b0c551] | committer: Michael Niedermayer

Fix potential pointer arithmetic overflows in the Electronic Arts CMV decoder.

Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e9064c9ce8ed18c3a3aab61e58e663b8f5b0c551
---

 libavcodec/eacmv.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavcodec/eacmv.c b/libavcodec/eacmv.c
index 76de9c9..a084106 100644
--- a/libavcodec/eacmv.c
+++ b/libavcodec/eacmv.c
 <at>  <at>  -56,7 +56,7  <at>  <at>  static void cmv_decode_intra(CmvContext * s, const uint8_t *buf, const uint8_t *
     unsigned char *dst = s->frame.data[0];
     int i;

-    for (i=0; i < s->avctx->height && buf+s->avctx->width<=buf_end; i++) {
+    for (i=0; i < s->avctx->height && buf_end - buf >= s->avctx->width; i++) {
         memcpy(dst, buf, s->avctx->width);
         dst += s->frame.linesize[0];
         buf += s->avctx->width;
 <at>  <at>  -88,7 +88,7  <at>  <at>  static void cmv_decode_inter(CmvContext * s, const uint8_t *buf, const uint8_t *

     i = 0;
     for(y=0; y<s->avctx->height/4; y++)
(Continue reading)

Laurent Aimar | 1 Oct 02:42 2011

Check for out of bound reads in the Electronic Arts CMV decoder.

ffmpeg | branch: master | Laurent Aimar <fenrir <at> videolan.org> | Sat Oct  1 00:45:01 2011 +0200|
[a5d46235f3f70f0b620f8e54649ece45ecc5b170] | committer: Michael Niedermayer

Check for out of bound reads in the Electronic Arts CMV decoder.

Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a5d46235f3f70f0b620f8e54649ece45ecc5b170
---

 libavcodec/eacmv.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/libavcodec/eacmv.c b/libavcodec/eacmv.c
index 3ac9cda..20ec0a2 100644
--- a/libavcodec/eacmv.c
+++ b/libavcodec/eacmv.c
 <at>  <at>  -158,6 +158,9  <at>  <at>  static int cmv_decode_frame(AVCodecContext *avctx,
     CmvContext *s = avctx->priv_data;
     const uint8_t *buf_end = buf + buf_size;

+    if (buf_end - buf < EA_PREAMBLE_SIZE)
+        return AVERROR_INVALIDDATA;
+
     if (AV_RL32(buf)==MVIh_TAG||AV_RB32(buf)==MVIh_TAG) {
         cmv_process_header(s, buf+EA_PREAMBLE_SIZE, buf_end);
         return buf_size;
Laurent Aimar | 1 Oct 02:42 2011

Fix out of bound reads due to integer overflow in the ADPCM IMA Electronic Arts EACS decoder .

ffmpeg | branch: master | Laurent Aimar <fenrir <at> videolan.org> | Sat Oct  1 00:45:02 2011 +0200|
[346876ec168affe7c21be88d8f1acf1a75cc8409] | committer: Michael Niedermayer

Fix out of bound reads due to integer overflow in the ADPCM IMA Electronic Arts EACS decoder.

Signed-off-by: Michael Niedermayer <michaelni <at> gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=346876ec168affe7c21be88d8f1acf1a75cc8409
---

 libavcodec/adpcm.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c
index 3cb62e3..cf609e7 100644
--- a/libavcodec/adpcm.c
+++ b/libavcodec/adpcm.c
 <at>  <at>  -641,10 +641,11  <at>  <at>  static int adpcm_decode_frame(AVCodecContext *avctx,
             buf_size -= 128;
         }
         break;
-    case CODEC_ID_ADPCM_IMA_EA_EACS:
+    case CODEC_ID_ADPCM_IMA_EA_EACS: {
+        unsigned header_size = 4 + (8<<st);
         samples_in_chunk = bytestream_get_le32(&src) >> (1-st);

-        if (samples_in_chunk > buf_size-4-(8<<st)) {
+        if (buf_size < header_size || samples_in_chunk > buf_size - header_size) {
             src += buf_size - 4;
             break;
(Continue reading)


Gmane