4 years agoindeo2data: K&R formatting cosmetics
Luca Barbato [Tue, 23 Feb 2016 00:58:18 +0000 (19:58 -0500)]
indeo2data: K&R formatting cosmetics

Signed-off-by: Vittorio Giovara <>
Signed-off-by: Diego Biurrun <>
(cherry picked from commit d4066a702407352a0648af882c34ea81a404fa2b)

Signed-off-by: Sean McGovern <>
4 years agopgssub: Fix subpicture colorspace and range
Jan Ekström [Sun, 24 Apr 2016 18:33:45 +0000 (20:33 +0200)]
pgssub: Fix subpicture colorspace and range

Widen the values from limited to full range and use BT.709 where it
should be used according to the video resolution:

SD is BT.601, HD is BT.709

Default to BT.709 due to most observed HDMV content being HD.

Signed-off-by: Sean McGovern <>
4 years agocolorspace: Add support for BT709
Jan Ekström [Sun, 24 Apr 2016 18:30:06 +0000 (20:30 +0200)]
colorspace: Add support for BT709

BT.709 coefficients were gathered from the first two parts of BT.709
to BT.2020 conversion guide in ARIB STD-B62 (Pt. 1, Chapter 6.2.2).
They were additionally confirmed by manually calculating values.

Signed-off-by: Sean McGovern <>
4 years agocmdutils: update copyright year to 2016
Sean McGovern [Sat, 12 Mar 2016 19:38:10 +0000 (14:38 -0500)]
cmdutils: update copyright year to 2016

Signed-off-by: Luca Barbato <>
4 years agoavpacket: fix setting in av_packet_ref()
Anton Khirnov [Thu, 12 May 2016 13:34:58 +0000 (15:34 +0200)]
avpacket: fix setting in av_packet_ref()

The data field does not necessarily point to the beginning of the
underlying AVBuffer.

(cherry picked from commit 8996515b137f962e3a8691241c285c96437b6c53)
Signed-off-by: Anton Khirnov <>
4 years agoavpacket: Check buffer reference
Vittorio Giovara [Mon, 2 Feb 2015 19:53:51 +0000 (20:53 +0100)]
avpacket: Check buffer reference

Bug-Id: CID 1267889
(cherry picked from commit fe0f4e56577a2dbd373bb50b0ae2d49e69d822fc)
Signed-off-by: Anton Khirnov <>
4 years agotls: Use the right return value for breaking out due to the interrupt callback
Martin Storsjö [Thu, 24 Mar 2016 09:27:49 +0000 (11:27 +0200)]
tls: Use the right return value for breaking out due to the interrupt callback

The retry_transfer_wrapper function higher up in the call chain
ignores AVERROR(EINTR), which only means "interrupted by system call".

This makes sure that returning due to the interrupt callback
works as intended.

Signed-off-by: Martin Storsjö <>
4 years agovf_fade: make sure the slice end is always in the frame
Anton Khirnov [Thu, 24 Mar 2016 20:38:54 +0000 (21:38 +0100)]
vf_fade: make sure the slice end is always in the frame

(cherry picked from commit a638e9184d63e57e67901f34afe919fd56fd3ac4)
Signed-off-by: Anton Khirnov <>
4 years agoasfenc: fix some possible integer overflows
Anton Khirnov [Fri, 4 Mar 2016 15:32:07 +0000 (16:32 +0100)]
asfenc: fix some possible integer overflows

Store the file duration in the same timebase it arrives (i.e.
milliseconds) and only convert it to the file duration units (100ns)
when it's actually written, thus simplifying some calculations. Also,
store the duration as unsigned, since it cannot be negative.

Bug-ID: CVE-2016-2326
(cherry picked from commit ff3db937ef3aa30046a3936146f86ad48ee2ff90)
Signed-off-by: Anton Khirnov <>

4 years agoUpdate changelog for v11.5 and v11.6 v11.6
Sean McGovern [Fri, 26 Feb 2016 22:46:44 +0000 (17:46 -0500)]
Update changelog for v11.5 and v11.6

Signed-off-by: Vittorio Giovara <>
4 years agoconcat: disable by default
Sean McGovern [Thu, 18 Feb 2016 23:51:12 +0000 (18:51 -0500)]
concat: disable by default

It is a known security issue.

Also, issue a Big Fat Warning if the user explicity requests it.

Original patch by Luca Barbato <>

4 years agoconfigure: add --enable-rpath
Reinhard Tartler [Sat, 23 Aug 2014 14:04:26 +0000 (10:04 -0400)]
configure: add --enable-rpath

This option facilitates testing shared libarary builds: for instance
fate builders do no longer need to set LD_LIBRARY_PATH as the binaries will
get the right search paths hardcoded into their executable file.

This option is only meant to be used for testing purposes: The installed
libraries must not move around in the file system, and doing so will
cause a lot of subtle problems. For more information why using RPATH is
dangerous, please refer to

(cherry picked from commit 749b1f1359b5af0a08221923b016551b18ab6171)
Signed-off-by: Diego Biurrun <>
4 years agomatroska: Always consider S_TEXT/UTF8 as SRT when demuxing v11.5
Luca Barbato [Fri, 19 Feb 2016 12:49:43 +0000 (13:49 +0100)]
matroska: Always consider S_TEXT/UTF8 as SRT when demuxing

Reported-By: Maxim Koitsov <>
4 years agomkv: Force the full parsing of mp3
Luca Barbato [Sat, 6 Feb 2016 12:15:37 +0000 (13:15 +0100)]
mkv: Force the full parsing of mp3

Some muxer might or might not fit incomplete mp3 frames in
their packets.

Signed-off-by: Luca Barbato <>
4 years agomov: Force the full parsing of mp3
Luca Barbato [Sat, 6 Feb 2016 12:15:36 +0000 (13:15 +0100)]
mov: Force the full parsing of mp3

Some muxer might or might not fit incomplete mp3 frames in
their packets.

Bug-Id: 899

Signed-off-by: Luca Barbato <>
4 years agoUpdate changelog for v11.5
Sean McGovern [Sun, 7 Feb 2016 21:43:42 +0000 (16:43 -0500)]
Update changelog for v11.5

4 years agomov: Use the correct type for size
Luca Barbato [Tue, 9 Feb 2016 22:07:18 +0000 (23:07 +0100)]
mov: Use the correct type for size

An AVIO offset is int64_t.

Bug-Id: 921

4 years agoavi: Validate the stream-id for DV as well
Michael Niedermayer [Sat, 28 Nov 2015 20:06:45 +0000 (21:06 +0100)]
avi: Validate the stream-id for DV as well

Avoid false positives while syncing.

Bug-Id: ffmpeg/4086
Bug-Id: 879

Signed-off-by: Michael Niedermayer <>
Signed-off-by: Luca Barbato <>
4 years agodvdsubdec: Validate the RLE offsets
Luca Barbato [Wed, 11 Nov 2015 19:08:29 +0000 (20:08 +0100)]
dvdsubdec: Validate the RLE offsets

4 years agorpza: Check the blocks left before processing one
Luca Barbato [Sun, 1 Nov 2015 03:07:42 +0000 (04:07 +0100)]
rpza: Check the blocks left before processing one

Bug-Id: 903
Reported-By: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <>
4 years agolagarith: Correctly compute hash_shift
Luca Barbato [Sun, 1 Nov 2015 13:46:17 +0000 (14:46 +0100)]
lagarith: Correctly compute hash_shift

All the values are unsigned.

Bug-Id: 907
Signed-off-by: Luca Barbato <>
4 years agomsnwc_tcp: Correctly report failure
Luca Barbato [Sun, 1 Nov 2015 03:07:43 +0000 (04:07 +0100)]
msnwc_tcp: Correctly report failure

And prevent a memory leak

Signed-off-by: Luca Barbato <>
4 years agomimic: Always return on failure
Luca Barbato [Sun, 1 Nov 2015 03:07:46 +0000 (04:07 +0100)]
mimic: Always return on failure

Bug-Id: 905
Signed-off-by: Luca Barbato <>
4 years agoflashsv: Initialize the block array
Luca Barbato [Sun, 1 Nov 2015 03:07:48 +0000 (04:07 +0100)]
flashsv: Initialize the block array

Otherwise flashsv2_prime could be fed random data.

Bug-Id: 908
Signed-off-by: Luca Barbato <>
4 years agotruemotion2: Fix the buffer check
Luca Barbato [Sun, 1 Nov 2015 03:07:47 +0000 (04:07 +0100)]
truemotion2: Fix the buffer check

The variable skip contains the expected size in bytes.

Bug-Id: 906
Signed-off-by: Luca Barbato <>
4 years agonut: Use the correct codec_tag when multiple are available
Luca Barbato [Thu, 3 Sep 2015 15:31:14 +0000 (17:31 +0200)]
nut: Use the correct codec_tag when multiple are available

Some codecs use the codec_tag to signal specific information and
picking the first one would lead to a broken file.

Bug-Id: 883
Signed-off-by: Luca Barbato <>
4 years agoopus: Buffer the samples from the correct offset
Michael Niedermayer [Tue, 27 Oct 2015 12:47:12 +0000 (13:47 +0100)]
opus: Buffer the samples from the correct offset

When not all the opus stream have the same amount of decoded samples
process the least amount and store what is left from the other streams.

Bug-Id: 909
Signed-off-by: Michael Niedermayer <>
Signed-off-by: Luca Barbato <>
4 years agommvideo: Make sure the rle does not write over the frame boundaries
Luca Barbato [Thu, 10 Sep 2015 12:46:05 +0000 (14:46 +0200)]
mmvideo: Make sure the rle does not write over the frame boundaries

Bug-Id: 887
4 years agofile: properly forward errors from file_read() and file_write()
Sean McGovern [Thu, 27 Aug 2015 04:04:15 +0000 (00:04 -0400)]
file: properly forward errors from file_read() and file_write()

Bug-Id: 881

Signed-off-by: Luca Barbato <>
4 years agomux: Make sure that the data is actually written
Sean McGovern [Thu, 27 Aug 2015 04:04:16 +0000 (00:04 -0400)]
mux: Make sure that the data is actually written

And forward the error if it is not.

Bug-Id: 881

Signed-off-by: Luca Barbato <>
4 years agoimgutils: Fix a typo in avcodec_get_pix_fmt_loss
Luca Barbato [Tue, 18 Aug 2015 14:18:30 +0000 (16:18 +0200)]
imgutils: Fix a typo in avcodec_get_pix_fmt_loss

If the candidate does not have alpha and the source does have alpha
report the loss of alpha.

4 years agovp7: bound checking in vp7_decode_frame_header
Federico Tomassetti [Thu, 13 Aug 2015 13:35:53 +0000 (15:35 +0200)]
vp7: bound checking in vp7_decode_frame_header

4 years agoconfigure: arm: Assume softfp ABI on darwin
Martin Storsjö [Fri, 14 Aug 2015 06:47:21 +0000 (09:47 +0300)]
configure: arm: Assume softfp ABI on darwin

Don't try to detect the float ABI by checking at the toolchain
name or by trying to assemble and link files with eabi_attributes.

This fixes the float ABI detection when building using clang
with -fembed-bitcode, where the current eabi_attributes check
accidentally passes.

This issue was pointed out by James Howe <>.

Signed-off-by: Martin Storsjö <>
4 years agortsp: Allow $ as interleaved packet indicator before a complete response header
Martin Storsjö [Wed, 21 Oct 2015 08:56:36 +0000 (11:56 +0300)]
rtsp: Allow $ as interleaved packet indicator before a complete response header

Some RTSP servers ("HiIpcam/V100R003 VodServer/1.0.0") respond to
our keepalive GET_PARAMETER request by a truncated RTSP header
(lacking the final empty line to indicate a complete response
header). Prior to 764ec70149, this worked just fine since we
reacted to the $ as interleaved packet indicator anywhere.

Since $ is a valid character within the response header lines,
764ec70149 changed it to be ignored there. But to keep
compatibility with such broken servers, we need to at least
allow reacting to it at the start of lines.

Signed-off-by: Martin Storsjö <>
4 years agortsp: Only interpret $ as interleaved packet indicator at the start of replies
Martin Storsjö [Wed, 21 Jan 2015 12:05:43 +0000 (13:05 +0100)]
rtsp: Only interpret $ as interleaved packet indicator at the start of replies

Allow $ as character anywhere within normal RTSP replies - both
within the lines, and as the first character of RTSP header lines.
(The existing old comment indicated that an inline packet could
start at any line within a RTSP reply header, but that doesn't
sound valid to me, and I'm not sure if the existing code
handled that correctly either.)

Signed-off-by: Martin Storsjö <>
4 years agoaf_channelmap: properly set the supported output channel layouts
Anton Khirnov [Wed, 22 Jul 2015 09:30:37 +0000 (11:30 +0200)]
af_channelmap: properly set the supported output channel layouts

The current code expects query_formats() to be called exactly once, it
will leak if it's not called at all (filter initialized, but never
configured or used) or try to read freed memory if it's called more than

Found-by: James Almer <>
4 years agoarm: use a local label instead of the function symbol in ff_prefetch_arm
Janne Grunau [Mon, 20 Jul 2015 08:46:15 +0000 (10:46 +0200)]
arm: use a local label instead of the function symbol in ff_prefetch_arm

Avoids a relocation which might end out of range for thumb2.

Reported-By: Ludovic Fauvet <>
4 years agobytestream2: set the reader to the end when reading more than available
Anton Khirnov [Fri, 10 Jul 2015 07:31:24 +0000 (09:31 +0200)]
bytestream2: set the reader to the end when reading more than available

This prevents possible infinite loops with the calling code along the
lines of while (bytestream2_get_bytes_left()) { ... }, where the reader
does not advance.

4 years agog726: Do not crash on user mistake
Luca Barbato [Sat, 11 Jul 2015 09:47:13 +0000 (11:47 +0200)]
g726: Do not crash on user mistake

Properly report the sample rate as invalid

4 years agoavconv: vda: Unlock the pixel buffer once it is accessed
Sebastien Zwickert [Wed, 8 Jul 2015 18:23:37 +0000 (20:23 +0200)]
avconv: vda: Unlock the pixel buffer once it is accessed

Avoid possible issues with memmapped hardware buffers in
case VDA is not doing a conversion on behalf of the user
and make the code more proper as working example.

Signed-off-by: Luca Barbato <>
4 years agoh261: Signal freeze picture release for intra frames
Stian Selnes [Tue, 2 Dec 2014 17:55:13 +0000 (18:55 +0100)]
h261: Signal freeze picture release for intra frames

Freeze picture release should be set to 1 when we're responding to a
fast update request. For simplicity we set it for all intra frames,
including those that starts a GOP.

Fixes issue where Tandberg MXP1700 does not recover from packet loss
state since it's waiting for the freeze picture relase indication.

Bug-Id: 873
Signed-off-by: Luca Barbato <>
4 years agoh261: Set 'still image mode off' in picture header
Stian Selnes [Fri, 12 Dec 2014 15:08:19 +0000 (16:08 +0100)]
h261: Set 'still image mode off' in picture header

Ref H.261 recommendation section, setting the still image flag
to 1 disables still image mode. Some decoders require this in order to
decode the bitstream as normal video.

Fixes H.261 calls to Cisco E20.

Also, reserved (aka spare) bits should be set to 1 unless specified

Bug-Id: 872
Signed-off-by: Luca Barbato <>
4 years agowebp: Make sure enough bytes are available
Andreas Cadhalpun [Thu, 2 Jul 2015 23:14:51 +0000 (01:14 +0200)]
webp: Make sure enough bytes are available

Every chunk needs at least 8 bytes for chunk_type and chunk_size.
Prevent a possible infinite loop.

Signed-off-by: Luca Barbato <>
4 years agomov: Preserve the metadata even when bit-exactness is requested
Luca Barbato [Mon, 15 Jun 2015 18:40:46 +0000 (20:40 +0200)]
mov: Preserve the metadata even when bit-exactness is requested

Make sure to not write the custom `encoder` string in that case.

Bug-Id: 845
4 years agoaic: Fix slice size computation for widths multiples of 32 macroblocks
Vittorio Giovara [Sun, 28 Jun 2015 08:50:42 +0000 (10:50 +0200)]
aic: Fix slice size computation for widths multiples of 32 macroblocks

4 years agoh264: make sure the current picture is not made a long ref multiple times
Anton Khirnov [Fri, 8 May 2015 17:07:10 +0000 (19:07 +0200)]
h264: make sure the current picture is not made a long ref multiple times

Fixes possible invalid reads, once one of those refs is freed, but the
others remain.
4 years agolavc: Clarify the behaviour of dimension and format context fields
Luca Barbato [Sun, 14 Jun 2015 09:45:54 +0000 (11:45 +0200)]
lavc: Clarify the behaviour of dimension and format context fields

The AVCodecContext width, height, coded_width, coded_height and format
are used mainly as decoding hints and they get internally overwritten
during the data parsing stage.

Do not assume they match the last AVFrame provided by
avcodec_decode_video2 and assimilated functions since multi-threading
and other frame reordering might make those values to refer to frames
that will be outputted in the future.

4 years agoh264_weight: Fix SSSE3 biweight code with weights of 128
Michael Niedermayer [Fri, 12 Jun 2015 11:58:42 +0000 (12:58 +0100)]
h264_weight: Fix SSSE3 biweight code with weights of 128

Sample-Id: test_bref.mp4

Signed-off-by: Vittorio Giovara <>
4 years agomkv: Correctly report the latest packet had been flushed
Luca Barbato [Tue, 9 Jun 2015 08:47:11 +0000 (10:47 +0200)]
mkv: Correctly report the latest packet had been flushed

Bug-Id: 865
4 years agosctp: Always initialize outmsg struct
Vittorio Giovara [Wed, 3 Jun 2015 13:16:45 +0000 (14:16 +0100)]
sctp: Always initialize outmsg struct

Bug-Id: CID 1302711

4 years agoaudiointerleave: Always initialize new_pkt
Vittorio Giovara [Wed, 3 Jun 2015 13:16:47 +0000 (14:16 +0100)]
audiointerleave: Always initialize new_pkt

Bug-Id: CID 609333

4 years agomov: Check memory allocation
Vittorio Giovara [Wed, 3 Jun 2015 13:16:49 +0000 (14:16 +0100)]
mov: Check memory allocation

Bug-Id: CID 1292518

4 years agojack: Check memory allocation
Vittorio Giovara [Wed, 3 Jun 2015 13:16:48 +0000 (14:16 +0100)]
jack: Check memory allocation

Bug-Id: CID 1292520

4 years agortpdec_asf: Check memory allocation and free memory on error
Vittorio Giovara [Wed, 3 Jun 2015 13:16:50 +0000 (14:16 +0100)]
rtpdec_asf: Check memory allocation and free memory on error

Bug-Id: CID 1257774

4 years agoconfigure: Support MSVC 2015
Luca Barbato [Fri, 5 Jun 2015 13:07:06 +0000 (15:07 +0200)]
configure: Support MSVC 2015

The C runtime C99 compatibility had been improved a lot and it now
rejects some of the compatibility defines provided for the older

Many thanks to Ray for the time spent testing.

Bug-Id: 864
4 years agoaac: Wait to know the channels before allocating frame
Luca Barbato [Thu, 4 Jun 2015 08:19:50 +0000 (10:19 +0200)]
aac: Wait to know the channels before allocating frame

The channel configuration can be delivered only by the PCE,
try to parse it first and not try to decode until a channel
configuration is set.

4 years agobink: Factorize bink put_pixel
Luca Barbato [Wed, 3 Jun 2015 00:09:31 +0000 (02:09 +0200)]
bink: Factorize bink put_pixel

And make sure to check INTER_BLOCK as had been fixed by Michael

Reported-By: Andreas Cadhalpun
4 years agomov: Fix two memleaks
Andreas Cadhalpun [Tue, 26 May 2015 13:24:36 +0000 (14:24 +0100)]
mov: Fix two memleaks

Signed-off-by: Andreas Cadhalpun <>
Signed-off-by: Luca Barbato <>
4 years agomov: Correctly allocate ctts_data
Luca Barbato [Sun, 31 May 2015 10:28:33 +0000 (12:28 +0200)]
mov: Correctly allocate ctts_data

It can be reallocated.

5 years agortmpcrypt: Do the xtea decryption in little endian mode
Martin Storsjö [Wed, 11 Nov 2015 19:42:02 +0000 (21:42 +0200)]
rtmpcrypt: Do the xtea decryption in little endian mode

The XTEA algorithm operates on 32 bit numbers, not on byte sequences.
The XTEA implementation in libavutil is written assuming big endian
numbers, while the rtmpe signature encryption assumes little endian.

This fixes rtmpe communication with rtmpe servers that use signature
type 8 (XTEA), e.g. crunchyroll.

Signed-off-by: Martin Storsjö <>
5 years agoconfigure: address a copy-paste typo
Vicente Olivert Riera [Tue, 29 Sep 2015 16:28:33 +0000 (17:28 +0100)]
configure: address a copy-paste typo

The correct instruction for mips32r1 is addi.

Signed-off-by: Vicente Olivert Riera <>
Signed-off-by: Luca Barbato <>
5 years agovc1: Use logical instead of bitwise or for twomv
Michael Niedermayer [Sun, 21 Sep 2014 15:16:32 +0000 (16:16 +0100)]
vc1: Use logical instead of bitwise or for twomv

Signed-off-by: Michael Niedermayer <>
Signed-off-by: Tim Walker <>
(cherry picked from commit a97328afef0ccebfc8c3d9f9fdb8e93cbf1058ab)
Signed-off-by: Luca Barbato <>
5 years agomips: intreadwrite: Only execute that code for mips r1 or r2
Vicente Olivert Riera [Fri, 25 Sep 2015 06:56:25 +0000 (08:56 +0200)]
mips: intreadwrite: Only execute that code for mips r1 or r2

MIPS R6 supports unaligned memory access and does not have
the load/store-left/right family of instructions.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera at>
Signed-off-by: Luca Barbato <lu_zero at>
Signed-off-by: Luca Barbato <>
(cherry picked from commit d00bb8addccb63fa3feacb06d2a310731dc0113b)
Signed-off-by: Luca Barbato <>
5 years agoconfigure: mips: Support mips r6, r2 and r1
Luca Barbato [Fri, 25 Sep 2015 06:56:25 +0000 (08:56 +0200)]
configure: mips: Support mips r6, r2 and r1

Detect the different MIPS architecture variants.

Signed-off-by: Luca Barbato <>
(cherry picked from commit 1016a75cf3170648dc9b59fdef170cbfc142f8ad)
Signed-off-by: Luca Barbato <>
5 years agoconfigure: Set the initial ldflags to match the cflags
Luca Barbato [Fri, 25 Sep 2015 06:56:25 +0000 (08:56 +0200)]
configure: Set the initial ldflags to match the cflags

Some gcc-based toolchain would fail to link if the abi set by the
cpuflags does not match the default.

Signed-off-by: Luca Barbato <>
(cherry picked from commit 678f788fea3380e5cbbf75baac5cc0ce07a56a42)
Signed-off-by: Luca Barbato <>
5 years agoopusdec: properly handle mismatching configurations in multichannel streams
Anton Khirnov [Mon, 27 Jul 2015 09:13:53 +0000 (11:13 +0200)]
opusdec: properly handle mismatching configurations in multichannel streams

The substreams can have different resampling delays, so an additional
level of buffering is needed to synchronize them.

Bug-Id: 876

5 years agoh263: Always check both dimensions
Luca Barbato [Fri, 26 Jun 2015 13:57:16 +0000 (15:57 +0200)]
h263: Always check both dimensions

5 years agoimc: add required padding for GetBitContext buffer
Janne Grunau [Mon, 8 Jun 2015 12:48:54 +0000 (14:48 +0200)]
imc: add required padding for GetBitContext buffer

Fixes stack buffer overflow errors detected by address sanitizer in

5 years agoac3_parser: add required padding for GetBitContext buffer
Janne Grunau [Mon, 8 Jun 2015 12:48:26 +0000 (14:48 +0200)]
ac3_parser: add required padding for GetBitContext buffer

Fixes stack buffer overflow errors detected by address sanitizer in
various fate tests.

5 years agoaac_parser: add required padding for GetBitContext buffer
Janne Grunau [Mon, 8 Jun 2015 12:45:12 +0000 (14:45 +0200)]
aac_parser: add required padding for GetBitContext buffer

Fixes stack buffer overflow errors detected by address sanitizer in
various fate tests.

5 years agoUpdate changelog for v11.4 v11.4
Reinhard Tartler [Sun, 24 May 2015 08:36:42 +0000 (10:36 +0200)]
Update changelog for v11.4

5 years agoh264: Make sure reinit failures mark the context as not initialized
Luca Barbato [Mon, 25 May 2015 20:30:10 +0000 (22:30 +0200)]
h264: Make sure reinit failures mark the context as not initialized

Bug-Id: CVE-2015-3417
5 years agomsrle: Use FFABS to determine the frame size in msrle_decode_pal4
Luca Barbato [Mon, 25 May 2015 19:53:26 +0000 (21:53 +0200)]
msrle: Use FFABS to determine the frame size in msrle_decode_pal4

As done in msrle_decode_8_16_24_32.

Bug-Id: CVE-2015-3395
5 years agox86: cavs: Remove an unneeded scratch buffer
Michael Niedermayer [Thu, 28 May 2015 10:38:35 +0000 (12:38 +0200)]
x86: cavs: Remove an unneeded scratch buffer

Simplifies the code and makes it build on certain compilers
running out of registers on x86.

Reported-By: mudler
(cherry picked from commit e4610300de6869bd6b3b00e76cfeabb6d7653dcd)
Signed-off-by: Luca Barbato <>
5 years agoconfigure: Disable i686 for i586 and lower CPUs
Mikulas Patocka [Mon, 15 Sep 2014 12:11:21 +0000 (05:11 -0700)]
configure: Disable i686 for i586 and lower CPUs

5 years agomjpegenc: Fix JFIF header byte ordering
Shiina Hideaki [Thu, 7 May 2015 00:46:55 +0000 (01:46 +0100)]
mjpegenc: Fix JFIF header byte ordering

The header had a wrong version description.

Bug-Id: 808
Signed-off-by: Shiina Hideaki <>
Signed-off-by: Vittorio Giovara <>
5 years agonut: Make sure to clean up on read_header failure
Luca Barbato [Wed, 29 Apr 2015 19:29:49 +0000 (21:29 +0200)]
nut: Make sure to clean up on read_header failure

Based on Andreas Cadhalpun <> work.

5 years agopng: Set the color range as full range
wm4 [Fri, 8 May 2015 15:01:50 +0000 (17:01 +0200)]
png: Set the color range as full range

The format uses full range for the gray formats.

5 years agoavi: Validate sample_size
Andreas Cadhalpun [Wed, 6 May 2015 00:26:57 +0000 (02:26 +0200)]
avi: Validate sample_size

And either error out or set it to 0 if it is negative.

Signed-off-by: Luca Barbato <>
5 years agonut: Check chapter creation in decode_info_header
Andreas Cadhalpun [Tue, 28 Apr 2015 18:57:59 +0000 (20:57 +0200)]
nut: Check chapter creation in decode_info_header

This fixes a segmentation fault when accessing the metadata.

Signed-off-by: Luca Barbato <>
5 years agoalac: Reject rice_limit 0 if compression is used
Andreas Cadhalpun [Thu, 23 Apr 2015 22:01:43 +0000 (00:01 +0200)]
alac: Reject rice_limit 0 if compression is used

If in compression mode rice_limit = 0 leads to call
`show_bits(gb, k)` in `decode_scalar` with k = 0.

Request a sample in case it is valid and it should be accepted.

Signed-off-by: Luca Barbato <>
5 years agoape: Support _0000 files with nblock smaller than 64
Andreas Cadhalpun [Wed, 29 Apr 2015 18:39:22 +0000 (20:39 +0200)]
ape: Support _0000 files with nblock smaller than 64

The decode_array_0000 assumed that 64 is the minimal block size
while it is not.

Signed-off-by: Luca Barbato <>
5 years agomux: Do not leave stale side data pointers in ff_interleave_add_packet()
Michael Niedermayer [Fri, 1 May 2015 22:55:42 +0000 (23:55 +0100)]
mux: Do not leave stale side data pointers in ff_interleave_add_packet()

Signed-off-by: Michael Niedermayer <>
Signed-off-by: Vittorio Giovara <>
5 years agoavresample: Reallocate the internal buffer to the correct size
Luca Barbato [Mon, 27 Apr 2015 23:55:10 +0000 (01:55 +0200)]
avresample: Reallocate the internal buffer to the correct size

Fixes the corner case in which the internal buffer size
is larger than input buffer provided and resizing it
before moving the left over samples would make it write
to now unallocated memory.

Bug-Id: 825
Signed-off-by: Luca Barbato <>
5 years agompegts: Update the PSI/SI table only if the version change
John Högberg [Tue, 28 Apr 2015 08:20:33 +0000 (10:20 +0200)]
mpegts: Update the PSI/SI table only if the version change

If a PAT is finished while a PMT section filter is opened but
not yet finished, the PMT section filter is closed and all
the received data is discarded.

This is usually not an issue but some multiplexers (With very
quick PAT/PMT repetition settings) consistently emit a PMT
section start, then a PAT, and then the rest of the PMT,
causing the aforementioned behavior to result in no PMT being

In the most pathologic situation the stream information are lost
and the probe fallback miscategorizes subtitles as mp3 audio.

Avoid the issue through eliminating redundant PSI/SI table
updates by checking their version field, which is required by
the standard to be incremented on every change no matter how

Signed-off-by: Luca Barbato <>
5 years agortsp: Make sure we don't write too many transport entries into a fixed-size array
Martin Storsjö [Fri, 24 Apr 2015 09:38:09 +0000 (12:38 +0300)]
rtsp: Make sure we don't write too many transport entries into a fixed-size array

Signed-off-by: Martin Storsjö <>
5 years agortpenc_jpeg: Handle case of picture dimensions not dividing by 8
Andrey Utkin [Fri, 10 Apr 2015 21:54:10 +0000 (00:54 +0300)]
rtpenc_jpeg: Handle case of picture dimensions not dividing by 8

This fixes the calculation of the number of needed blocks to make
sure that ALL pixels are represented by the result.

Signed-off-by: Martin Storsjö <>
5 years agomov: Fix little endian audio detection
Vittorio Giovara [Fri, 13 Mar 2015 19:45:14 +0000 (19:45 +0000)]
mov: Fix little endian audio detection

Set this field to TRUE if the audio component is to operate on
little-endian data, and FALSE otherwise.

However TRUE and FALSE are not defined. Since this flag is just a boolean,
interpret all values except for 0 as little endian.


5 years agox86: Put COPY3_IF_LT under HAVE_6REGS
Luca Barbato [Mon, 16 Mar 2015 10:26:48 +0000 (11:26 +0100)]
x86: Put COPY3_IF_LT under HAVE_6REGS

It uses 6 registers, unbreaks building on hardened x86 system.

Bug-Id: gentoo/541930
5 years agoroqvideoenc: set enc->avctx in roq_encode_init
Andreas Cadhalpun [Mon, 9 Mar 2015 18:24:09 +0000 (19:24 +0100)]
roqvideoenc: set enc->avctx in roq_encode_init

So far it is only set in roq_encode_frame, but it is used in
roq_encode_end to free the coded_frame. This currently segfaults if
roq_encode_frame is not called between roq_encode_init and
Signed-off-by: Andreas Cadhalpun <>
Signed-off-by: Anton Khirnov <>
5 years agomp3: Properly use AVCodecContext API
Vittorio Giovara [Mon, 9 Mar 2015 23:02:00 +0000 (23:02 +0000)]
mp3: Properly use AVCodecContext API

Rather than having an unitialized context on the stack, allocate it with
defaults and free it when unneeded.

5 years agolibvpx: Fix mixed use of av_malloc() and av_reallocp()
Vittorio Giovara [Sun, 8 Mar 2015 21:08:16 +0000 (21:08 +0000)]
libvpx: Fix mixed use of av_malloc() and av_reallocp()

This buffer is resized when vpx_codec_get_cx_data() returns a

Signed-off-by: Vittorio Giovara <>
5 years agoRevert "lavfi: always check av_expr_parse_and_eval() return value" gitorious/release/11
Anton Khirnov [Sat, 2 May 2015 07:09:52 +0000 (09:09 +0200)]
Revert "lavfi: always check av_expr_parse_and_eval() return value"

This reverts commit 63be97ec403023fb664798432acedaf6e6922527.

All those calls were unchecked on purpose, as explained in the comments
in the code.

(cherry picked from commit 3735b5c616770429572f86aabdaec39c6ebb8818)
Signed-off-by: Anton Khirnov <>
5 years agoalsdec: only adapt order for positive max_order
Andreas Cadhalpun [Wed, 22 Apr 2015 14:03:41 +0000 (16:03 +0200)]
alsdec: only adapt order for positive max_order

For max_order = 0 the clipping range is invalid. (amin = 2, amax = 1)

Signed-off-by: Andreas Cadhalpun <>
Signed-off-by: Anton Khirnov <>
(cherry picked from commit 60f1cc4a1ffcbf24acbb543988ceeaec76b70818)
Signed-off-by: Anton Khirnov <>
5 years agoalsdec: check sample pointer range in revert_channel_correlation
Andreas Cadhalpun [Tue, 21 Apr 2015 17:28:30 +0000 (19:28 +0200)]
alsdec: check sample pointer range in revert_channel_correlation

Also change the type of begin, end and smp to ptrdiff_t to make the
comparison well-defined.

Signed-off-by: Andreas Cadhalpun <>
Signed-off-by: Anton Khirnov <>
(cherry picked from commit 94bb1ce882a12b6d7a1fa32715a68121b39ee838)
Signed-off-by: Anton Khirnov <>
5 years agoaacpsy: correct calculation of minath in psy_3gpp_init
Andreas Cadhalpun [Tue, 21 Apr 2015 16:43:55 +0000 (18:43 +0200)]
aacpsy: correct calculation of minath in psy_3gpp_init

The minimum of the ath(x, ATH_ADD) function depends on ATH_ADD.
This patch uses the first order approximation to determine it.

For ATH_ADD = 4 this results in the value at 3407.06812 (-5.24241638)
not the one at 3410 (-5.24237967).

Signed-off-by: Andreas Cadhalpun <>
Signed-off-by: Anton Khirnov <>
(cherry picked from commit 110f7f35fb615b97d983b1c6c6a714fddd28bcbe)
Signed-off-by: Anton Khirnov <>
5 years agoalsdec: limit avctx->bits_per_raw_sample to 32
Andreas Cadhalpun [Sat, 18 Apr 2015 18:29:13 +0000 (20:29 +0200)]
alsdec: limit avctx->bits_per_raw_sample to 32

avctx->bits_per_raw_sample is used in get_sbits_long, which only
supports up to 32 bits.

Signed-off-by: Andreas Cadhalpun <>
Signed-off-by: Anton Khirnov <>
(cherry picked from commit e191aaca44b986816695e3b7ecfae64697fd6631)
Signed-off-by: Anton Khirnov <>
5 years agoaasc: return correct buffer size from aasc_decode_frame
Andreas Cadhalpun [Thu, 16 Apr 2015 17:12:02 +0000 (19:12 +0200)]
aasc: return correct buffer size from aasc_decode_frame

Signed-off-by: Andreas Cadhalpun <>
Signed-off-by: Anton Khirnov <>
(cherry picked from commit 8fc8024ea56e814cd257d5fe27b21a865080782f)
Signed-off-by: Anton Khirnov <>
5 years agomatroskadec: fix crash when parsing invalid mkv
Thomas Guillem [Fri, 10 Apr 2015 17:04:51 +0000 (19:04 +0200)]
matroskadec: fix crash when parsing invalid mkv

Signed-off-by: Anton Khirnov <>
(cherry picked from commit b8d7f3186e86234f6255f5e8ee9e98573b4d9a6e)
Signed-off-by: Anton Khirnov <>
5 years agoavconv: do not overwrite the stream codec context for streamcopy
Anton Khirnov [Thu, 2 Apr 2015 04:09:05 +0000 (06:09 +0200)]
avconv: do not overwrite the stream codec context for streamcopy

Since we are not doing encoding, there is no point in ever touching the
separate encoding context. Always use the stream codec context.

Fixes writing attachments.
(cherry picked from commit 3892bdab9b652eb003ab95e167f1765e0b0ea035)
Signed-off-by: Anton Khirnov <>