* commit 'ff07ec143ebd3833fd5a3f4b6c00474ac523a31f':
pcx: Return an error on broken palette if err_detect is set to 'explode'
Conflicts:
libavcodec/pcx.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'd1d99e3befea5d411ac3aae72dbdecce94f8b547':
pcx: Check the packet size before assuming it fits a palette
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'fc739b3eefa0b58d64e7661621da94a94dbc8a82':
xan: Only read within the data that actually was initialized
Conflicts:
libavcodec/xan.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '30db94dc399f6e4ef8905049d9b740556f0fce47':
xan: Use bytestream2 to limit reading to within the buffer
Conflicts:
libavcodec/xan.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '9fb0de86b49e9fb0709a8ad1e1875e35da841887':
pcx: Consume the whole packet if giving up due to missing palette
Conflicts:
libavcodec/pcx.c
See: b4e516e30e
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '59480abce7e4238e22b3a4a904a9fe6abf4e4188':
alac: Do bounds checking of lpc_order read from the bitstream
See: fd4f4923cc
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This fixes reads out of bounds.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
We read 2 bytes for 15 out of 16 pixels, therefore we need to
have at least 30 bytes, not 16.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
Decoded data is always written in pairs within this decoder.
This fixes writes out of bounds.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
Previously, we returned 0, meaning successful decoding but 0
bytes consumed, leading to an infinite loop.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
If the input buffer contains more data after the deflate stream,
the loop previously left running infinitely, with inflate returning
Z_STREAM_END.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
In lpc_prediction(), we write up to array element 'lpc_order' in
an array allocated to hold 'max_samples_per_frame' elements.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
The le argument is passed so the function has the same prototype as the
other similar functions. It is otherwise unused
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This allows supporting files for which the image stride is smaller than
the max. block size + number of subpel mc taps, e.g. a 64x64 VP9 file
or a 16x16 VP8 file with -fflags +emu_edge.
The only use case of it was the selftest code, and there the slightly more
complex indexing that is needed after its removial doesnt matter.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'cab8c5f8e140c96ba3725ab709d823abfd1e31a5':
h264: do not reinitialize the global cabac tables at each slice header
See: 1e2e2c8095
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Michael Niedermayer
Martin Storsjö
Ronald S. Bultje
Michael Bradshaw
Paul B Mahol
Kostya Shishkov
Anton Khirnov