The decoder assumes in various places that the image size
is a multiple of the block size, and there is no obvious
way to support odd sizes. Bailing out early if the header
specifies a bad size avoids various errors later on.
Fixes CVE-2012-0947.
Signed-off-by: Mans Rullgard <mans@mansr.com>
* qatar/master:
mpeg12: fixed parsing in some mpeg2 streams
Add SMPTE240M transfer characteristics flag.
mpegts: Some additional HDMV types and reg descriptors for mpegts
motionpixels: Clip YUV values after applying a gradient.
jpeg: handle progressive in second field of interlaced.
ituh263dec: Implement enough of Annex O (scalability) to fix a FPE.
h263: more strictly forbid frame size changes with frame-mt.
h264: additional protection against unsupported size/bitdepth changes.
tta: prevents overflows for 32bit integers in header.
configure: remove malloc_aligned.
vp8: update frame size changes on thread context switches.
snowdsp: explicitily state instruction size.
wmall: fix reconstructing audio with uncoded channels
WMAL cosmetics: fix indentation
gitignore: add Win32 library suffixes
Conflicts:
configure
libavcodec/h263dec.c
libavcodec/h264.c
libavcodec/ituh263dec.c
libavcodec/mjpegdec.c
libavcodec/wmalosslessdec.c
libavcodec/x86/snowdsp_mmx.c
libavformat/mpegts.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Compared to av_opt_ptr, accessors bring:
- better performance (negligible);
- compile-time type check;
- link-time existence check
(or at worst, a dynamic linker error instead of a NULL dereference).
The option is related to the timecode, the new name clearly specifies the
context. Also it allows to list the option close to the other timecode
options.
* qatar/master:
arm: intreadwrite: disable inline asm for gcc 4.7 and later
arm: intreadwrite: fix inline asm constraints for gcc 4.6 and later
indeo3: fix motion vector validation
pcm_bluray: set bits_per_raw_sample for > 16-bit
twinvq: fix out of bounds array access
lavr: use 8.8 instead of 10.6 as the 16-bit fixed-point mixing coeff type
Conflicts:
doc/APIchanges
libavcodec/indeo3.c
libavcodec/pcm-mpeg.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Progressive data is allocated later in decode_sof(), not allocating
that data leads to NULL dereferences.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This prevents sample_rate/data_length from going negative, which
caused various crashes and undefined behaviour further down.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This properly synchronizes frame size changes between threads if
subsequent threads abort decoding before frame size is initialized, i.e.
it prevents the thread after that from ping-ponging back to the original
value.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Starting with version 4.7, gcc properly supports unaligned
memory accesses on ARM. Not using the inline asm with these
compilers results in better code.
Signed-off-by: Mans Rullgard <mans@mansr.com>
With a dereferenced type-cast pointer as memory operand, gcc 4.6
and later will sometimes copy the data to a temporary location,
the address of which is used as the operand value, if it thinks
the target address might be misaligned. Using a pointer to a
packed struct type instead does the right thing.
The 16-bit case is special since the ldrh instruction addressing
modes are limited compared to ldr. The "Uq" constraint produces a
memory reference suitable for an ldrsb instruction, which supports
the same addressing modes as ldrh. However, the restrictions appear
to apply only when the operand addresses a single byte. The memory
reference must thus be split into two operands each targeting one
byte. Finally, the "Uq" constraint is only available in ARM mode.
The Thumb-2 ldrh instruction supports most addressing modes so the
normal "m" constraint can be used there.
Signed-off-by: Mans Rullgard <mans@mansr.com>
Michael Niedermayer
Mans Rullgard
Justin Ruggles
Michael Bradshaw
Clément Bœsch
Nicolas George
Hendrik Leppkes
Joakim Plate
Stefano Sabatini
Alex Converse
Ronald S. Bultje
Kostya Shishkov
Mashiat Sarker Shakkhar
Paul B Mahol