Since resolution change support this also was exploitable, which is
how it was found.
Fixes read after free and out of array reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Move some functions from dsputil. The idea is that videodsp contains
functions that are useful for a large and varied set of video decoders.
Currently, it contains emulated_edge_mc() and prefetch().
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* commit 'f1d8763a02b5fce9a7d9789e049d74a45b15e1e8':
mpegvideo: allocate scratch buffers after linesize is known
Conflicts:
libavcodec/mpegvideo.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Since we can't know which stride a custom get_buffer() implementation is
going to use we have to allocate this scratch buffers after the linesize
is known. It was pretty safe for 8 bit per pixel pixel formats since we
always allocated memory for up to 16 bits per pixel. It broke hoever
with cmdutis.c's alloc_buffer() and high pixel bit depth since it
allocated larger edges than mpegvideo expected.
Fixes fuzzed sample nasa-8s2.ts_s244342.
* commit '6a27ae28f9bde981e85c82cf5bf42c5f43fb6f13':
mpegvideo: treat delayed pictures as used
Conflicts:
libavcodec/h264.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This requires to move the avcodec_default_free_buffers() call to
ff_MPV_common_end() since otherwise delayed pictures would get freed
during a size change.
In ISO/IEC 13818-2, bit rate is differently determined according to video type
1) MPEG1 Video
Bit_rate and vbv_delay are set to 3FFFF and FFFF respectively
to indicate variable bitrate. Other values are for constant bitrate.
VBV is only defined for constant bit rate operation.
Ths STD supersedes the VBV model for vbr.
2) MPEG2 Video
Even if the bitrate is constant, the value of bit_rate may not be the actual bitrate
since bit_rate need only be an upper bound to that actual bitrate.
VBV is only defined for variable bit rate operation.
Constant bit rate is viewed as a special case of vbr.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '581281e242609a222233a2e5538b89dfb88fb18e':
matroskadec: check realloc in lzo encoding
matroska: honor error_recognition on unknown doctypes
tiffdec: Add support for GRAY16LE.
tiffenc: Add support for little endian RGB48 and GRAY16
mpeg4: support frame parameter changes with frame-mt
mpegvideo: check ff_find_unused_picture() return value for errors
mpegvideo: release frame buffers before freeing them
configure: msvc: default to 'lib' as 'ar' tool
build: support some non-standard ar variants
Conflicts:
libavcodec/h263dec.c
libavcodec/mpegvideo.c
libavcodec/tiff.c
libavcodec/tiffenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Adds a flag context_reinit to MpegEncContext to relieable keep track
of frame parameter changes which require a context reinitialization.
This is required for broken inputs which change the frame size but
error out before the context can be reinitialized.
* qatar/master:
rv34: use ff_MPV_common_frame_size_change()
mpegvideo: add reinit function for frame parameter changes
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This is mainly required for frame parameter changes during frame based
multithreading but single threaded usage profits too from avoiding
ff_MPV_common_end()/ff_MPV_common_init() cycles.
* commit 'd58dd4b5b5d31cfd4092e38a5f2c894eee2ab078':
avopt: Store defaults for AV_OPT_TYPE_FLAGS in the i64 union member
Conflicts:
libavcodec/libvpxenc.c
libavcodec/options_table.h
libavfilter/vf_drawtext.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '124134e42455763b28cc346fed1d07017a76e84e':
avopt: Store defaults for AV_OPT_TYPE_CONST in the i64 union member
Conflicts:
libavcodec/aacenc.c
libavcodec/libopenjpegenc.c
libavcodec/options_table.h
libavdevice/bktr.c
libavdevice/v4l2.c
libavdevice/x11grab.c
libavfilter/af_amix.c
libavfilter/vf_drawtext.c
libavformat/movenc.c
libavformat/options_table.h
libavutil/opt.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'a1bcc76e6036e78f25cbb7323c145056cfca9d93': (21 commits)
cmdutils: fix a memleak when specifying an option twice.
x86: mpegvideo: more sensible names for optimization file and init function
x86: mpegvideoenc: Split optimizations off into a separate file
dnxhdenc: x86: more sensible names for optimization file and init function
svq1/svq3: Move common code out of SVQ1 decoder-specific file
dirac: add Comments and references to the standard
lavr: x86: optimized 6-channel flt to fltp conversion
lavr: x86: optimized 2-channel flt to fltp conversion
lavr: x86: optimized 6-channel flt to s16p conversion
lavr: x86: optimized 2-channel flt to s16p conversion
lavr: x86: optimized 6-channel s16 to fltp conversion
lavr: x86: optimized 2-channel s16 to fltp conversion
lavr: x86: optimized 6-channel s16 to s16p conversion
lavr: x86: optimized 2-channel s16 to s16p conversion
lavr: x86: optimized 2-channel fltp to flt conversion
lavr: x86: optimized 6-channel fltp to s16 conversion
lavr: x86: optimized 2-channel fltp to s16 conversion
lavr: x86: optimized 6-channel s16p to flt conversion
lavr: x86: optimized 2-channel s16p to flt conversion
lavr: x86: optimized 6-channel s16p to s16 conversion
...
Conflicts:
libavcodec/dirac.c
libavcodec/mpegvideo.h
libavcodec/x86/Makefile
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
mpegvideo: reduce excessive inlining of mpeg_motion()
mpegvideo: convert mpegvideo_common.h to a .c file
build: factor out mpegvideo.o dependencies to CONFIG_MPEGVIDEO
Move MASK_ABS macro to libavcodec/mathops.h
x86: move MANGLE() and related macros to libavutil/x86/asm.h
x86: rename libavutil/x86_cpu.h to libavutil/x86/asm.h
aacdec: Don't fall back to the old output configuration when no old configuration is present.
rtmp: Add message tracking
rtsp: Support mpegts in raw udp packets
rtsp: Support receiving plain data over UDP without any RTP encapsulation
rtpdec: Remove an unused include
rtpenc: Remove an av_abort() that depends on user-supplied data
vsrc_movie: discourage its use with avconv.
avconv: allow no input files.
avconv: prevent invalid reads in transcode_init()
avconv: rename OutputStream.is_past_recording_time to finished.
Conflicts:
configure
doc/filters.texi
ffmpeg.c
ffmpeg.h
libavcodec/Makefile
libavcodec/aacdec.c
libavcodec/mpegvideo.c
libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This file defines a single, huge function, MPV_motion(), which
although being declared inline is not actually inlined by the
compiler (for good reason). There is thus no sense in defining
this function in a header file, resulting in multiple copies of
it in the final library.
Signed-off-by: Mans Rullgard <mans@mansr.com>
* qatar/master: (29 commits)
lavfi: reclassify showfiltfmts as a TESTPROG
graph2dot: fix printf format specifier
swscale: yuv2planeX 8bit >=sse2 functions need aligned stack on x86-32.
vp8: loopfilter >=sse2 functions need aligned stack on x86-32.
amr: remove shift out of the AMR_BIT() macro.
dsputilenc: group yasm and inline asm function pointer assignment.
mov: use forward declaration of a function instead of a table.
Clarify Doxygen comment for FF_API_* #defines.
configure: simplify get_version()
Create version.h headers for libraries that lack them
gitignore: Use full path instead of relative path to specify patterns
mpegvideo: remove VLAs
Add XTEA encryption support in libavutil
Add Blowfish encryption support in libavutil
eval: Add the isinf() function and tests for it
flacdec: move lpc filter to flacdsp
flacdec: split off channel decorrelation as flacdsp
avplay: Add an option for not limiting the input buffer size
FATE: add a test for WMA cover art.
FATE: add a test for apetag cover art
...
Conflicts:
.gitignore
configure
ffplay.c
libavcodec/Makefile
libavcodec/error_resilience.c
libavcodec/mpegvideo.c
libavcodec/ratecontrol.c
libavdevice/avdevice.h
libavfilter/Makefile
libavfilter/filtfmts.c
libavfilter/version.h
libavformat/mov.c
libavformat/version.h
libavutil/Makefile
libavutil/avutil.h
libavutil/version.h
libswscale/swscale.h
libswscale/x86/swscale_mmx.c
tests/fate/libavutil.mak
tests/lavfi-regression.sh
tools/graph2dot.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The new lowres support is limited to decoders where lowres decoding
is possible in high quality.
I was not able to measure any speed difference, but if one is found
the 2-3 lines that might affect speed can be made compile time conditional
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
ARM: allow runtime masking of CPU features
dsputil: remove unused functions
mov: Treat keyframe indexes as 1-origin if starting at non-zero.
mov: Take stps entries into consideration also about key_off.
Remove lowres video decoding
Conflicts:
ffmpeg.c
ffplay.c
libavcodec/arm/vp8dsp_init_arm.c
libavcodec/libopenjpegdec.c
libavcodec/mjpegdec.c
libavcodec/mpegvideo.c
libavcodec/utils.c
libavformat/mov.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Interlaced images can have 32 references (16 per field), so limiting the
array size to 16 leads to invalid writes.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
* qatar/master:
h264: error out on invalid bitdepth.
aacsbr: use a swap index for the Y matrix rather than copy buffers.
huffyuv: do not abort on unknown pix_fmt; instead, return an error.
lcl: return negative error codes on decode_init() errors.
rtpenc: Use MB info side data for splitting H263 packets for RFC 2190
h263enc: Add an option for outputting info about MBs as side data
avpacket: Add a function for shrinking already allocated side data
nellymoserdec: Saner and faster IMDCT windowing
Conflicts:
doc/APIchanges
libavcodec/avpacket.c
libavcodec/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master: (58 commits)
amrnbdec: check frame size before decoding.
cscd: use negative error values to indicate decode_init() failures.
h264: prevent overreads in intra PCM decoding.
FATE: do not decode audio in the nuv test.
dxa: set audio stream time base using the sample rate
psx-str: do not allow seeking by bytes
asfdec: Do not set AVCodecContext.frame_size
vqf: set packet parameters after av_new_packet()
mpegaudiodec: use DSPUtil.butterflies_float().
FATE: add mp3 test for sample that exhibited false overreads
fate: add cdxl test for bit line plane arrangement
vmnc: return error on decode_init() failure.
libvorbis: add/update error messages
libvorbis: use AVFifoBuffer for output packet buffer
libvorbis: remove unneeded e_o_s check
libvorbis: check return values for functions that can return errors
libvorbis: use float input instead of s16
libvorbis: do not flush libvorbis analysis if dsp state was not initialized
libvorbis: use VBR by default, with default quality of 3
libvorbis: fix use of minrate/maxrate AVOptions
...
Conflicts:
Changelog
doc/APIchanges
libavcodec/avcodec.h
libavcodec/dpxenc.c
libavcodec/libvorbis.c
libavcodec/vmnc.c
libavformat/asfdec.c
libavformat/id3v2enc.c
libavformat/internal.h
libavformat/mp3enc.c
libavformat/utils.c
libavformat/version.h
libswscale/utils.c
tests/fate/video.mak
tests/ref/fate/nuv
tests/ref/fate/prores-alpha
tests/ref/lavf/ffm
tests/ref/vsynth1/prores
tests/ref/vsynth2/prores
Merged-by: Michael Niedermayer <michaelni@gmx.at>