diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-06-04 15:40:13 +0400 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2012-06-04 15:40:13 +0400 |
commit | 514f3e7c02202902badb389904965ca278a0299e (patch) | |
tree | e37331197c6354f3ac5c1d590ba0af9859fd0075 | |
parent | 3fab87edc9ff5745d0a5c1634760ae0971d4e725 (diff) | |
parent | 4dfea3e9f065e520f5fc71028472f7f6b9beed52 (diff) |
Merge remote-tracking branch 'qatar/release/0.8' into release/0.10
* qatar/release/0.8:
Update Changelog for the 0.8.3 Release
Prepare for 0.8.3 Release
ea: check chunk_size for validity.
png: check bit depth for PAL8/Y400A pixel formats.
qdm2: clip array indices returned by qdm2_get_vlc().
tqi: Pass errors from the MB decoder
h264: Add check for invalid chroma_format_idc
h263dec: Disallow width/height changing with frame threads.
Conflicts:
Changelog
RELEASE
libavcodec/eatqi.c
libavcodec/h264_ps.c
libavcodec/pngdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r-- | Changelog | 5 | ||||
-rw-r--r-- | libavcodec/eatqi.c | 4 | ||||
-rw-r--r-- | libavcodec/h263dec.c | 5 | ||||
-rw-r--r-- | libavcodec/h264_ps.c | 4 | ||||
-rw-r--r-- | libavcodec/pngdec.c | 5 | ||||
-rw-r--r-- | libavcodec/qdm2.c | 18 | ||||
-rw-r--r-- | libavformat/electronicarts.c | 7 |
7 files changed, 36 insertions, 12 deletions
@@ -4,6 +4,11 @@ releases are sorted from youngest to oldest. version next: +version 0.10.4: + +- Several bugs and crashes have been fixed + Note, CVE-2012-0851 and CVE-2011-3937 have been fixed in previous releases + version 0.10.3: - Security fixes in the 4xm demuxer, avi demuxer, cook decoder, diff --git a/libavcodec/eatqi.c b/libavcodec/eatqi.c index d650a71713..306aa65fbf 100644 --- a/libavcodec/eatqi.c +++ b/libavcodec/eatqi.c @@ -62,7 +62,7 @@ static int tqi_decode_mb(MpegEncContext *s, DCTELEM (*block)[64]) int n; s->dsp.clear_blocks(block[0]); for (n=0; n<6; n++) - if(ff_mpeg1_decode_block_intra(s, block[n], n)<0) + if (ff_mpeg1_decode_block_intra(s, block[n], n) < 0) return -1; return 0; @@ -137,7 +137,7 @@ static int tqi_decode_frame(AVCodecContext *avctx, for (s->mb_y=0; s->mb_y<(avctx->height+15)/16; s->mb_y++) for (s->mb_x=0; s->mb_x<(avctx->width+15)/16; s->mb_x++) { - if(tqi_decode_mb(s, t->block) < 0) + if (tqi_decode_mb(s, t->block) < 0) break; tqi_idct_put(t, t->block); } diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c index b41ba7ab19..b57a679049 100644 --- a/libavcodec/h263dec.c +++ b/libavcodec/h263dec.c @@ -591,6 +591,11 @@ retry: /* H.263 could change picture size any time */ ParseContext pc= s->parse_context; //FIXME move these demuxng hack to avformat + if (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_FRAME)) { + av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0); + return -1; // width / height changed during parallelized decoding + } + s->parse_context.buffer=0; MPV_common_end(s); s->parse_context= pc; diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index 0ef591ccfa..e462287363 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -351,9 +351,9 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ if (sps->chroma_format_idc > 3U) { av_log(h->s.avctx, AV_LOG_ERROR, "chroma_format_idc %d is illegal\n", sps->chroma_format_idc); goto fail; - } - if(sps->chroma_format_idc == 3) + } else if(sps->chroma_format_idc == 3) { sps->residual_color_transform_flag = get_bits1(&s->gb); + } sps->bit_depth_luma = get_ue_golomb(&s->gb) + 8; sps->bit_depth_chroma = get_ue_golomb(&s->gb) + 8; if (sps->bit_depth_luma > 12U || sps->bit_depth_chroma > 12U) { diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c index 58677d8457..b768d38cae 100644 --- a/libavcodec/pngdec.c +++ b/libavcodec/pngdec.c @@ -479,13 +479,14 @@ static int decode_frame(AVCodecContext *avctx, } else if (s->bit_depth == 16 && s->color_type == PNG_COLOR_TYPE_RGB) { avctx->pix_fmt = PIX_FMT_RGB48BE; - } else if (s->color_type == PNG_COLOR_TYPE_PALETTE) { + } else if ((s->bits_per_pixel == 1 || s->bits_per_pixel == 2 || s->bits_per_pixel == 4 || s->bits_per_pixel == 8) && + s->color_type == PNG_COLOR_TYPE_PALETTE) { avctx->pix_fmt = PIX_FMT_PAL8; } else if (s->bit_depth == 1) { avctx->pix_fmt = PIX_FMT_MONOBLACK; } else if (s->bit_depth == 8 && s->color_type == PNG_COLOR_TYPE_GRAY_ALPHA) { - avctx->pix_fmt = PIX_FMT_GRAY8A; + avctx->pix_fmt = PIX_FMT_Y400A; } else { av_log(avctx, AV_LOG_ERROR, "unsupported bit depth %d " "and color type %d\n", diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c index 5da21d757d..aa9c3870c8 100644 --- a/libavcodec/qdm2.c +++ b/libavcodec/qdm2.c @@ -884,9 +884,13 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l break; case 30: - if (BITS_LEFT(length,gb) >= 4) - samples[0] = type30_dequant[qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1)]; - else + if (BITS_LEFT(length,gb) >= 4) { + unsigned index = qdm2_get_vlc(gb, &vlc_tab_type30, 0, 1); + if (index < FF_ARRAY_ELEMS(type30_dequant)) { + samples[0] = type30_dequant[index]; + } else + samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); + } else samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); run = 1; @@ -900,8 +904,12 @@ static void synthfilt_build_sb_samples (QDM2Context *q, GetBitContext *gb, int l type34_predictor = samples[0]; type34_first = 0; } else { - samples[0] = type34_delta[qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1)] / type34_div + type34_predictor; - type34_predictor = samples[0]; + unsigned index = qdm2_get_vlc(gb, &vlc_tab_type34, 0, 1); + if (index < FF_ARRAY_ELEMS(type34_delta)) { + samples[0] = type34_delta[index] / type34_div + type34_predictor; + type34_predictor = samples[0]; + } else + samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); } } else { samples[0] = SB_DITHERING_NOISE(sb,q->noise_idx); diff --git a/libavformat/electronicarts.c b/libavformat/electronicarts.c index a0007d2982..19b72edc8e 100644 --- a/libavformat/electronicarts.c +++ b/libavformat/electronicarts.c @@ -476,12 +476,17 @@ static int ea_read_packet(AVFormatContext *s, while (!packet_read) { chunk_type = avio_rl32(pb); - chunk_size = (ea->big_endian ? avio_rb32(pb) : avio_rl32(pb)) - 8; + chunk_size = ea->big_endian ? avio_rb32(pb) : avio_rl32(pb); + if (chunk_size <= 8) + return AVERROR_INVALIDDATA; + chunk_size -= 8; switch (chunk_type) { /* audio data */ case ISNh_TAG: /* header chunk also contains data; skip over the header portion*/ + if (chunk_size < 32) + return AVERROR_INVALIDDATA; avio_skip(pb, 32); chunk_size -= 32; case ISNd_TAG: |