February 2012 - ffmpeg-cvslog

get_buffers: Check that pix_fmt is not NONE.
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Wed Feb 29 06:20:22 2012 +0100| [c2500635235d809e0c0ac526a7e13072ab7c8900] | committer: Michael Niedermayer get_buffers: Check that pix_fmt is not NONE. This is somewhat redundant as no decoder should call get_buffer() with such argument. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c2500635235d809e0… --- ffmpeg.c | 2 +- ffplay.c | 2 +- libavcodec/utils.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ffmpeg.c b/ffmpeg.c index 06fb253..c43192d 100644 --- a/ffmpeg.c +++ b/ffmpeg.c @@ -553,7 +553,7 @@ static int codec_get_buffer(AVCodecContext *s, AVFrame *frame) FrameBuffer *buf; int ret, i; - if(av_image_check_size(s->width, s->height, 0, s)) + if(av_image_check_size(s->width, s->height, 0, s) || s->pix_fmt<0) return -1; if (!ist->buffer_pool && (ret = alloc_buffer(s, ist, &ist->buffer_pool)) < 0) diff --git a/ffplay.c b/ffplay.c index 19c4308..93097e1 100644 --- a/ffplay.c +++ b/ffplay.c @@ -1564,7 +1564,7 @@ static int input_get_buffer(AVCodecContext *codec, AVFrame *pic) w = codec->width; h = codec->height; - if(av_image_check_size(w, h, 0, codec)) + if(av_image_check_size(w, h, 0, codec) || codec->pix_fmt<0) return -1; avcodec_align_dimensions2(codec, &w, &h, stride); diff --git a/libavcodec/utils.c b/libavcodec/utils.c index a697fac..63f7fae 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -414,7 +414,7 @@ static int video_get_buffer(AVCodecContext *s, AVFrame *pic) return -1; } - if(av_image_check_size(w, h, 0, s)) + if(av_image_check_size(w, h, 0, s) || s->pix_fmt<0) return -1; if (!avci->buffer) {

1 0

alsdec: Check that quantized parcor coeffs are within range.
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Wed Feb 29 06:10:17 2012 +0100| [8534881a389044ec51adabcf979616b4875ac072] | committer: Michael Niedermayer alsdec: Check that quantized parcor coeffs are within range. ALS spec: 11.6.3.1.1 Quantization and encoding of parcor coefficients ... In all cases the resulting quantized values ak are restricted to the range [-64,63]. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8534881a389044ec5… --- libavcodec/alsdec.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 84ed4cf..8abba60 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -695,6 +695,10 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) int rice_param = parcor_rice_table[sconf->coef_table][k][1]; int offset = parcor_rice_table[sconf->coef_table][k][0]; quant_cof[k] = decode_rice(gb, rice_param) + offset; + if (quant_cof[k] < -64 || quant_cof[k] > 63) { + av_log(avctx, AV_LOG_ERROR, "quant_cof %d is out of range\n", quant_cof[k]); + return AVERROR_INVALIDDATA; + } } // read coefficients 20 to 126

1 0

libpostproc: fix out of array accesses detected by AddressSanitizer.
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Wed Feb 29 04:25:13 2012 +0100| [f5bf7b9f4baf9f4626146f996df47c1d37517024] | committer: Michael Niedermayer libpostproc: fix out of array accesses detected by AddressSanitizer. Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f5bf7b9f4baf9f462… --- libpostproc/postprocess_template.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/libpostproc/postprocess_template.c b/libpostproc/postprocess_template.c index 4b8184c..3419257 100644 --- a/libpostproc/postprocess_template.c +++ b/libpostproc/postprocess_template.c @@ -3549,7 +3549,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[ { RENAME(tempNoiseReducer)(dstBlock-8, stride, c.tempBlurred[isColor] + y*dstStride + x, - c.tempBlurredPast[isColor] + (y>>3)*256 + (x>>3), + c.tempBlurredPast[isColor] + (y>>3)*256 + (x>>3) + 256, c.ppMode.maxTmpNoise); } } @@ -3571,7 +3571,7 @@ static void RENAME(postProcess)(const uint8_t src[], int srcStride, uint8_t dst[ if((mode & TEMP_NOISE_FILTER)){ RENAME(tempNoiseReducer)(dstBlock-8, dstStride, c.tempBlurred[isColor] + y*dstStride + x, - c.tempBlurredPast[isColor] + (y>>3)*256 + (x>>3), + c.tempBlurredPast[isColor] + (y>>3)*256 + (x>>3) + 256, c.ppMode.maxTmpNoise); }

1 0

vf_deshake: try to fix memleak
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Wed Feb 29 02:33:32 2012 +0100| [f54e06feb363e7c704fbca52cb057d742285d7bf] | committer: Michael Niedermayer vf_deshake: try to fix memleak Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f54e06feb363e7c70… --- libavfilter/vf_deshake.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/libavfilter/vf_deshake.c b/libavfilter/vf_deshake.c index bb20551..cdece5c 100644 --- a/libavfilter/vf_deshake.c +++ b/libavfilter/vf_deshake.c @@ -418,6 +418,8 @@ static av_cold void uninit(AVFilterContext *ctx) avfilter_unref_buffer(deshake->ref); if (deshake->fp) fclose(deshake->fp); + avcodec_close(deshake->avctx); + av_freep(&deshake->avctx); } static void end_frame(AVFilterLink *link)

1 0

fate: switch lavfi-pp targets which need bitexact flags to use them.
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Wed Feb 29 02:24:59 2012 +0100| [9aa7b3cd5341f2252a7754b6ad9db8b49b6a343a] | committer: Michael Niedermayer fate: switch lavfi-pp targets which need bitexact flags to use them. Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9aa7b3cd5341f2252… --- tests/lavfi-regression.sh | 10 +++++----- tests/ref/lavfi/pp | 2 +- tests/ref/lavfi/pp2 | 2 +- tests/ref/lavfi/pp3 | 2 +- tests/ref/lavfi/pp4 | 2 +- tests/ref/lavfi/pp6 | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/tests/lavfi-regression.sh b/tests/lavfi-regression.sh index 8f47ee4..1bb0dfe 100755 --- a/tests/lavfi-regression.sh +++ b/tests/lavfi-regression.sh @@ -38,12 +38,12 @@ do_lavfi "fade" "fade=in:5:15,fade=out:30:15" do_lavfi "null" "null" do_lavfi "overlay" "split[m],scale=88:72,pad=96:80:4:4[o2];[m]fifo,[o2]overlay=240:16" do_lavfi "pad" "pad=iw*1.5:ih*1.5:iw*0.3:ih*0.2" -do_lavfi "pp" "mp=pp=de/tn/l5/al" -do_lavfi "pp2" "mp=pp=fq:16/fa/lb" -do_lavfi "pp3" "mp=pp=fq:8/ac/li" -do_lavfi "pp4" "mp=pp=ci" +do_lavfi "pp" "mp=pp=be/de/tn/l5/al" +do_lavfi "pp2" "mp=pp=be/fq:16/fa/lb" +do_lavfi "pp3" "mp=pp=be/fq:8/ac/li" +do_lavfi "pp4" "mp=pp=be/ci" do_lavfi "pp5" "mp=pp=md" -do_lavfi "pp6" "mp=pp=fd" +do_lavfi "pp6" "mp=pp=be/fd" do_lavfi "scale200" "scale=200:200" do_lavfi "scale500" "scale=500:500" do_lavfi "select" "select=not(eq(mod(n\,2)\,0)+eq(mod(n\,3)\,0))" diff --git a/tests/ref/lavfi/pp b/tests/ref/lavfi/pp index 4d26254..554a0b2 100644 --- a/tests/ref/lavfi/pp +++ b/tests/ref/lavfi/pp @@ -1 +1 @@ -pp 3ddfb037bb1f941d6526a2473a191677 +pp 520803fe1843d384b852ff9750e815c9 diff --git a/tests/ref/lavfi/pp2 b/tests/ref/lavfi/pp2 index 2694bfa..4517f3c 100644 --- a/tests/ref/lavfi/pp2 +++ b/tests/ref/lavfi/pp2 @@ -1 +1 @@ -pp2 79e3480bfc7561f6a175138727319999 +pp2 1a34413c53356a5fc4f891e50f8400c8 diff --git a/tests/ref/lavfi/pp3 b/tests/ref/lavfi/pp3 index ea406b9..3c64c1c 100644 --- a/tests/ref/lavfi/pp3 +++ b/tests/ref/lavfi/pp3 @@ -1 +1 @@ -pp3 d5feed74a102bf241cd57a3784eda8c0 +pp3 192df08ba93baa48d90551509b64615c diff --git a/tests/ref/lavfi/pp4 b/tests/ref/lavfi/pp4 index ebbc692..88f8ed0 100644 --- a/tests/ref/lavfi/pp4 +++ b/tests/ref/lavfi/pp4 @@ -1 +1 @@ -pp4 9584bae9fe344e2ffa9d73a8370e8b11 +pp4 23b157b7a658800954f095f950f18165 diff --git a/tests/ref/lavfi/pp6 b/tests/ref/lavfi/pp6 index b56d971..9547ac7 100644 --- a/tests/ref/lavfi/pp6 +++ b/tests/ref/lavfi/pp6 @@ -1 +1 @@ -pp6 4a2f70e09ef52a48df2e5be8b8e2859f +pp6 9ace50ed384e9a085965c52366e9cd6f

1 0

libpostproc: add bitexact mode, which is needed for regression testing.
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Wed Feb 29 02:05:54 2012 +0100| [7f80afe0a7ae7982f1a074c838f7e8e7e361e6fb] | committer: Michael Niedermayer libpostproc: add bitexact mode, which is needed for regression testing. Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7f80afe0a7ae7982f… --- libpostproc/postprocess.c | 7 +++++-- libpostproc/postprocess_internal.h | 1 + 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/libpostproc/postprocess.c b/libpostproc/postprocess.c index ef9cd44..1e31cee 100644 --- a/libpostproc/postprocess.c +++ b/libpostproc/postprocess.c @@ -150,6 +150,7 @@ static struct PPFilter filters[]= {"l5", "lowpass5", 1, 1, 4, LOWPASS5_DEINT_FILTER}, {"tn", "tmpnoise", 1, 7, 8, TEMP_NOISE_FILTER}, {"fq", "forcequant", 1, 0, 0, FORCE_QUANT}, + {"be", "bitexact", 1, 0, 0, BITEXACT}, {NULL, NULL,0,0,0,0} //End Marker }; @@ -536,9 +537,8 @@ static av_always_inline void do_a_deblock_C(uint8_t *src, int step, int stride, //Note: we have C, MMX, MMX2, 3DNOW version there is no 3DNOW+MMX2 one //Plain C versions -#if !(HAVE_MMX || HAVE_ALTIVEC) || CONFIG_RUNTIME_CPUDETECT +//we always compile C for testing which needs bitexactness #define COMPILE_C -#endif #if HAVE_ALTIVEC #define COMPILE_ALTIVEC @@ -624,6 +624,9 @@ static inline void postProcess(const uint8_t src[], int srcStride, uint8_t dst[] PPMode *ppMode= (PPMode *)vm; c->ppMode= *ppMode; //FIXME + if(ppMode->lumMode & BITEXACT) + return postProcess_C(src, srcStride, dst, dstStride, width, height, QPs, QPStride, isColor, c); + // Using ifs here as they are faster than function pointers although the // difference would not be measurable here but it is much better because // someone might exchange the CPU whithout restarting MPlayer ;) diff --git a/libpostproc/postprocess_internal.h b/libpostproc/postprocess_internal.h index 2256d78..33c5f69 100644 --- a/libpostproc/postprocess_internal.h +++ b/libpostproc/postprocess_internal.h @@ -67,6 +67,7 @@ #define TEMP_NOISE_FILTER 0x100000 #define FORCE_QUANT 0x200000 +#define BITEXACT 0x1000000 //use if you want a faster postprocessing code //cannot differentiate between chroma & luma filters (both on or both off)

1 0

fate: More libpostproc tests to improve coverage.
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Tue Feb 28 20:54:13 2012 +0100| [0ae9b32e51e6920298ae8aaf4c481eae422c50a6] | committer: Michael Niedermayer fate: More libpostproc tests to improve coverage. Reviewed-by: Derek Buitenhuis <derek.buitenhuis(a)gmail.com> Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0ae9b32e51e692029… --- tests/lavfi-regression.sh | 5 +++++ tests/ref/lavfi/pp2 | 1 + tests/ref/lavfi/pp3 | 1 + tests/ref/lavfi/pp4 | 1 + tests/ref/lavfi/pp5 | 1 + tests/ref/lavfi/pp6 | 1 + 6 files changed, 10 insertions(+), 0 deletions(-) diff --git a/tests/lavfi-regression.sh b/tests/lavfi-regression.sh index d00dfe6..8f47ee4 100755 --- a/tests/lavfi-regression.sh +++ b/tests/lavfi-regression.sh @@ -39,6 +39,11 @@ do_lavfi "null" "null" do_lavfi "overlay" "split[m],scale=88:72,pad=96:80:4:4[o2];[m]fifo,[o2]overlay=240:16" do_lavfi "pad" "pad=iw*1.5:ih*1.5:iw*0.3:ih*0.2" do_lavfi "pp" "mp=pp=de/tn/l5/al" +do_lavfi "pp2" "mp=pp=fq:16/fa/lb" +do_lavfi "pp3" "mp=pp=fq:8/ac/li" +do_lavfi "pp4" "mp=pp=ci" +do_lavfi "pp5" "mp=pp=md" +do_lavfi "pp6" "mp=pp=fd" do_lavfi "scale200" "scale=200:200" do_lavfi "scale500" "scale=500:500" do_lavfi "select" "select=not(eq(mod(n\,2)\,0)+eq(mod(n\,3)\,0))" diff --git a/tests/ref/lavfi/pp2 b/tests/ref/lavfi/pp2 new file mode 100644 index 0000000..2694bfa --- /dev/null +++ b/tests/ref/lavfi/pp2 @@ -0,0 +1 @@ +pp2 79e3480bfc7561f6a175138727319999 diff --git a/tests/ref/lavfi/pp3 b/tests/ref/lavfi/pp3 new file mode 100644 index 0000000..ea406b9 --- /dev/null +++ b/tests/ref/lavfi/pp3 @@ -0,0 +1 @@ +pp3 d5feed74a102bf241cd57a3784eda8c0 diff --git a/tests/ref/lavfi/pp4 b/tests/ref/lavfi/pp4 new file mode 100644 index 0000000..ebbc692 --- /dev/null +++ b/tests/ref/lavfi/pp4 @@ -0,0 +1 @@ +pp4 9584bae9fe344e2ffa9d73a8370e8b11 diff --git a/tests/ref/lavfi/pp5 b/tests/ref/lavfi/pp5 new file mode 100644 index 0000000..55c7bc5 --- /dev/null +++ b/tests/ref/lavfi/pp5 @@ -0,0 +1 @@ +pp5 09f92a9bf9348859461c150c12bd1317 diff --git a/tests/ref/lavfi/pp6 b/tests/ref/lavfi/pp6 new file mode 100644 index 0000000..b56d971 --- /dev/null +++ b/tests/ref/lavfi/pp6 @@ -0,0 +1 @@ +pp6 4a2f70e09ef52a48df2e5be8b8e2859f

1 0

cook: avoid out of global array read.
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Tue Feb 28 20:08:47 2012 +0100| [51defefa85508219fac594273e85313b41722b5c] | committer: Michael Niedermayer cook: avoid out of global array read. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=51defefa85508219f… --- libavcodec/cook.c | 41 +++++++++++++++++++++++++++++------------ 1 files changed, 29 insertions(+), 12 deletions(-) diff --git a/libavcodec/cook.c b/libavcodec/cook.c index 08b51d8..6c111de 100644 --- a/libavcodec/cook.c +++ b/libavcodec/cook.c @@ -366,7 +366,7 @@ static void decode_gain_info(GetBitContext *gb, int *gaininfo) * @param q pointer to the COOKContext * @param quant_index_table pointer to the array */ -static void decode_envelope(COOKContext *q, COOKSubpacket *p, +static int decode_envelope(COOKContext *q, COOKSubpacket *p, int *quant_index_table) { int i, j, vlc_index; @@ -388,7 +388,14 @@ static void decode_envelope(COOKContext *q, COOKSubpacket *p, j = get_vlc2(&q->gb, q->envelope_quant_index[vlc_index - 1].table, q->envelope_quant_index[vlc_index - 1].bits, 2); quant_index_table[i] = quant_index_table[i - 1] + j - 12; // differential encoding + + if (quant_index_table[i] < -63 || quant_index_table[i] > 64) { + av_log(NULL, AV_LOG_ERROR, "quant_index_table value out of bounds\n"); + return AVERROR_INVALIDDATA; + } } + + return 0; } /** @@ -635,20 +642,24 @@ static void decode_vectors(COOKContext *q, COOKSubpacket *p, int *category, * @param q pointer to the COOKContext * @param mlt_buffer pointer to mlt coefficients */ -static void mono_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer) +static int mono_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer) { int category_index[128]; int quant_index_table[102]; int category[128]; + int ret; memset(&category, 0, sizeof(category)); memset(&category_index, 0, sizeof(category_index)); - decode_envelope(q, p, quant_index_table); + if ((ret = decode_envelope(q, p, quant_index_table)) < 0) + return ret; q->num_vectors = get_bits(&q->gb, p->log2_numvector_size); categorize(q, p, quant_index_table, category, category_index); expand_category(q, category, category_index); decode_vectors(q, p, category, quant_index_table, mlt_buffer); + + return 0; } @@ -798,10 +809,10 @@ static void decouple_float(COOKContext *q, * @param mlt_buffer1 pointer to left channel mlt coefficients * @param mlt_buffer2 pointer to right channel mlt coefficients */ -static void joint_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer1, +static int joint_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer1, float *mlt_buffer2) { - int i, j; + int i, j, ret; int decouple_tab[SUBBAND_SIZE]; float *decode_buffer = q->decode_buffer_0; int idx, cpl_tmp; @@ -815,8 +826,8 @@ static void joint_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer1, memset(mlt_buffer1, 0, 1024 * sizeof(*mlt_buffer1)); memset(mlt_buffer2, 0, 1024 * sizeof(*mlt_buffer2)); decouple_info(q, p, decouple_tab); - mono_decode(q, p, decode_buffer); - + if ((ret = mono_decode(q, p, decode_buffer)) < 0) + return ret; /* The two channels are stored interleaved in decode_buffer. */ for (i = 0; i < p->js_subband_start; i++) { for (j = 0; j < SUBBAND_SIZE; j++) { @@ -837,6 +848,7 @@ static void joint_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer1, q->decouple(q, p, i, f1, f2, decode_buffer, mlt_buffer1, mlt_buffer2); idx = (1 << p->js_vlc_bits) - 1; } + return 0; } /** @@ -909,10 +921,11 @@ static inline void mlt_compensate_output(COOKContext *q, float *decode_buffer, * @param inbuffer pointer to the inbuffer * @param outbuffer pointer to the outbuffer */ -static void decode_subpacket(COOKContext *q, COOKSubpacket *p, +static int decode_subpacket(COOKContext *q, COOKSubpacket *p, const uint8_t *inbuffer, float *outbuffer) { int sub_packet_size = p->size; + int ret; /* packet dump */ // for (i = 0; i < sub_packet_size ; i++) // av_log(q->avctx, AV_LOG_ERROR, "%02x", inbuffer[i]); @@ -921,13 +934,16 @@ static void decode_subpacket(COOKContext *q, COOKSubpacket *p, decode_bytes_and_gain(q, p, inbuffer, &p->gains1); if (p->joint_stereo) { - joint_decode(q, p, q->decode_buffer_1, q->decode_buffer_2); + if ((ret = joint_decode(q, p, q->decode_buffer_1, q->decode_buffer_2)) < 0) + return ret; } else { - mono_decode(q, p, q->decode_buffer_1); + if ((ret = mono_decode(q, p, q->decode_buffer_1)) < 0) + return ret; if (p->num_channels == 2) { decode_bytes_and_gain(q, p, inbuffer + sub_packet_size / 2, &p->gains2); - mono_decode(q, p, q->decode_buffer_2); + if ((ret = mono_decode(q, p, q->decode_buffer_2)) < 0) + return ret; } } @@ -996,7 +1012,8 @@ static int cook_decode_frame(AVCodecContext *avctx, void *data, i, q->subpacket[i].size, q->subpacket[i].joint_stereo, offset, avctx->block_align); - decode_subpacket(q, &q->subpacket[i], buf + offset, samples); + if ((ret = decode_subpacket(q, &q->subpacket[i], buf + offset, samples)) < 0) + return ret; offset += q->subpacket[i].size; chidx += q->subpacket[i].num_channels; av_log(avctx, AV_LOG_DEBUG, "subpacket[%i] %i %i\n",

1 0

Merge remote-tracking branch 'qatar/master'
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Michael Niedermayer <michaelni(a)gmx.at> | Wed Feb 29 00:30:35 2012 +0100| [0e6aa0fef565fdb625673c60276e90c2ea091e8e] | committer: Michael Niedermayer Merge remote-tracking branch 'qatar/master' * qatar/master: adpcm: Clip step_index values read from the bitstream at the beginning of each frame. oma: don't read beyond end of leaf_table. doxygen: Remove documentation for non-existing parameters; misc small fixes. Indeo3: fix crashes on corrupt bitstreams. msmpeg4: Replace forward declaration by proper #include. segment: implement wrap around avf: reorder AVStream and AVFormatContext aacdec: Remove erroneous reference to global gain from the out of bounds scalefactor error message. Conflicts: libavcodec/indeo3.c libavformat/avformat.h libavutil/avutil.h Merged-by: Michael Niedermayer <michaelni(a)gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0e6aa0fef565fdb62… ---

1 0

adpcm: Clip step_index values read from the bitstream at the beginning of each frame .
by git＠videolan.org 29 Feb '12

29 Feb '12

ffmpeg | branch: master | Alex Converse <alex.converse(a)gmail.com> | Tue Feb 28 11:50:22 2012 -0800| [bbeb29133b55b7256d18f5aaab8b5c8e919a173a] | committer: Alex Converse adpcm: Clip step_index values read from the bitstream at the beginning of each frame. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bbeb29133b55b7256… --- libavcodec/adpcm.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index bd86ab0..302f2ff 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -696,7 +696,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, for (channel = 0; channel < avctx->channels; channel++) { cs = &c->status[channel]; cs->predictor = (int16_t)bytestream_get_le16(&src); - cs->step_index = *src++; + cs->step_index = av_clip(*src++, 0, 88); src++; *samples++ = cs->predictor; } @@ -719,8 +719,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, c->status[0].predictor = (int16_t)AV_RL16(src + 10); c->status[1].predictor = (int16_t)AV_RL16(src + 12); - c->status[0].step_index = src[14]; - c->status[1].step_index = src[15]; + c->status[0].step_index = av_clip(src[14], 0, 88); + c->status[1].step_index = av_clip(src[15], 0, 88); /* sign extend the predictors */ src += 16; diff_channel = c->status[1].predictor; @@ -760,7 +760,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, for (channel = 0; channel < avctx->channels; channel++) { cs = &c->status[channel]; cs->predictor = (int16_t)bytestream_get_le16(&src); - cs->step_index = *src++; + cs->step_index = av_clip(*src++, 0, 88); src++; } @@ -823,7 +823,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, src += 4; // skip sample count (already read) for (i=0; i<=st; i++) - c->status[i].step_index = bytestream_get_le32(&src); + c->status[i].step_index = av_clip(bytestream_get_le32(&src), 0, 88); for (i=0; i<=st; i++) c->status[i].predictor = bytestream_get_le32(&src); @@ -1037,11 +1037,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, case CODEC_ID_ADPCM_IMA_SMJPEG: if (avctx->codec->id == CODEC_ID_ADPCM_IMA_AMV) { c->status[0].predictor = sign_extend(bytestream_get_le16(&src), 16); - c->status[0].step_index = bytestream_get_le16(&src); + c->status[0].step_index = av_clip(bytestream_get_le16(&src), 0, 88); src += 4; } else { c->status[0].predictor = sign_extend(bytestream_get_be16(&src), 16); - c->status[0].step_index = bytestream_get_byte(&src); + c->status[0].step_index = av_clip(bytestream_get_byte(&src), 0, 88); src += 1; }

1 0