diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-04-07 15:57:13 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-04-07 15:57:13 +0200 |
| commit | 566de83883cab02d113fd82b5d3013a770162620 (patch) | |
| tree | d5dc1c17dd25b69a4c06134de781d1591a9d347d | |
| parent | e9d5a6f1c5b65319400a45446ae6523a2296de73 (diff) | |
| parent | b385a772180963813a23baf9a80713a12c86cb7c (diff) | |
| download | ffmpeg-566de83883cab02d113fd82b5d3013a770162620.tar.gz | |
Merge remote-tracking branch 'qatar/release/0.8' into release/0.10
* qatar/release/0.8:
update Changelog
fate: fetch samples that match the release series
dxva2: include dxva.h if found
iff: validate CMAP palette size
Changelog: document msrle bugfix
Changelog: cosmetics, remove trailing periods and sort
msrledec: check bounds before constructing a possibly invalid pointer,
Conflicts:
Changelog
configure
libavformat/iff.c
tests/Makefile
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/msrledec.c | 4 | ||||
| -rw-r--r-- | libavformat/iff.c | 5 |
2 files changed, 7 insertions, 2 deletions
diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c index 10bc482329..a6cf22faa1 100644 --- a/libavcodec/msrledec.c +++ b/libavcodec/msrledec.c @@ -145,8 +145,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, if(p1 == 0) { //Escape code p2 = bytestream2_get_byte(gb); if(p2 == 0) { //End-of-line - output = pic->data[0] + (--line) * pic->linesize[0]; - if (line < 0) { + if (--line < 0) { if (bytestream2_get_be16(gb) == 1) { // end-of-picture return 0; } else { @@ -156,6 +155,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, return AVERROR_INVALIDDATA; } } + output = pic->data[0] + line * pic->linesize[0]; pos = 0; continue; } else if(p2 == 1) { //End-of-picture diff --git a/libavformat/iff.c b/libavformat/iff.c index ebc1c35ba5..876b902586 100644 --- a/libavformat/iff.c +++ b/libavformat/iff.c @@ -188,6 +188,11 @@ static int iff_read_header(AVFormatContext *s, break; case ID_CMAP: + if (data_size < 3 || data_size > 768 || data_size % 3) { + av_log(s, AV_LOG_ERROR, "Invalid CMAP chunk size %d\n", + data_size); + return AVERROR_INVALIDDATA; + } st->codec->extradata_size = data_size + IFF_EXTRA_VIDEO_SIZE; st->codec->extradata = av_malloc(data_size + IFF_EXTRA_VIDEO_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) |