aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2011-12-24 01:19:33 +0100
committerMichael Niedermayer <michaelni@gmx.at>2011-12-24 01:41:43 +0100
commitdf825c956af76ae04af18dc00403bf1a0e745af1 (patch)
tree45759720297eb50f0e8b0057c1b3217761eb2237
parentd38580a7bb811028b5d3bac4924fd486c06b816f (diff)
parentd912a30c7d5cf9b8fdb26402804c9b0f999b4ff1 (diff)
downloadffmpeg-df825c956af76ae04af18dc00403bf1a0e745af1.tar.gz
Merge remote-tracking branch 'qatar/release/0.7' into release/0.8
This merge is primary for metadata, theres little actually changed except cosmetics * qatar/release/0.7: 4xm: Add a check in decode_i_frame to prevent buffer overreads wma: initialize prev_block_len_bits, next_block_len_bits, and block_len_bits. Update RELEASE file for 0.7.3 swscale: #include "libavutil/mathematics.h" vp3dec: Check coefficient index in vp3_dequant() svq1dec: call avcodec_set_dimensions() after dimensions changed. swscale: Readd #define _SVID_SOURCE Conflicts: RELEASE libavcodec/4xm.c libavcodec/vp3.c libswscale/utils.c Merged-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavcodec/4xm.c11
-rw-r--r--libavcodec/vp3.c10
-rw-r--r--libavcodec/wma.c3
-rw-r--r--libswscale/utils.c1
4 files changed, 19 insertions, 6 deletions
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index 3f8061f942..bbddef4876 100644
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -694,10 +694,13 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){
unsigned int prestream_size;
const uint8_t *prestream;
- if (bitstream_size > (1<<26) || length < bitstream_size + 12)
- return -1;
- prestream_size = 4*AV_RL32(buf + bitstream_size + 4);
- prestream = buf + bitstream_size + 12;
+ if (length < bitstream_size + 12) {
+ av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n");
+ return AVERROR_INVALIDDATA;
+ }
+
+ prestream_size = 4 * AV_RL32(buf + bitstream_size + 4);
+ prestream = buf + bitstream_size + 12;
if (prestream_size > (1<<26) ||
prestream_size != length - (bitstream_size + 12)){
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 2f07af8c4b..3abc78b85a 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -1514,7 +1514,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)
/* invert DCT and place (or add) in final output */
if (s->all_fragments[i].coding_method == MODE_INTRA) {
- vp3_dequant(s, s->all_fragments + i, plane, 0, block);
+ int index;
+ index = vp3_dequant(s, s->all_fragments + i, plane, 0, block);
+ if (index > 63)
+ continue;
if(s->avctx->idct_algo!=FF_IDCT_VP3)
block[0] += 128<<3;
s->dsp.idct_put(
@@ -1522,7 +1525,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)
stride,
block);
} else {
- if (vp3_dequant(s, s->all_fragments + i, plane, 1, block)) {
+ int index = vp3_dequant(s, s->all_fragments + i, plane, 1, block);
+ if (index > 63)
+ continue;
+ if (index > 0) {
s->dsp.idct_add(
output_plane + first_pixel,
stride,
diff --git a/libavcodec/wma.c b/libavcodec/wma.c
index 67599b7eab..8f464619c2 100644
--- a/libavcodec/wma.c
+++ b/libavcodec/wma.c
@@ -137,6 +137,9 @@ int ff_wma_init(AVCodecContext *avctx, int flags2)
/* compute MDCT block size */
s->frame_len_bits = ff_wma_get_frame_len_bits(s->sample_rate, s->version, 0);
+ s->next_block_len_bits = s->frame_len_bits;
+ s->prev_block_len_bits = s->frame_len_bits;
+ s->block_len_bits = s->frame_len_bits;
s->frame_len = 1 << s->frame_len_bits;
if (s->use_variable_block_len) {
diff --git a/libswscale/utils.c b/libswscale/utils.c
index 984f2c52fa..bdbc5bcadc 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -44,6 +44,7 @@
#include "libavutil/cpu.h"
#include "libavutil/avutil.h"
#include "libavutil/bswap.h"
+#include "libavutil/mathematics.h"
#include "libavutil/opt.h"
#include "libavutil/pixdesc.h"