diff options
| author | Michael Niedermayer <[email protected]> | 2013-09-07 14:27:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <[email protected]> | 2013-09-07 14:29:09 +0200 |
| commit | de5e00336988ccff74715bcad0c7697ea8c57baf (patch) | |
| tree | c809ec6c8856dfe667f9d264d12c14904a1b481b | |
| parent | 5c6aea5c31bf2a2f3343a051f6b39a62b245878e (diff) | |
| parent | b01e4d80c69da83d765263dd774fbbc4a2944b97 (diff) | |
Merge remote-tracking branch 'qatar/release/9' into release/1.1
* qatar/release/9:
mpegvideo: Avoid 32-bit wrapping of linesize multiplications
mjpegb: Detect changing number of planes in interlaced video
alac: Check that the channels fit at the given offset
4xm: Check that the read track value is non-negative
Conflicts:
libavcodec/alac.c
libavcodec/mjpegdec.c
Merged-by: Michael Niedermayer <[email protected]>
| -rw-r--r-- | libavcodec/alac.c | 5 | ||||
| -rw-r--r-- | libavcodec/mjpegdec.c | 3 | ||||
| -rw-r--r-- | libavformat/4xm.c | 2 |
3 files changed, 6 insertions, 4 deletions
diff --git a/libavcodec/alac.c b/libavcodec/alac.c index 68e4b75c91..072cac3245 100644 --- a/libavcodec/alac.c +++ b/libavcodec/alac.c @@ -462,9 +462,8 @@ static int alac_decode_frame(AVCodecContext *avctx, void *data, } channels = (element == TYPE_CPE) ? 2 : 1; - if ( ch + channels > alac->channels - || ff_alac_channel_layout_offsets[alac->channels - 1][ch] + channels > alac->channels - ) { + if (ch + channels > alac->channels || + ff_alac_channel_layout_offsets[alac->channels - 1][ch] + channels > alac->channels) { av_log(avctx, AV_LOG_ERROR, "invalid element channel count\n"); return AVERROR_INVALIDDATA; } diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 0c9bb3d866..60d3b70d65 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -254,7 +254,8 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) return -1; if (s->interlaced && (s->bottom_field == !s->interlace_polarity)) { if (nb_components != s->nb_components) { - av_log(s->avctx, AV_LOG_ERROR, "nb_components changing in interlaced picture\n"); + av_log(s->avctx, AV_LOG_ERROR, + "nb_components changing in interlaced picture\n"); return AVERROR_INVALIDDATA; } } diff --git a/libavformat/4xm.c b/libavformat/4xm.c index 7f85bcadbd..ab02b0a530 100644 --- a/libavformat/4xm.c +++ b/libavformat/4xm.c @@ -135,6 +135,8 @@ static int parse_strk(AVFormatContext *s, av_log(s, AV_LOG_ERROR, "current_track too large\n"); return AVERROR_INVALIDDATA; } + if (track < 0) + return AVERROR_INVALIDDATA; if (track + 1 > fourxm->track_count) { fourxm->tracks = av_realloc_f(fourxm->tracks, track + 1, sizeof(AudioTrack)); if (!fourxm->tracks) |