diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-11-21 19:41:08 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-11-21 19:41:08 +0100 |
| commit | a12dec46995929622aae45e7f68c0f989110be56 (patch) | |
| tree | 3ae0c8da6675d0e515a95c0a7b6c899a50ee8f13 /libavcodec/vp3.c | |
| parent | 87ae12009ea489c5c34e953b2b0194a8ba669fb2 (diff) | |
| parent | 661ee45f8881bb551eb403472e60c38a7c2818aa (diff) | |
| download | ffmpeg-a12dec46995929622aae45e7f68c0f989110be56.tar.gz | |
Merge branch 'release/0.8' into release/0.7
* release/0.8: (31 commits)
svq1dec: call avcodec_set_dimensions() after dimensions changed. Fixes NGS00148
vp3dec: Check coefficient index in vp3_dequant() Fixes NGS00145
qdm2dec: fix buffer overflow. Fixes NGS00144
h264: Fix invalid interlaced progressive MB combinations for direct mode prediction. Fixes Ticket312
mpegvideo: dont use ff_mspel_motion() for vc1 Fixes Ticket655
imgutils: Fix illegal read.
ac3probe: Detect Sonic Foundry Soft Encode AC3 as raw AC3. Our ac3 code chain can handle it fine. More ideal would be to write a demuxer that actually extracts what can be from the additional headers and uses it for whatever it can be used for.
mjpeg: support mpo Fixes stereoscopic_photo.mpo
Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info.
lavf: fix multiplication overflow in avformat_find_stream_info()
lavf: fix invalid reads in avformat_find_stream_info()
lavf: add avformat_find_stream_info()
lavc: fix parentheses placement in avcodec_open2().
lavc: introduce avcodec_open2() as a replacement for avcodec_open().
rawdec: use a default sample rate if none is specified. Fixes "ffmpeg -f s16le -i /dev/zero"
rawdec: add check on sample_rate
qdm2dec: check remaining input bits in the mainloop of qdm2_fft_decode_tones() This is neccessary but likely not sufficient to prevent out of array reads.
cinepak: check strip_size
wma: Check channel number before init. Fixes Ticket240
Do not try to read 16bit gray png files with alpha channel.
...
Conflicts:
libavcodec/version.h
libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vp3.c')
| -rw-r--r-- | libavcodec/vp3.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c index 549f494ff6..2f07af8c4b 100644 --- a/libavcodec/vp3.c +++ b/libavcodec/vp3.c @@ -1308,6 +1308,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag, case 1: // zero run s->dct_tokens[plane][i]++; i += (token >> 2) & 0x7f; + if(i>63){ + av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n"); + return -1; + } block[perm[i]] = (token >> 9) * dequantizer[perm[i]]; i++; break; |