aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * vp56: error out on invalid stream dimensions.Ronald S. Bultje2012-02-292-1/+10
| | | | | | | | | | | | | | | | | | | | Prevents crashes when playing corrupt vp5/6 streams. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 8bc396fc0e8769a056375c1c211f389ce0e3ecc5) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * asf: don't seek back on EOF.Ronald S. Bultje2012-02-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Seeking back on EOF will reset the EOF flag, causing us to re-enter the loop to find the next marker in the ASF file, thus potentially causing an infinite loop. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit bb6d5411e1e1a8e0608b1af1c4addee654dcbac5) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * asf: error out on ridiculously large minpktsize values.Ronald S. Bultje2012-02-291-1/+5
| | | | | | | | | | | | | | | | | | | | They cause various issues further down in demuxing. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 6e57a02b9f639af53acfa9fc742c1341400818f8) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * lavf: add functions for accessing the fourcc<->CodecID mapping tables.Anton Khirnov2012-02-295-28/+64
| | | | | | | | | | | | | | | | | | | | | | Fixes bug 212. (cherry picked from commit dd6d3b0e025cb2a16022665dbb8ab1be18dc05e8) Conflicts: doc/APIchanges Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * avutil: make intfloat api publicPaul B Mahol2012-02-293-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The functions are already av_ prefixed and intfloat header is already provided. Install libavutil/intfloat.h Signed-off-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net> (cherry picked from commit 8b933129b932f523a746e921a0a20b8dd8816971) Conflicts: doc/APIchanges Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * mjpegbdec: Fix overflow in SOS.Alex Converse2012-02-281-2/+5
| | | | | | | | | | | | | | | | | | | | | | Based in part by a fix from Michael Niedermayer <michaelni@gmx.at> Fixes CVE-2011-3947 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind (cherry picked from commit b57d262412204e54a7ef8fa1b23ff4dcede622e5) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * oma: don't read beyond end of leaf_table.Ronald S. Bultje2012-02-281-1/+1
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 934cd18a43151ba4b819d9270d539cdb26f6e079) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * Indeo3: fix crashes on corrupt bitstreams.Ronald S. Bultje2012-02-281-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | Splits at borders of cells are invalid, since it leaves one of the cells with a width/height of zero. Also, propagate errors on buffer allocation failures, so we don't continue decoding (which crashes). Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit fc9bc08dca9ac32526251e19fcf738d23b8c68d1) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * vorbis: fix overflows in floor1[] vector and inverse db table index.Ronald S. Bultje2012-02-262-15/+14
| | | | | | | | | | | | (cherry picked from commit 24947d4988012f1f0fd467c83418615adc11c3e8) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * Fix parser not to clobber has_b_frames when extradata is set.Reinhard Tartler2012-02-261-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Because in contrast to the decoder, the parser does not setup low_delay. The code in parse_nal_units would always end up setting has_b_frames to "1", except when stream is explicitly marked as low delay. Since the parser itself would create 'extradata', simply reopening the parser would cause this. This happens for instance in estimate_timings_from_pts(), which causes the parser to be reopened on the same stream. This fixes Libav #22 and FFmpeg (trac) #360 CC: libav-stable@libav.org Based on a patch by Reimar Döffinger <Reimar.Doeffinger@gmx.de> (commit 31ac0ac29b6bba744493f7d1040757a3f51b9ad7) Comments and description adapted by Reinhard Tartler. Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 790a367d9ecd04360f78616765ee723f3fe65645) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * rm: prevent infinite loops for index parsing.Ronald S. Bultje2012-02-261-3/+17
| | | | | | | | | | | | | | | | | | | | | | | | Specifically, prevent jumping back in the file for the next index, since this can lead to infinite loops where we jump between indexes referring to each other, and don't read indexes that don't fit in the file. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit aac07a7a4c2c7a4a29cf6dbc88c1b9fdd191b99d) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * fraps: release reference buffer on pix_fmt change.Ronald S. Bultje2012-02-261-7/+7
| | | | | | | | | | | | | | | | | | | | | | Prevents crash when trying to copy from a non-existing plane in e.g. a RGB32 reference image to a YUV420P target image Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 830f70442a87a31f7c75565e9380e3caf8333b8a) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * kgv1: release reference picture on size change.Ronald S. Bultje2012-02-261-1/+4
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 6c4c27adb61b2881a94ce5c7d97ee1c8adadb5fe) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * kgv1: use avctx->get/release_buffer().Ronald S. Bultje2012-02-261-25/+39
| | | | | | | | | | | | | | | | | | | | Also fixes crashes on corrupt bitstreams. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 33cd32b389864f2437c94e6fd7dc109ff5f0ed06) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * lcl: error out if uncompressed input buffer is smaller than framesize.Ronald S. Bultje2012-02-261-1/+22
| | | | | | | | | | | | | | | | | | | | | | This prevents crashes when trying to read beyond the end of the buffer while decoding frame data. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit be129271eac04f91393bf42a490ec631e1a9abea) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * mjpeg: abort decoding if packet is too large.Ronald S. Bultje2012-02-261-0/+4
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit ab492ca2ab105aeb24d955f3f03756bdb3139ee1) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * tiff: Prevent overreads in the type_sizes array.Alex Converse2012-02-261-4/+11
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 447363870f2f91e125e07ac2d0820359a5d86b06) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * swf: check return values for av_get/new_packet().Ronald S. Bultje2012-02-261-5/+9
| | | | | | | | | | | | | | | | | | | | Prevents crashers when using the packet if allocation failed. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 31632e73f47d25e2077fce729571259ee6354854) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * truemotion2: error out if the huffman tree has no nodes.Ronald S. Bultje2012-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | This prevents crashers and errors further down when reading nodes in the empty tree. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 2b83e8b7005d531bc78b0fd4f699e9faa54ce9bb) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * rmdec: when using INT4 deinterleaving, error out if sub_packet_h <= 1.Ronald S. Bultje2012-02-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | We read sub_packet_h / 2 packets per line of data (during deinterleaving), which equals zero if sub_packet_h <= 1, thus causing us to not read any data, leading to an infinite loop. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit e30b3e59a4f3004337cb1623b2aac988ce52b93f) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * avplay: fix -threads optionJanne Grunau2012-02-261-12/+0
| | | | | | | | | | | | | | | | | | | | | | The AVOptions based default to threads auto in 2473a45c8 works only if avplay does not use custom option handling for -threads. CC: <libav-stable@libav.org> (cherry picked from commit e48a70e6da02cd5426b6340af70410bdfe27dfa7) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * vc1parse: call vc1_init_common().Ronald S. Bultje2012-02-263-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The parser uses VLC tables initialized in vc1_common_init(), therefore we should call this function on parser init also. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit c742ab4e81bb9dcabfdab006d6b8b09a5808c4ce) Conflicts: libavcodec/vc1.h Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * wma: don't return 0 on invalid packets.Ronald S. Bultje2012-02-261-2/+6
| | | | | | | | | | | | | | | | | | | | | | Return 0 means "please return the same data again", i.e. it causes an infinite loop. Instead, return an error. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 9d3050d3e95e307ebc34a943484c7add838d1220) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * mjpegb: don't return 0 at the end of frame decoding.Ronald S. Bultje2012-02-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Return 0 indicates "please return the same data again", i.e. it causes an infinite loop. Instead, return that we consumed the buffer if we finished decoding succesfully, or return an error if an error occurred. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 74699ac8c8b562e9f8d26e21482b89585365774a) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * asf: prevent packet_size_left from going negative if hdrlen > pktlen.Ronald S. Bultje2012-02-261-0/+7
| | | | | | | | | | | | | | | | | | | | | | This prevents failed assertions further down in the packet processing where we require non-negative values for packet_size_left. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 41afac7f7a67c634c86b1d17fc930e9183d4aaa0) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * aiff: don't skip block_align==0 check on COMM-after-SSND files.Ronald S. Bultje2012-02-261-2/+2
| | | | | | | | | | | | | | | | | | | | This prevents SIGFPEs when using block_align for divisions. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 32a659c758bf2ddd8ad48f18c06fa77444341286) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * mp3on4: require a minimum framesize.Ronald S. Bultje2012-02-261-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | If bufsize < headersize, init_get_bits() will be called with a negative number, causing it to fail and any subsequent call to get_bits() will crash because it reads from a NULL pointer. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 3e13005cac6e076053276b515f5fcf59a3f4b65d) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * huffyuv: error out on bit overrun.Ronald S. Bultje2012-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | On EOF, get_bits() will continuously return 0, causing an infinite loop. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 84c202cc37024bd78261e4222e46631ea73c48dd) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * als: prevent infinite loop in zero_remaining().Ronald S. Bultje2012-02-261-1/+1
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit af468015d972c0dec5c8c37b2685ffa5cbe4ae87) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * cook: prevent div-by-zero if channels is zero.Ronald S. Bultje2012-02-261-0/+4
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 941fc1ea1ed7f7d99a8b9e2607b41f2f2820394a) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * vc1: prevent using last_frame as a reference for I/P first frame.Ronald S. Bultje2012-02-261-2/+9
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit ae591aeea58d64399b8281be31dacec0de85ae04) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * swscale: take first/lastline over/underflows into account for MMX.Ronald S. Bultje2012-02-261-0/+38
| | | | | | | | | | | | | | | | | | | | Fixes crashes for extremely large resizes (several 100-fold). Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 1d8c4af396b6ed84c84b5ebf0bf1163c4a7a3017) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * swscale: fix overflows in filterPos[] calculation for large sizes.Ronald S. Bultje2012-02-261-7/+7
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 19a65b5be47944c607a9e979edb098924d95f2e4) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * swscale: enforce a minimum filtersize.Ronald S. Bultje2012-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | At very small dimensions, this calculation could lead to zero-sized filters, which leads to uninitialized output, zero-sized allocations, loop overflows in SIMD that uses do{..}while(i++<filtersize); instead of for(i=0;i<filtersize;i++){..} and several other similar failures. Therefore, require a minimum filtersize of 1. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit dae2ce361a2b5fd9be1d43e5e8c00bdbc5f03e3d) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * tta: error out if samplerate is zero.Ronald S. Bultje2012-02-261-0/+3
| | | | | | | | | | | | | | | | | | | | Prevents a division by zero later on. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 7416d610362807848236ceff1bc6740dbc82842d) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * vc1: prevent null pointer dereference on broken filesJanne Grunau2012-02-261-1/+1
| | | | | | | | | | | | | | CC: libav-stable@libav.org (cherry picked from commit 510ef04a461b3b54a762c6141ad880cbed85981f) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * smacker: Sanity check huffman tables found in the headers.Alex Converse2012-02-261-9/+13
| | | | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 9adf25c1cf78dbf1d71bf386c49dc74cb8a60df0) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * lavf: prevent infinite loops while flushing in avformat_find_stream_infoJanne Grunau2012-02-261-8/+14
| | | | | | | | | | | | | | | | | | | | | | | | If no data was seen for a stream decoder are returning 0 when fed with empty packets for flushing. We can stop flushing when the decoder does not return delayed delayed frames anymore. Changes try_decode_frame() return value to got_picture or negative error. CC: libav-stable@libav.org (cherry picked from commit b3461c29c1aee7d62eeb02a59d46593c60362679) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * matroska: don't overwrite string values until read/alloc was succesful.Ronald S. Bultje2012-02-261-5/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This prevents certain tags with a default value assigned to them (as per the EBML syntax elements) from ever being assigned a NULL value. Other parts of the code rely on these being non-NULL (i.e. they don't check for NULL before e.g. using the string in strcmp() or similar), and thus in effect this prevents crashes when reading of such specific tags fails, either because of low memory or because of targeted file corruption. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit cd40c31ee9ad2cca6f3635950b002fd46be07e98) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * matroskadec: Pad AAC extradata.Alex Converse2012-02-261-1/+1
| | | | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit d2ee8c17793201ce969afd1f433ba1580c143cd2) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * aac: fix infinite loop on end-of-frame with sequence of 1-bits.Alex Converse2012-02-261-12/+13
| | | | | | | | | | | | | | | | | | Based-on-work-by: Ronald S. Bultje <rsbultje@gmail.com> Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 1cd9a6154bc1ac1193c703cea980ed21c3e53792) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * wma: Clip WMA1 and WMA2 frame length to 11 bits.Alex Converse2012-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The MDCT buffers in the decoder are only sized for up to 11 bits. The reverse engineered documentation for WMA1/2 headers say that that for all samplerates above 32kHz 11 bits are used. 12 and 13 bit support were added for WMAPro. I was unable to make any Microsoft tools generate a test file at a samplerate above 48kHz. Discovered by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit d78bb1a4b2a3a415b68e4e6dd448779eccec64e3) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * rv20: prevent calling ff_h263_decode_mba() with unset height/widthJanne Grunau2012-02-261-1/+2
| | | | | | | | | | | | | | | | | | | | Prevents a crash of VLC during playback of a invalid matroska file, found by John Villamil <johnv@matasano.com>. CC: libav-stable@libav.org (cherry picked from commit c3e10ae4127c998b809066926a410f40ebd47593) Signed-off-by: Anton Khirnov <anton@khirnov.net>
| * flac: fix infinite loops on all-zero input or end-of-stream.Ronald S. Bultje2012-02-262-1/+10
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 52e4018be47697a60f4f18f83551766df31f5adf) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * golomb: use HAVE_BITS_REMAINING() macro to prevent infloop on EOF.Ronald S. Bultje2012-02-261-1/+1
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 46b3fbc30b7aaf7fdd52391734cfd6d93af8720a) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * get_bits: add HAVE_BITS_REMAINING macro.Ronald S. Bultje2012-02-261-1/+14
| | | | | | | | | | | | (cherry picked from commit b44b41633f110e9d938165e0f79c9d32191fc135) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * golomb: avoid infinite loop on all-zero input (or end of buffer).Ronald S. Bultje2012-02-261-2/+2
| | | | | | | | | | | | | | | | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit c6643fddba73560f26f90d327c84d8832222a720) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * shorten: Use separate pointers for the allocated memory for decoded samples.Michael Niedermayer2012-02-261-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes invalid free() if any of the buffers are not allocated due to either not decoding a header or an error prior to allocating all buffers. Fixes CVE-2012-0858 CC: libav-stable@libav.org Signed-off-by: Michael Niedermayer <michaelni@gmx.at> Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com> (cherry picked from commit 204cb29b3c84a74cbcd059d353c70c8bdc567d98) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * atrac3: Fix crash in tonal component decoding.Michael Niedermayer2012-02-261-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a check to avoid writing past the end of the channel_unit.components[] array. Bug Found by: cosminamironesei Fixes CVE-2012-0853 CC: libav-stable@libav.org Signed-off-by: Michael Niedermayer <michaelni@gmx.at> Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com> (cherry picked from commit c509f4f74713b035a06f79cb4d00e708f5226bc5) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| * ws_snd1: Fix wrong samples count and crash.Michael Niedermayer2012-02-261-2/+2
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 9fb7a5af97d8c084c3af2566070d09eae0ab49fc) Addresses CVE-2012-0848 Reviewed-by: Justin Ruggles <justin.ruggles@gmail.com> Signed-off-by: Reinhard Tartler <siretart@tauware.de>
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-31 06:48:51 +0000