Packman Build Service PMBS

ffmpeg-2.changes Changed

ffmpeg-2.spec Changed

_service Changed

ffmpeg-2-2.8.21.tar.xz/CREDITS -> ffmpeg-2-2.8.22.tar.xz/CREDITS Changed

ffmpeg-2-2.8.21.tar.xz/Changelog -> ffmpeg-2-2.8.22.tar.xz/Changelog Changed

@@ -1,6 +1,75 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+2.8.22:
+ avformat/rtsp: Use rtsp_st->stream_index
+ avcodec/jpeg2000dec: Check image offset
+ Update for FFmpeg 2.8.22
+ avcodec/xvididct: Make c* unsigned to avoid undefined overflows
+ avformat/tmv: Check video chunk size
+ avformat/matroskadec: Check prebuffered_ns for overflow
+ avformat/wavdec: Check left avio_tell for overflow
+ avformat/tta: Better totalframes check
+ avformat/rpl: Check for number_of_chunks overflow
+ avformat/jacosubdec: Check timeres
+ avcodec/escape124: Do not return random numbers
+ avformat/avs: Check if return code is representable
+ avcodec/lcldec: Make PNG filter addressing match the code afterwards
+ avformat/westwood_vqa: Check chunk size
+ avformat/sbgdec: Check for period overflow
+ avcodec/xvididct: Fix integer overflow in idct_row()
+ avcodec/celp_math: avoid overflow in shift
+ avformat/format: Stop reading data at EOF during probing
+ avcodec/huffyuvdec: avoid undefined behavior with get_vlc2() failure
+ avcodec/mpeg4videodec: more unsigned in amv computation
+ avcodec/tta: fix signed overflow in decorrelate
+ avcodec/xvididct: Fix integer overflow in idct_row()
+ avcodec/jpeg2000dec: Check for reduction factor and image offset
+ avutil/softfloat: Basic documentation for av_sincos_sf()
+ avutil/softfloat: fix av_sincos_sf()
+ avcodec/utils: fix 2 integer overflows in get_audio_frame_duration()
+ avcodec/hevcdec: Avoid null pointer dereferences in MC
+ avcodec: Ignoring errors is only possible before the input end
+ avformat/wavdec: Check that smv block fits in available space
+ avcodec/tak: Check remaining bits in ff_tak_decode_frame_header()
+ avcodec/utils: the IFF_ILBM implementation assumes that there are a multiple of 16 allocated
+ avcodec/pngdec: Do not pass AVFrame into global header decode
+ avcodec/vorbisdec: Check codebook float values to be finite
+ avcodec/lcldec: More space for rgb24
+ avcodec/lcldec: Support 4:1:1 and 4:2:2 with odd width
+ libavcodec/lcldec: width and height should not be unsigned
+ avcodec/escape124: Check that blocks are allocated before use
+ avcodec/huffyuvdec: Fix undefined behavior with shift
+ avcodec/vp3: Check width to avoid assertion failure
+ avcodec/g729postfilter: Limit shift in long term filter
+ configure: update copyright year
+ avcodec/vp3: Add missing check for av_malloc
+ avcodec/escape124: Fix some return codes
+ avcodec/escape124: fix signdness of end of input check
+ Use https for repository links
+ avcodec/motionpixels: Mask pixels to valid values
+ avcodec/bink: Avoid undefined out of array end pointers in binkb_decode_plane()
+ avcodec/bink: Fix off by 1 error in ref end
+ avcodec/utils: Ensure linesize for SVQ3
+ avcodec/utils: allocate a line more for VC1 and WMV3
+ avcodec/videodsp_template: Adjust pointers to avoid undefined pointer things
+ avcodec/pngdec: Check deloco index more exactly
+ avcodec/ffv1dec: Check that num h/v slices is supported
+ avformat/mov: Check samplesize and offset to avoid integer overflow
+ avcodec/pictordec: Remove mid exit branch
+ avcodec/utils: use 32pixel alignment for bink
+ avcodec/012v: Order operations for odd size handling
+ avcodec/eatgq: : Check index increments in tgq_decode_block()
+ avcodec/sunrast: Fix maplength check
+ avcodec/wavpack: Avoid undefined shift in get_tail()
+ avformat/id3v2: Check taglen in read_uslt()
+ avcodec/ffv1dec: restructure slice coordinate reading a bit
+ avcodec/mlpdec: Check max matrix instead of max channel in noise check
+ swscale/input: Use more unsigned intermediates
+ avcodec/alsdec: The minimal block is at least 7 bits
+ avformat/replaygain: avoid undefined / negative abs
+ avcodec/ffv1dec: Fail earlier if prior context is corrupted
+
 version 2.8.21:
  avformat/rmdec: check tag_size
  avformat/nutdec: Check fields

ffmpeg-2-2.8.21.tar.xz/RELEASE -> ffmpeg-2-2.8.22.tar.xz/RELEASE Changed

ffmpeg-2-2.8.21.tar.xz/configure -> ffmpeg-2-2.8.22.tar.xz/configure Changed

ffmpeg-2-2.8.21.tar.xz/doc/Doxyfile -> ffmpeg-2-2.8.22.tar.xz/doc/Doxyfile Changed

ffmpeg-2-2.8.21.tar.xz/doc/authors.texi -> ffmpeg-2-2.8.22.tar.xz/doc/authors.texi Changed

ffmpeg-2-2.8.21.tar.xz/doc/git-howto.texi -> ffmpeg-2-2.8.22.tar.xz/doc/git-howto.texi Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/012v.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/012v.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/alsdec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/alsdec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/bink.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/bink.c Changed

@@ -825,7 +825,7 @@
 
     binkb_init_bundles(c);
     ref_start = frame->dataplane_idx;
-    ref_end   = frame->dataplane_idx + (bh * frame->linesizeplane_idx + bw) * 8;
+    ref_end   = frame->dataplane_idx + ((bh - 1) * frame->linesizeplane_idx + bw - 1) * 8;
 
     for (i = 0; i < 64; i++)
         coordmapi = (i & 7) + (i >> 3) * stride;
@@ -879,7 +879,7 @@
                 xoff = binkb_get_value(c, BINKB_SRC_X_OFF);
                 yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;
                 ref = dst + xoff + yoff * stride;
-                if (ref < ref_start || ref + 8*stride > ref_end) {
+                if (ref < ref_start || ref > ref_end) {
                     av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");
                 } else if (ref + 8*stride < dst || ref >= dst + 8*stride) {
                     c->hdsp.put_pixels_tab10(dst, ref, stride, 8);
@@ -895,7 +895,7 @@
                 xoff = binkb_get_value(c, BINKB_SRC_X_OFF);
                 yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;
                 ref = dst + xoff + yoff * stride;
-                if (ref < ref_start || ref + 8 * stride > ref_end) {
+                if (ref < ref_start || ref > ref_end) {
                     av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");
                 } else if (ref + 8*stride < dst || ref >= dst + 8*stride) {
                     c->hdsp.put_pixels_tab10(dst, ref, stride, 8);
@@ -925,7 +925,7 @@
                 xoff = binkb_get_value(c, BINKB_SRC_X_OFF);
                 yoff = binkb_get_value(c, BINKB_SRC_Y_OFF) + ybias;
                 ref = dst + xoff + yoff * stride;
-                if (ref < ref_start || ref + 8 * stride > ref_end) {
+                if (ref < ref_start || ref > ref_end) {
                     av_log(c->avctx, AV_LOG_WARNING, "Reference block is out of bounds\n");
                 } else if (ref + 8*stride < dst || ref >= dst + 8*stride) {
                     c->hdsp.put_pixels_tab10(dst, ref, stride, 8);

ffmpeg-2-2.8.21.tar.xz/libavcodec/celp_math.h -> ffmpeg-2-2.8.22.tar.xz/libavcodec/celp_math.h Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/eatgq.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/eatgq.c Changed

@@ -58,7 +58,7 @@
     return 0;
 }
 
-static void tgq_decode_block(TgqContext *s, int16_t block64, GetBitContext *gb)
+static int tgq_decode_block(TgqContext *s, int16_t block64, GetBitContext *gb)
 {
     uint8_t *perm = s->scantable.permutated;
     int i, j, value;
@@ -66,6 +66,8 @@
     for (i = 1; i < 64;) {
         switch (show_bits(gb, 3)) {
         case 4:
+            if (i >= 63)
+                return AVERROR_INVALIDDATA;
             blockpermi++ = 0;
         case 0:
             blockpermi++ = 0;
@@ -75,6 +77,8 @@
         case 1:
             skip_bits(gb, 2);
             value = get_bits(gb, 6);
+            if (value > 64 - i)
+                return AVERROR_INVALIDDATA;
             for (j = 0; j < value; j++)
                 blockpermi++ = 0;
             break;
@@ -102,6 +106,7 @@
         }
     }
     block0 += 128 << 4;
+    return 0;
 }
 
 static void tgq_idct_put_mb(TgqContext *s, int16_t (*block)64, AVFrame *frame,
@@ -161,8 +166,11 @@
         if (ret < 0)
             return ret;
 
-        for (i = 0; i < 6; i++)
-            tgq_decode_block(s, s->blocki, &gb);
+        for (i = 0; i < 6; i++) {
+            int ret = tgq_decode_block(s, s->blocki, &gb);
+            if (ret < 0)
+                return ret;
+        }
         tgq_idct_put_mb(s, s->block, frame, mb_x, mb_y);
         bytestream2_skip(&s->gb, mode);
     } else {

ffmpeg-2-2.8.21.tar.xz/libavcodec/escape124.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/escape124.c Changed

@@ -89,11 +89,6 @@
     unsigned i, j;
     CodeBook cb = { 0 };
 
-    if (size >= INT_MAX / 34 || get_bits_left(gb) < size * 34)
-        return cb;
-
-    if (size >= INT_MAX / sizeof(MacroBlock))
-        return cb;
     cb.blocks = av_malloc(size ? size * sizeof(MacroBlock) : 1);
     if (!cb.blocks)
         return cb;
@@ -163,7 +158,7 @@
 
     // This condition can occur with invalid bitstreams and
     // *codebook_index == 2
-    if (block_index >= s->codebooks*codebook_index.size)
+    if (block_index >= s->codebooks*codebook_index.size || !s->codebooks*codebook_index.blocks)
         return (MacroBlock) { { 0 } };
 
     return s->codebooks*codebook_index.blocksblock_index;
@@ -227,7 +222,7 @@
     // represent a lower bound of the space needed for skipped superblocks. Non
     // skipped SBs need more space.
     if (get_bits_left(&gb) < 64 + s->num_superblocks * 23LL / 4320)
-        return -1;
+        return AVERROR_INVALIDDATA;
 
     frame_flags = get_bits_long(&gb, 32);
     frame_size  = get_bits_long(&gb, 32);
@@ -244,7 +239,7 @@
         if ((ret = av_frame_ref(frame, s->frame)) < 0)
             return ret;
 
-        return frame_size;
+        return 0;
     }
 
     for (i = 0; i < 3; i++) {
@@ -273,9 +268,14 @@
                 }
             }
             av_freep(&s->codebooksi.blocks);
+            if (cb_size >= INT_MAX / 34 || get_bits_left(&gb) < (int)cb_size * 34)
+                return AVERROR_INVALIDDATA;
+
+            if (cb_size >= INT_MAX / sizeof(MacroBlock))
+                return AVERROR_INVALIDDATA;
             s->codebooksi = unpack_codebook(&gb, cb_depth, cb_size);
             if (!s->codebooksi.blocks)
-                return -1;
+                return AVERROR(ENOMEM);
         }
     }
 
@@ -368,7 +368,7 @@
 
     *got_frame = 1;
 
-    return frame_size;
+    return 0;
 }

ffmpeg-2-2.8.21.tar.xz/libavcodec/ffv1dec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/ffv1dec.c Changed

@@ -284,24 +284,31 @@
     RangeCoder *c = &fs->c;
     uint8_t stateCONTEXT_SIZE;
     unsigned ps, i, context_count;
+    int sx, sy, sw, sh;
+
     memset(state, 128, sizeof(state));
+    sx = get_symbol(c, state, 0);
+    sy = get_symbol(c, state, 0);
+    sw = get_symbol(c, state, 0) + 1U;
+    sh = get_symbol(c, state, 0) + 1U;
 
     av_assert0(f->version > 2);
 
-    fs->slice_x      =  get_symbol(c, state, 0)      * f->width ;
-    fs->slice_y      =  get_symbol(c, state, 0)      * f->height;
-    fs->slice_width  = (get_symbol(c, state, 0) + 1) * f->width  + fs->slice_x;
-    fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;
-
-    fs->slice_x /= f->num_h_slices;
-    fs->slice_y /= f->num_v_slices;
-    fs->slice_width  = fs->slice_width /f->num_h_slices - fs->slice_x;
-    fs->slice_height = fs->slice_height/f->num_v_slices - fs->slice_y;
-    if ((unsigned)fs->slice_width > f->width || (unsigned)fs->slice_height > f->height)
-        return -1;
-    if (    (unsigned)fs->slice_x + (uint64_t)fs->slice_width  > f->width
-         || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
-        return -1;
+
+    if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
+        return AVERROR_INVALIDDATA;
+    if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
+        return AVERROR_INVALIDDATA;
+
+    fs->slice_x      =  sx       * (int64_t)f->width  / f->num_h_slices;
+    fs->slice_y      =  sy       * (int64_t)f->height / f->num_v_slices;
+    fs->slice_width  = (sx + sw) * (int64_t)f->width  / f->num_h_slices - fs->slice_x;
+    fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
+
+    av_assert0((unsigned)fs->slice_width  <= f->width &&
+                (unsigned)fs->slice_height <= f->height);
+    av_assert0 (   (unsigned)fs->slice_x + (uint64_t)fs->slice_width  <= f->width
+                && (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
 
     for (i = 0; i < f->plane_count; i++) {
         PlaneContext * const p = &fs->planei;
@@ -416,8 +423,11 @@
     }
     if ((ret = ff_ffv1_init_slice_state(f, fs)) < 0)
         return ret;
-    if (f->cur->key_frame || fs->slice_reset_contexts)
+    if (f->cur->key_frame || fs->slice_reset_contexts) {
         ff_ffv1_clear_slice_state(f, fs);
+    } else if (fs->slice_damaged) {
+        return AVERROR_INVALIDDATA;
+    }
 
     width  = fs->slice_width;
     height = fs->slice_height;
@@ -569,6 +579,11 @@
         return AVERROR_INVALIDDATA;
     }
 
+    if (f->num_h_slices > MAX_SLICES / f->num_v_slices) {
+        av_log(f->avctx, AV_LOG_ERROR, "slice count unsupported\n");
+        return AVERROR_PATCHWELCOME;
+    }
+
     f->quant_table_count = get_symbol(c, state, 0);
     if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count) {
         av_log(f->avctx, AV_LOG_ERROR, "quant table count %d is invalid\n", f->quant_table_count);
@@ -814,21 +829,25 @@
         fs->slice_damaged = 0;
 
         if (f->version == 2) {
-            fs->slice_x      =  get_symbol(c, state, 0)      * f->width ;
-            fs->slice_y      =  get_symbol(c, state, 0)      * f->height;
-            fs->slice_width  = (get_symbol(c, state, 0) + 1) * f->width  + fs->slice_x;
-            fs->slice_height = (get_symbol(c, state, 0) + 1) * f->height + fs->slice_y;
-
-            fs->slice_x     /= f->num_h_slices;
-            fs->slice_y     /= f->num_v_slices;
-            fs->slice_width  = fs->slice_width  / f->num_h_slices - fs->slice_x;
-            fs->slice_height = fs->slice_height / f->num_v_slices - fs->slice_y;
-            if ((unsigned)fs->slice_width  > f->width ||
-                (unsigned)fs->slice_height > f->height)
+            int sx = get_symbol(c, state, 0);
+            int sy = get_symbol(c, state, 0);
+            int sw = get_symbol(c, state, 0) + 1U;
+            int sh = get_symbol(c, state, 0) + 1U;
+
+            if (sx < 0 || sy < 0 || sw <= 0 || sh <= 0)
                 return AVERROR_INVALIDDATA;
-            if (   (unsigned)fs->slice_x + (uint64_t)fs->slice_width  > f->width
-                || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
+            if (sx > f->num_h_slices - sw || sy > f->num_v_slices - sh)
                 return AVERROR_INVALIDDATA;
+
+            fs->slice_x      =  sx       * (int64_t)f->width  / f->num_h_slices;
+            fs->slice_y      =  sy       * (int64_t)f->height / f->num_v_slices;
+            fs->slice_width  = (sx + sw) * (int64_t)f->width  / f->num_h_slices - fs->slice_x;
+            fs->slice_height = (sy + sh) * (int64_t)f->height / f->num_v_slices - fs->slice_y;
+
+            av_assert0((unsigned)fs->slice_width  <= f->width &&
+                       (unsigned)fs->slice_height <= f->height);
+            av_assert0 (   (unsigned)fs->slice_x + (uint64_t)fs->slice_width  <= f->width
+                        && (unsigned)fs->slice_y + (uint64_t)fs->slice_height <= f->height);
         }
 
         for (i = 0; i < f->plane_count; i++) {

ffmpeg-2-2.8.21.tar.xz/libavcodec/g729postfilter.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/g729postfilter.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/h263dec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/h263dec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/hevc.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/hevc.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/huffyuvdec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/huffyuvdec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/jpeg2000dec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/jpeg2000dec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/lcldec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/lcldec.c Changed

@@ -151,6 +151,8 @@
     if (expected != (unsigned int)c->zstream.total_out) {
         av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n",
                expected, c->zstream.total_out);
+        if (expected > (unsigned int)c->zstream.total_out)
+            return (unsigned int)c->zstream.total_out;
         return AVERROR_UNKNOWN;
     }
     return c->zstream.total_out;
@@ -173,8 +175,8 @@
     int row, col;
     unsigned char *encoded = avpkt->data, *outptr;
     uint8_t *y_out, *u_out, *v_out;
-    unsigned int width = avctx->width; // Real image width
-    unsigned int height = avctx->height; // Real image height
+    int width = avctx->width; // Real image width
+    int height = avctx->height; // Real image height
     unsigned int mszh_dlen;
     unsigned char yq, y1q, uq, vq;
     int uqvq, ret;
@@ -232,16 +234,19 @@
             break;
         case COMP_MSZH_NOCOMP: {
             int bppx2;
+            int aligned_width = width;
             switch (c->imgtype) {
             case IMGTYPE_YUV111:
             case IMGTYPE_RGB24:
                 bppx2 = 6;
                 break;
             case IMGTYPE_YUV422:
+                aligned_width &= ~3;
             case IMGTYPE_YUV211:
                 bppx2 = 4;
                 break;
             case IMGTYPE_YUV411:
+                aligned_width &= ~3;
             case IMGTYPE_YUV420:
                 bppx2 = 3;
                 break;
@@ -249,7 +254,7 @@
                 bppx2 = 0; // will error out below
                 break;
             }
-            if (len < ((width * height * bppx2) >> 1))
+            if (len < ((aligned_width * height * bppx2) >> 1))
                 return AVERROR_INVALIDDATA;
             break;
         }
@@ -281,12 +286,13 @@
             ret = zlib_decomp(avctx, buf + 8 + mthread_inlen, len - 8 - mthread_inlen,
                               mthread_outlen, mthread_outlen);
             if (ret < 0) return ret;
+            len = c->decomp_size;
         } else {
             int ret = zlib_decomp(avctx, buf, len, 0, c->decomp_size);
             if (ret < 0) return ret;
+            len = ret;
         }
         encoded = c->decomp_buf;
-        len = c->decomp_size;
         break;
 #endif
     default:
@@ -314,8 +320,8 @@
             }
             break;
         case IMGTYPE_YUV422:
+            pixel_ptr = 0;
             for (row = 0; row < height; row++) {
-                pixel_ptr = row * width * 2;
                 yq = uq = vq =0;
                 for (col = 0; col < width/4; col++) {
                     encodedpixel_ptr = yq -= encodedpixel_ptr;
@@ -331,8 +337,8 @@
             }
             break;
         case IMGTYPE_YUV411:
+            pixel_ptr = 0;
             for (row = 0; row < height; row++) {
-                pixel_ptr = row * width / 2 * 3;
                 yq = uq = vq =0;
                 for (col = 0; col < width/4; col++) {
                     encodedpixel_ptr = yq -= encodedpixel_ptr;
@@ -406,6 +412,11 @@
                 v_out col >> 1      = *encoded++ + 128;
                 v_out(col >> 1) + 1 = *encoded++ + 128;
             }
+            if (col && col < width) {
+                u_out col >> 1      = u_out(col>>1) - 1;
+                v_out col >> 1      = v_out(col>>1) - 1;
+            }
+
             y_out -= frame->linesize0;
             u_out -= frame->linesize1;
             v_out -= frame->linesize2;
@@ -427,6 +438,10 @@
                 u_outcol >> 2 = *encoded++ + 128;
                 v_outcol >> 2 = *encoded++ + 128;
             }
+            if (col && col < width) {
+                u_outcol >> 2 = u_out(col>>2) - 1;
+                v_outcol >> 2 = v_out(col>>2) - 1;
+            }
             y_out -= frame->linesize0;
             u_out -= frame->linesize1;
             v_out -= frame->linesize2;
@@ -486,6 +501,7 @@
                                 FFALIGN(avctx->height, 4);
     unsigned int max_decomp_size;
     int subsample_h, subsample_v;
+    int partial_h_supported = 0;
 
     if (avctx->extradata_size < 8) {
         av_log(avctx, AV_LOG_ERROR, "Extradata size too small.\n");
@@ -507,26 +523,24 @@
         av_log(avctx, AV_LOG_DEBUG, "Image type is YUV 1:1:1.\n");
         break;
     case IMGTYPE_YUV422:
-        c->decomp_size = basesize * 2;
+        c->decomp_size = (avctx->width & ~3) * avctx->height * 2;
         max_decomp_size = max_basesize * 2;
         avctx->pix_fmt = AV_PIX_FMT_YUV422P;
         av_log(avctx, AV_LOG_DEBUG, "Image type is YUV 4:2:2.\n");
-        if (avctx->width % 4) {
-            avpriv_request_sample(avctx, "Unsupported dimensions");
-            return AVERROR_INVALIDDATA;
-        }
+        partial_h_supported = 1;
         break;
     case IMGTYPE_RGB24:
-        c->decomp_size = basesize * 3;
+        c->decomp_size = FFALIGN(avctx->width*3, 4) * avctx->height;
         max_decomp_size = max_basesize * 3;
         avctx->pix_fmt = AV_PIX_FMT_BGR24;
         av_log(avctx, AV_LOG_DEBUG, "Image type is RGB 24.\n");
         break;
     case IMGTYPE_YUV411:
-        c->decomp_size = basesize / 2 * 3;
+        c->decomp_size = (avctx->width & ~3) * avctx->height / 2 * 3;
         max_decomp_size = max_basesize / 2 * 3;
         avctx->pix_fmt = AV_PIX_FMT_YUV411P;
         av_log(avctx, AV_LOG_DEBUG, "Image type is YUV 4:1:1.\n");
+        partial_h_supported = 1;
         break;
     case IMGTYPE_YUV211:
         c->decomp_size = basesize * 2;
@@ -546,7 +560,7 @@
     }
 
     av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &subsample_h, &subsample_v);
-    if (avctx->width % (1<<subsample_h) || avctx->height % (1<<subsample_v)) {
+    if ((avctx->width % (1<<subsample_h) && !partial_h_supported) || avctx->height % (1<<subsample_v)) {
         avpriv_request_sample(avctx, "Unsupported dimensions");
         return AVERROR_INVALIDDATA;
     }

ffmpeg-2-2.8.21.tar.xz/libavcodec/mlpdec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/mlpdec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/motionpixels.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/motionpixels.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/mpeg4videodec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/mpeg4videodec.c Changed

@@ -555,7 +555,7 @@
         for (y = 0; y < 16; y++) {
             int v;
 
-            v = mb_v + dy * y;
+            v = mb_v + (unsigned)dy * y;
             // FIXME optimize
             for (x = 0; x < 16; x++) {
                 sum += v >> shift;
@@ -1126,7 +1126,7 @@
                                 if (SHOW_UBITS(re, &s->gb, 1) == 0) {
                                     av_log(s->avctx, AV_LOG_ERROR,
                                            "1. marker bit missing in 3. esc\n");
-                                    if (!(s->avctx->err_recognition & AV_EF_IGNORE_ERR))
+                                    if (!(s->avctx->err_recognition & AV_EF_IGNORE_ERR) || get_bits_left(&s->gb) <= 0)
                                         return -1;
                                 }
                                 SKIP_CACHE(re, &s->gb, 1);
@@ -1137,7 +1137,7 @@
                                 if (SHOW_UBITS(re, &s->gb, 1) == 0) {
                                     av_log(s->avctx, AV_LOG_ERROR,
                                            "2. marker bit missing in 3. esc\n");
-                                    if (!(s->avctx->err_recognition & AV_EF_IGNORE_ERR))
+                                    if (!(s->avctx->err_recognition & AV_EF_IGNORE_ERR) || get_bits_left(&s->gb) <= 0)
                                         return -1;
                                 }

ffmpeg-2-2.8.21.tar.xz/libavcodec/pictordec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/pictordec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/pngdec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/pngdec.c Changed

@@ -306,7 +306,7 @@
 static void deloco_ ## NAME(TYPE *dst, int size, int alpha) \
 { \
     int i; \
-    for (i = 0; i < size; i += 3 + alpha) { \
+    for (i = 0; i < size - 2; i += 3 + alpha) { \
         int g = dst i + 1; \
         dsti + 0 += g; \
         dsti + 2 += g; \
@@ -618,6 +618,8 @@
     int ret;
     size_t byte_depth = s->bit_depth > 8 ? 2 : 1;
 
+    if (!p)
+        return AVERROR_INVALIDDATA;
     if (!(s->hdr_state & PNG_IHDR)) {
         av_log(avctx, AV_LOG_ERROR, "IDAT without IHDR\n");
         return AVERROR_INVALIDDATA;
@@ -1226,6 +1228,10 @@
     }
 exit_loop:
 
+    if (!p)
+        return AVERROR_INVALIDDATA;
+
+
     if (s->bits_per_pixel <= 4)
         handle_small_bpp(s, p);
 
@@ -1362,7 +1368,7 @@
         s->zstream.zfree  = ff_png_zfree;
 
         bytestream2_init(&s->gb, avctx->extradata, avctx->extradata_size);
-        if ((ret = decode_frame_common(avctx, s, p, avpkt)) < 0)
+        if ((ret = decode_frame_common(avctx, s, NULL, avpkt)) < 0)
             goto end;
     }

ffmpeg-2-2.8.21.tar.xz/libavcodec/sunrast.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/sunrast.c Changed

@@ -19,6 +19,7 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#include "libavutil/avassert.h"
 #include "libavutil/common.h"
 #include "libavutil/intreadwrite.h"
 #include "libavutil/imgutils.h"
@@ -75,6 +76,12 @@
         return AVERROR_PATCHWELCOME;
     }
 
+    if (maplength > 768) {
+        av_log(avctx, AV_LOG_WARNING, "invalid colormap length\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    // This also checks depth to be valid
     switch (depth) {
         case 1:
             avctx->pix_fmt = maplength ? AV_PIX_FMT_PAL8 : AV_PIX_FMT_MONOWHITE;
@@ -96,15 +103,23 @@
             return AVERROR_INVALIDDATA;
     }
 
+    // This checks w and h to be valid in the sense that bytes of a padded bitmap are addressable with 32bit int
     ret = ff_set_dimensions(avctx, w, h);
     if (ret < 0)
         return ret;
 
+    // ensured by ff_set_dimensions()
+    av_assert0(w <= (INT32_MAX - 7) / depth);
+
     /* scanlines are aligned on 16 bit boundaries */
     len  = (depth * w + 7) >> 3;
     alen = len + (len & 1);
 
-    if (buf_end - buf < maplength + (len * h) * 3 / 256)
+    // ensured by ff_set_dimensions()
+    av_assert0(h  <= INT32_MAX / (3 * len));
+
+    // maplength is limited to 768 and the right term is limited to INT32_MAX / 256 so the add needs no check
+    if (buf_end - buf < (uint64_t)maplength + (len * h) * 3 / 256)
         return AVERROR_INVALIDDATA;
 
     if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
@@ -118,7 +133,7 @@
     } else if (maplength) {
         unsigned int len = maplength / 3;
 
-        if (maplength % 3 || maplength > 768) {
+        if (maplength % 3) {
             av_log(avctx, AV_LOG_WARNING, "invalid colormap length\n");
             return AVERROR_INVALIDDATA;
         }

ffmpeg-2-2.8.21.tar.xz/libavcodec/tak.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/tak.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/tta.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/tta.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/utils.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/utils.c Changed

@@ -360,6 +360,8 @@
     case AV_PIX_FMT_GBRP16BE:
         w_align = 16; //FIXME assume 16 pixel per macroblock
         h_align = 16 * 2; // interlaced needs 2 macroblocks height
+        if (s->codec_id == AV_CODEC_ID_BINKVIDEO)
+            w_align = 16*2;
         break;
     case AV_PIX_FMT_YUV411P:
     case AV_PIX_FMT_YUVJ411P:
@@ -425,12 +427,13 @@
     }
 
     if (s->codec_id == AV_CODEC_ID_IFF_ILBM || s->codec_id == AV_CODEC_ID_IFF_BYTERUN1) {
-        w_align = FFMAX(w_align, 8);
+        w_align = FFMAX(w_align, 16);
     }
 
     *width  = FFALIGN(*width, w_align);
     *height = FFALIGN(*height, h_align);
     if (s->codec_id == AV_CODEC_ID_H264 || s->lowres ||
+        s->codec_id == AV_CODEC_ID_VC1  || s->codec_id == AV_CODEC_ID_WMV3 ||
         s->codec_id == AV_CODEC_ID_VP5  || s->codec_id == AV_CODEC_ID_VP6 ||
         s->codec_id == AV_CODEC_ID_VP6F || s->codec_id == AV_CODEC_ID_VP6A
     ) {
@@ -444,6 +447,9 @@
         // the next rounded up width is 32
         *width = FFMAX(*width, 32);
     }
+    if (s->codec_id == AV_CODEC_ID_SVQ3) {
+        *width = FFMAX(*width, 32);
+    }
 
     for (i = 0; i < 4; i++)
         linesize_aligni = STRIDE_ALIGN;
@@ -3479,7 +3485,7 @@
     if (sr > 0) {
         /* calc from sample rate */
         if (id == AV_CODEC_ID_TTA)
-            return 256 * sr / 245;
+            return 256ll * sr / 245;
 
         if (ch > 0) {
             /* calc from sample rate and channels */

ffmpeg-2-2.8.21.tar.xz/libavcodec/videodsp_template.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/videodsp_template.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/vorbisdec.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/vorbisdec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/vp3.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/vp3.c Changed

@@ -1747,6 +1747,8 @@
     s->avctx  = avctx;
     s->width  = FFALIGN(avctx->coded_width, 16);
     s->height = FFALIGN(avctx->coded_height, 16);
+    if (s->width < 18)
+        return AVERROR_PATCHWELCOME;
     if (avctx->codec_id != AV_CODEC_ID_THEORA)
         avctx->pix_fmt = AV_PIX_FMT_YUV420P;
     avctx->chroma_sample_location = AVCHROMA_LOC_CENTER;
@@ -2095,8 +2097,13 @@
     if (ff_thread_get_buffer(avctx, &s->current_frame, AV_GET_BUFFER_FLAG_REF) < 0)
         goto error;
 
-    if (!s->edge_emu_buffer)
+    if (!s->edge_emu_buffer) {
         s->edge_emu_buffer = av_malloc(9 * FFABS(s->current_frame.f->linesize0));
+        if (!s->edge_emu_buffer) {
+            ret = AVERROR(ENOMEM);
+            goto error;
+        }
+    }
 
     if (s->keyframe) {
         if (!s->theora) {
@@ -2302,7 +2309,9 @@
     /* sanity check */
     if (av_image_check_size(visible_width, visible_height, 0, avctx) < 0 ||
         visible_width  + offset_x > s->width ||
-        visible_height + offset_y > s->height) {
+        visible_height + offset_y > s->height ||
+        visible_width < 18
+    ) {
         av_log(avctx, AV_LOG_ERROR,
                "Invalid frame dimensions - w:%d h:%d x:%d y:%d (%dx%d).\n",
                visible_width, visible_height, offset_x, offset_y,
@@ -2348,6 +2357,8 @@
     } else
         avctx->pix_fmt = AV_PIX_FMT_YUV420P;
 
+    if (s->width < 18)
+        return AVERROR_PATCHWELCOME;
     ret = ff_set_dimensions(avctx, s->width, s->height);
     if (ret < 0)
         return ret;

ffmpeg-2-2.8.21.tar.xz/libavcodec/wavpack.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/wavpack.c Changed

ffmpeg-2-2.8.21.tar.xz/libavcodec/xvididct.c -> ffmpeg-2-2.8.22.tar.xz/libavcodec/xvididct.c Changed

@@ -56,37 +56,37 @@
 
 static int idct_row(short *in, const int *const tab, int rnd)
 {
-    const int c1 = tab0;
-    const int c2 = tab1;
-    const int c3 = tab2;
-    const int c4 = tab3;
-    const int c5 = tab4;
-    const int c6 = tab5;
-    const int c7 = tab6;
+    const unsigned c1 = tab0;
+    const unsigned c2 = tab1;
+    const unsigned c3 = tab2;
+    const unsigned c4 = tab3;
+    const unsigned c5 = tab4;
+    const unsigned c6 = tab5;
+    const unsigned c7 = tab6;
 
     const int right = in5 | in6 | in7;
     const int left  = in1 | in2 | in3;
     if (!(right | in4)) {
         const int k = c4 * in0 + rnd;
         if (left) {
-            const int a0 = k + c2 * in2;
-            const int a1 = k + c6 * in2;
-            const int a2 = k - c6 * in2;
-            const int a3 = k - c2 * in2;
+            const unsigned a0 = k + c2 * in2;
+            const unsigned a1 = k + c6 * in2;
+            const unsigned a2 = k - c6 * in2;
+            const unsigned a3 = k - c2 * in2;
 
             const int b0 = c1 * in1 + c3 * in3;
             const int b1 = c3 * in1 - c7 * in3;
             const int b2 = c5 * in1 - c1 * in3;
             const int b3 = c7 * in1 - c5 * in3;
 
-            in0 = (a0 + b0) >> ROW_SHIFT;
-            in1 = (a1 + b1) >> ROW_SHIFT;
-            in2 = (a2 + b2) >> ROW_SHIFT;
-            in3 = (a3 + b3) >> ROW_SHIFT;
-            in4 = (a3 - b3) >> ROW_SHIFT;
-            in5 = (a2 - b2) >> ROW_SHIFT;
-            in6 = (a1 - b1) >> ROW_SHIFT;
-            in7 = (a0 - b0) >> ROW_SHIFT;
+            in0 = (int)(a0 + b0) >> ROW_SHIFT;
+            in1 = (int)(a1 + b1) >> ROW_SHIFT;
+            in2 = (int)(a2 + b2) >> ROW_SHIFT;
+            in3 = (int)(a3 + b3) >> ROW_SHIFT;
+            in4 = (int)(a3 - b3) >> ROW_SHIFT;
+            in5 = (int)(a2 - b2) >> ROW_SHIFT;
+            in6 = (int)(a1 - b1) >> ROW_SHIFT;
+            in7 = (int)(a0 - b0) >> ROW_SHIFT;
         } else {
             const int a0 = k >> ROW_SHIFT;
             if (a0) {
@@ -102,8 +102,8 @@
                 return 0;
         }
     } else if (!(left | right)) {
-        const int a0 = (rnd + c4 * (in0 + in4)) >> ROW_SHIFT;
-        const int a1 = (rnd + c4 * (in0 - in4)) >> ROW_SHIFT;
+        const int a0 = (int)(rnd + c4 * (in0 + in4)) >> ROW_SHIFT;
+        const int a1 = (int)(rnd + c4 * (in0 - in4)) >> ROW_SHIFT;
 
         in0 = a0;
         in3 = a0;
@@ -114,7 +114,7 @@
         in5 = a1;
         in6 = a1;
     } else {
-        const int k  = c4 * in0 + rnd;
+        const unsigned int k  = c4 * in0 + rnd;
         const unsigned int a0 = k + c2 * in2 + c4 * in4 + c6 * in6;
         const unsigned int a1 = k + c6 * in2 - c4 * in4 - c2 * in6;
         const unsigned int a2 = k - c6 * in2 - c4 * in4 + c2 * in6;

ffmpeg-2-2.8.21.tar.xz/libavformat/avs.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/avs.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/format.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/format.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/id3v2.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/id3v2.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/jacosubdec.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/jacosubdec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/matroskadec.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/matroskadec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/mov.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/mov.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/replaygain.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/replaygain.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/rpl.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/rpl.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/rtsp.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/rtsp.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/sbgdec.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/sbgdec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/tmv.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/tmv.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/tta.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/tta.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/wavdec.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/wavdec.c Changed

ffmpeg-2-2.8.21.tar.xz/libavformat/westwood_vqa.c -> ffmpeg-2-2.8.22.tar.xz/libavformat/westwood_vqa.c Changed

ffmpeg-2-2.8.21.tar.xz/libavutil/softfloat.c -> ffmpeg-2-2.8.22.tar.xz/libavutil/softfloat.c Changed

ffmpeg-2-2.8.21.tar.xz/libavutil/softfloat.h -> ffmpeg-2-2.8.22.tar.xz/libavutil/softfloat.h Changed

ffmpeg-2-2.8.21.tar.xz/libswscale/input.c -> ffmpeg-2-2.8.22.tar.xz/libswscale/input.c Changed

@@ -84,9 +84,9 @@
     int32_t rv = rgb2yuvRV_IDX, gv = rgb2yuvGV_IDX, bv = rgb2yuvBV_IDX;
     av_assert1(src1==src2);
     for (i = 0; i < width; i++) {
-        int r_b = (input_pixel(&src18 * i + 0) + input_pixel(&src18 * i + 4) + 1) >> 1;
-        int   g = (input_pixel(&src18 * i + 1) + input_pixel(&src18 * i + 5) + 1) >> 1;
-        int b_r = (input_pixel(&src18 * i + 2) + input_pixel(&src18 * i + 6) + 1) >> 1;
+        unsigned r_b = (input_pixel(&src18 * i + 0) + input_pixel(&src18 * i + 4) + 1) >> 1;
+        unsigned   g = (input_pixel(&src18 * i + 1) + input_pixel(&src18 * i + 5) + 1) >> 1;
+        unsigned b_r = (input_pixel(&src18 * i + 2) + input_pixel(&src18 * i + 6) + 1) >> 1;
 
         dstUi= (ru*r + gu*g + bu*b + (0x10001<<(RGB2YUV_SHIFT-1))) >> RGB2YUV_SHIFT;
         dstVi= (rv*r + gv*g + bv*b + (0x10001<<(RGB2YUV_SHIFT-1))) >> RGB2YUV_SHIFT;
@@ -156,9 +156,9 @@
     int32_t rv = rgb2yuvRV_IDX, gv = rgb2yuvGV_IDX, bv = rgb2yuvBV_IDX;
     av_assert1(src1 == src2);
     for (i = 0; i < width; i++) {
-        int r_b = input_pixel(&src1i * 3 + 0);
-        int g   = input_pixel(&src1i * 3 + 1);
-        int b_r = input_pixel(&src1i * 3 + 2);
+        unsigned r_b = input_pixel(&src1i * 3 + 0);
+        unsigned g   = input_pixel(&src1i * 3 + 1);
+        unsigned b_r = input_pixel(&src1i * 3 + 2);
 
         dstUi = (ru*r + gu*g + bu*b + (0x10001 << (RGB2YUV_SHIFT - 1))) >> RGB2YUV_SHIFT;
         dstVi = (rv*r + gv*g + bv*b + (0x10001 << (RGB2YUV_SHIFT - 1))) >> RGB2YUV_SHIFT;
@@ -178,12 +178,12 @@
     int32_t rv = rgb2yuvRV_IDX, gv = rgb2yuvGV_IDX, bv = rgb2yuvBV_IDX;
     av_assert1(src1 == src2);
     for (i = 0; i < width; i++) {
-        int r_b = (input_pixel(&src16 * i + 0) +
-                   input_pixel(&src16 * i + 3) + 1) >> 1;
-        int g   = (input_pixel(&src16 * i + 1) +
-                   input_pixel(&src16 * i + 4) + 1) >> 1;
-        int b_r = (input_pixel(&src16 * i + 2) +
-                   input_pixel(&src16 * i + 5) + 1) >> 1;
+        unsigned r_b = (input_pixel(&src16 * i + 0) +
+                        input_pixel(&src16 * i + 3) + 1) >> 1;
+        unsigned g   = (input_pixel(&src16 * i + 1) +
+                        input_pixel(&src16 * i + 4) + 1) >> 1;
+        unsigned b_r = (input_pixel(&src16 * i + 2) +
+                        input_pixel(&src16 * i + 5) + 1) >> 1;
 
         dstUi = (ru*r + gu*g + bu*b + (0x10001 << (RGB2YUV_SHIFT - 1))) >> RGB2YUV_SHIFT;
         dstVi = (rv*r + gv*g + bv*b + (0x10001 << (RGB2YUV_SHIFT - 1))) >> RGB2YUV_SHIFT;

Changes of Revision 3