Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hdmv menus support for bluray #464

Closed
wants to merge 14 commits into from
Closed

Hdmv menus support for bluray #464

wants to merge 14 commits into from

Conversation

elupus
Copy link
Contributor

@elupus elupus commented Oct 3, 2011

This series add support for HDMV menus support on blurays. Some blurays use this format for their menu's, but sadly most use BD-J (java) based systems.

This will not replace the previous default of playing longest title on the bluray if starting index.bdmv. To try to play with menu's you need to start the MovieObject.bdmv file.

It also drops support for older libbluray version. You can either uninstall/force disable or update your installed version. It will abort configure if it is in auto mode and an old libbluray is detected.

@elupus
Copy link
Contributor Author

elupus commented Oct 3, 2011

I think we are going to hold of on this for eden

nemphys referenced this pull request in nemphys/xbmc Mar 21, 2012
margro referenced this pull request in margro/xbmc Mar 24, 2012
elupus added 14 commits April 10, 2012 21:57
xbmc will abort configure if an old libbluray is found
and configure is auto or yes. To skip libbluray support
in that case explicitly disable it.
Code will fall back to longest item if there is not first play
hdmv item. However it will still try menu's if there is only
some unnsupported BD-J titles. This could possible fail to
play if it switches into BD-J mode later in menu's.

Starting index.bdmv will still only play longest title,
to attempt playback with menu's, start the MovieObject.bdmv
…ying to syncronize players

This avoids a lot of the stutter that occurs with streams
with concated streams or timestamp gaps in them and almost
makes the timestamp correction logic for dvd's redundant.

With this in place it should be also finally be possible
to handle looping still frames in dvd's by having dvdplayervideo
respect timestamps and not limit itself to minimum 1 fps.
This allows the IDirectory to intellegently filter content
based on what scanner are looking for. For virtual directories
that have metadata, this can be used to filter out applicable
files.
@elupus elupus closed this Apr 10, 2012
margro referenced this pull request in margro/xbmc Dec 21, 2013
riff: retry reading metadata without padding if it fails with

Fixes Ticket1821

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d0c27e8)

riff: ignore ff_read_riff_info() failure.

Some files simply contain invalid info tags.
Fixes unrelated bug posted into Ticket1821

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 09456d0)

avidec: try to support oddly muxed MMES stream

Fixes ticket1804

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit be89693)

mpeg1video: support multi threaded slice encoding.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 03df972)

Conflicts:
	libavcodec/mpeg12enc.c

mpeg1video: fix regression with slices != threads

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a016795)

lavc/ass_split: check for NULL pointer in ff_ass_split_override_codes().

This is consistent with the other ff_ass_split_* functions.

It also fixes a crash when trying to split a dialog with text=NULL
(which seems to happen when the text of the dialog is empty); basically,
this commit fixes crashes when trying to encode an empty text subtitle
dialog (see subrip and mov_text encoders).

Fixes Ticket2048.
(cherry picked from commit c83002a)

ivi_common: check that scan pattern is set before using it.

Fixes CVE-2012-2791.

CC: libav-stable@libav.org

(cherry picked from commit deabb52)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

vp56: make parse_header return standard error codes

Returning 0 for failure is misleading.

CC: libav-stable@libav.org

(cherry picked from commit bb675d3)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

vp56: release frames on error

Fixes CVE-2012-2783

CC: libav-stable@libav.org

(cherry picked from commit f33b5ba)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

vp8: reset loopfilter delta values at keyframes.

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

(cherry picked from commit 0bf511d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

yuv4mpeg: reject unsupported codecs

The muxer already rejects unsupported pixel formats, reject also
unsupported codecs to prevent dangerous misuses.
(cherry picked from commit 424b1e7)

Conflicts:

	libavformat/yuv4mpeg.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

flacenc: ensure the order is within the min/max range in LPC order search

This fixes use of uninitialized values when the FLAC encoder uses the
2-level, 4-level, and 8-level search methods. Fixes failure of the
fate-flac-24-comp-8 test when run using valgrind.
(cherry picked from commit 3a2731c)

Conflicts:

	libavcodec/flacenc.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

h264: Fix parameters to ff_er_add_slice() call

s->mb_x is reset to zero a couple of lines above. It does not make
sense to call ff_er_add_slice() with 0 as endx when the end of the
macroblock row was reached. Fixes unnecessary and counterproductive
error resilience in https://bugzilla.libav.org/show_bug.cgi?id=394.

(cherry picked from commit e6160bd)

Conflicts:

	libavcodec/h264.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

id3v2: fix reading unsynchronized frames.

Current code would incorrectly process e.g. 'ff 00 ff 00 ff' to
'ff ff ff', while it should be 'ff ff 00 ff'.

Fixes Bug 395.

CC: libav-stable@libav.org
(cherry picked from commit 9ae80e6)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

indeo3: ensure that decoded cell data is in 7-bit range as presumed by decoder

Related to CVE-2012-2804
(cherry picked from commit fc417db)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

indeo3: when freeing buffers, set pointers referencing them to NULL as well

Related to CVE-2012-2804
(cherry picked from commit bc00da2)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

mpeg12: do not decode extradata more than once.

Fixes CVE-2012-2803.

CC: libav-stable@libav.org
(cherry picked from commit 5823686)

Conflicts:

	libavcodec/mpeg12.c

mp3: properly forward mp_decode_frame errors

The function can return either a parsing error or a memory management
error.

Fixes: CVE-2012-2797

(cherry picked from commit 9ab0874)

Conflicts:

	libavcodec/mpegaudiodec.c

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

vp6: properly fail on unsupported feature

Interlacing is not supported at all and mismanaged down the normal
codepaths causing possible buffer management issues.

Fixes: CVE-2012-2783
(cherry picked from commit be75fed)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

tiffdec: Use the correct height field.

Fixes Ticket913

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4784a13)

Conflicts:
	libavcodec/tiff.c

aacdec: Fix an off-by-one overwrite when switching to LTP profile from MAIN.

Found-by: pawlkt
CC: libav-stable@libav.org
Fixes: CVE-2012-5144
(cherry picked from commit 6d5b009)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

lavf: avoid integer overflow in ff_compute_frame_duration()

Scaling the denominator instead of the numerator if it is too large
loses precision. Fixes an assert caused by a negative frame duration in
the fuzzed sample nasa-8s2.ts_s202310.

CC: libav-stable@libav.org
(cherry picked from commit 7709ce0)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

flashsv: check for keyframe before using differential coding

Fixes a segfault in te fuzzed sample resolutionchange.flv_s211713.

CC: libav-stable@libav.org
(cherry picked from commit 5ae72f5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

h264: enable low delay only if no delayed frames were seen

Dropping frames is undesirable but that is the only way by which the
decoder could return to low delay mode. Instead emit a warning and
continue with delayed frames.
Fixes a crash in fuzzed sample nasa-8s2.ts_s20033 caused by a larger
than expected has_b_frames value. Low delay keeps getting re-enabled
from a presumely broken SPS.

CC: libav-stable@libav.org
(cherry picked from commit 706acb5)

Conflicts:

	libavcodec/h264.c

flashsv: make sure data for zlib priming is available

Fixes a segfault in the fuzzed sample resolutionchange.flv_s314809.

CC: libav-stable@libav.org
(cherry picked from commit 3ae69b9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

h264: error out on unset current_picture_ptr for h->current_slice > 0

Fixes a segfault with fuzzed sample sample_varPAR_s11622_r001-02.avi.

CC: libav-stable@libav.org
(cherry picked from commit 0b300da)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

alacdec: do not be too strict about the extradata size

Sometimes the extradata has duplicate atoms, but that shouldn't prevent
decoding. Just ensure that it is at least 36 bytes as a sanity check.

CC: libav-stable@libav.org
(cherry picked from commit 68a04b0)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

ppc: always use pic for shared libraries

CC: libav-stable@libav.org
(cherry picked from commit 1944d53)

Conflicts:

	configure

opt: avoid segfault in av_opt_next() if the class does not have an option list

CC: libav-stable@libav.org
(cherry picked from commit d02202e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

rtsp: Recheck the reordering queue if getting a new packet

If we timed out and consumed a packet from the reordering queue,
but didn't return a packet to the caller, recheck the queue status.
Otherwise, we could end up in an infinite loop, trying to consume
a queued packet that has already been consumed.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8729698)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

h264: check sps.log2_max_frame_num for validity

Fixes infinite or long taking loop in frame num gap code in
the fuzzed sample bipbop234.ts_s223302.

CC: libav-stable@libav.org
(cherry picked from commit d7d6efe)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Fix uninitialized reads on malformed ogg files.

The ogg decoder wasn't padding the input buffer with the appropriate
FF_INPUT_BUFFER_PADDING_SIZE bytes. Which led to uninitialized reads in
various pieces of parsing code when they thought they had more data than
they actually did.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
(cherry picked from commit ef0d779)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

h264: fix sps parsing for SVC and CAVLC 4:4:4 Intra profiles

Fixes bug 396.

CC: libav-stable@libav.org
(cherry picked from commit 1c8bf3b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

oggdec: check memory allocation

(cherry picked from commit ba064eb)

Conflicts:

	libavformat/oggdec.c

oggdec: free the ogg streams on read_header failure

Plug an annoying memory leak on broken files.
(cherry picked from commit 89b51b5)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 42bd6d9cf681306d14c92af97a40116fe4eb2522)

Conflicts:

	libavformat/oggdec.c

h264: check context state before decoding slice data partitions

Fixes mov_h264_aac__Demo_FlagOfOurFathers.mov.SIGSEGV.4e9.656.

Found-by: Mateusz "j00ru" Jurczyk
CC: libav-stable@libav.org
(cherry-picked from commit c1fcf56)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

h264: check ref_count validity for num_ref_idx_active_override_flag

Fixes segfault in the fuzzed sample bipbop234.ts_s226407.
CC: libav-stable@libav.org
(cherry-picked from commit 6e5cdf2)
Signed-off-by: Janne Grunau <janne-libav@jannau.net>

Fix detection of struct v4l2_frmsize_discrete.

It was always detected successfully.
(cherry picked from commit 91e016865cccc192f86d40ea93eb06cf0e7ba4a0)

indeo3: initialise pixel planes on allocation

This prevents decoder from reading garbage from it in case of errors later.
(cherry picked from commit 81064a8)

Fixes an invalid read on sample from CVE-2012-2804

Signed-off-by: Anton Khirnov <anton@khirnov.net>

mp3: exit on parsing error in mp_decode_frame

Properly forward mp_decode_layer3 errors, mp_decode_layer1 and
mp_decode_layer2 do not return errors.

Based on a patch by Michael Niedermayer.
(cherry picked from commit 0c03cc6)

Signed-off-by: Anton Khirnov <anton@khirnov.net>

matroskaenc: add codec_tag lists back.

This reverts 312645e :
"Do not set codec_tag property for matroska muxers."

Also adds dummy codec_tag lists with codecs
supported in mkv but not in wav / avi.

Fixes ticket xbmc#2169.
(cherry picked from commit df39c3c)

Conflicts:
	libavformat/matroskaenc.c

pthread: set the frame properties from the thread context, not user.

Right now, the frame properties are set from the user-facing
AVCodecContext before it is updated from the thread context, which is
wrong since they may be invalid or obsolete.

ffmpeg: dont allow -flags to override -pass

Fixes Ticket2154

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ccf9dd0)

Conflicts:
	ffmpeg_opt.c

sws: dont write out of array on bigendian

Fixes Ticket2229

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e2c636)

rtpenc: fix overflow checking in avc_mp4_find_startcode()

The check `start + res < start' is broken since pointer overflow is
undefined behavior in C.  Many compilers such as gcc/clang optimize
away this check.

Use `res > end - start' instead.  Also change `res' to unsigned int
to avoid signed left-shift overflow.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2f01456)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

rtmp: fix multiple broken overflow checks

Sanity checks like `data + size >= data_end || data + size < data' are
broken, because `data + size < data' assumes pointer overflow, which is
undefined behavior in C.  Many compilers such as gcc/clang optimize such
checks away.

Use `size < 0 || size >= data_end - data' instead.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 902cfe2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

rtmp: fix buffer overflows in ff_amf_tag_contents()

A negative `size' will bypass FFMIN().  In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.

Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e69237)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

huffyuvdec: Check init_vlc() return codes.

Prevents out of array writes

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f67a0d1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95ab8d33e1a680f30a5a9605175112008ab81afc)

Conflicts:

	libavcodec/huffyuv.c
(cherry picked from commit 277def59fce10d91e3113e5c0f63e22bc4abfa88)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

huffyuvdec: Skip len==0 cases

Fixes vlc decoding for hypothetical files that would contain such cases.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0dfc01c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5ff41ffeb4cb9ea6df49757dc859619dc3d3ab4f)

Conflicts:

	libavcodec/huffyuv.c
(cherry picked from commit 9bc70fe1ae50fd2faa0b9429d47cfbda01a92ebc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Write the fiel atom to mov files independently of the used video coded.

The QuickTime specification does not contain any hint that the atom
must not be written in some cases and both the QuickTime and the
AVID decoders do not fail if the atom is present.

This change allows to signal (visually) interlaced streams with
a codec different from uncompressed video.

As a side-effect, this fixes ticket xbmc#2202
(cherry picked from commit 7d0e3b1)

Conflicts:
	libavformat/movenc.c
	tests/ref/lavf/mov
	tests/ref/seek/lavf_mov
	tests/ref/vsynth/vsynth1-avui
	tests/ref/vsynth/vsynth1-dnxhd-1080i
	tests/ref/vsynth/vsynth1-mpeg4
	tests/ref/vsynth/vsynth2-avui
	tests/ref/vsynth/vsynth2-dnxhd-1080i
	tests/ref/vsynth/vsynth2-mpeg4

doc: filters: Correct BNF FILTER description

Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit b5ad422)

doc: developer: Allow tabs in the vim configuration for Automake files

While we do not use Automake in libav, this allows our config to be
used more globally without introducing unwanted breakage.
(cherry picked from commit 040c565)

Conflicts:

	doc/developer.texi

build: Fix CAF demuxer dependencies

(cherry picked from commit a519463)

Conflicts:

	libavcodec/Makefile

lavf/avio: check for : in filenames for protocols.

If the first "special" character in a filename is a comma,
it can introduce protocol options, but only if there is a
colon at the end. Otherwise, it is just a filename with a
comma.

Fix trac ticket xbmc#2303.
(cherry picked from commit d9fad53)

Require at least three frames to autodetect loas. (cherry picked from commit a60530e)

oggdec: make sure the private parse data is cleaned up (cherry picked from commit d894f74)

Related to CVE-2012-2882

Conflicts:

	libavformat/oggdec.h
	libavformat/oggparsevorbis.c

update year to 2013

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

configure: clean up Altivec detection

There used to be one test for Altivec intrinsics support and a
separate test to determine which of two possible syntaxes to use
for vector literals.  Since 2008, we only support the more common
of these so the split test no longer makes sense.

This combines the tests into one and also changes the hard error on
failure to a warning.  The test can reasonably fail if no --cpu flag
is provided (or is provided with an unknown CPU) and the compiler
default target does not support Altivec.  Aborting in this case is
probably over-reacting.

Fixes: #464, http://bugs.debian.org/701710

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 20bcce5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

wmadec: require block_align to be set.

Avoids an infinite loop in the calling programs with decoder not
consuming any input and not returning output.

CC:libav-stable@libav.org
(cherry picked from commit ea1136b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit c1f479e8df24284237c80ad959619fc85e29a26d)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

vorbisdec: Error on bark_map_size equal to 0.

The value is used to calculate output LSP curve and a division by zero
and out of array accesses would occur.

CVE-2013-0894

CC: libav-stable@libav.org

Reported-by: Dale Curtis <dalecurtis@chromium.org>
Found-by: inferno@chromium.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 11dcecf)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 494ddd377ada76ed555f7a3f49391455daa099c9)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

xxan: fix invalid memory access in xan_decode_frame_type0()

The loop a few lines below the xan_unpack() call accesses up to
dec_size * 2 bytes into y_buffer, so dec_size must be limited to
buffer_size / 2.

CC:libav-stable@libav.org
(cherry picked from commit 8a49d2b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 62a657de168cf501acb23d48cc1aa00793dc83f3)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

wmaprodec: return an error, not 0, when the input is too small.

Returning 0 may result in an infinite loop in valid calling programs. A
decoder should never return 0 without producing any output.

CC:libav-stable@libav.org
(cherry picked from commit 4c0080b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 60dd8b5733f9ec4919fbc732ace1be8184dde880)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

vc1: Move init code shared between decoder and parser to common code file.

This fixes standalone compilation of the VC-1 parser.
(cherry picked from commit 3c71538)

Conflicts:

	libavcodec/vc1data.h

Signed-off-by: Diego Biurrun <diego@biurrun.de>

h264: check for luma and chroma bit depth being equal

The decoder assumes a single bit depth for all the planes while
the specification allows different bit depths for luma and chroma.

Avoid the possible problems described in CVE-2013-2277

matroskadec: request a read buffer for the wav header

Solve an infiniloop.

CC: libav-stable@libav.org

(cherry picked from commit 37cb3b1)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

shorten: set invalid channels count to 0

Prevent the loop shorten_decode_close from writing and freeing out of
the array boundary.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org

(cherry picked from commit c10da30)
(cherry picked from commit 21d568be179c54a1596d1377b4da7fbe755bfe7f)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

shorten: K&R formatting cosmetics

(cherry picked from commit a2ad554)
(cherry picked from commit 97cc2f286f9e3eed1a00034367ebca58cc05ee39)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/shorten.c

dsputil: fix invalid array indexing

Indexing outside an array is invalid and causes errors with
gcc 4.8.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 0a07f2b)

Signed-off-by: Diego Biurrun <diego@biurrun.de>

parser: fix large overreads

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

(cherry picked from commit 096abfa)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

lavf: fix arithmetic overflows in avformat_seek_file()

The values compared here can be more than INT64_MAX apart.  Since the
difference is always positive, converting to uint64_t before subtracting
gives the correct result without overflows.

Signed-off-by: Mans Rullgard <mans@mansr.com>

(cherry picked from commit 91ac403)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

atrac3: avoid oversized shifting in decode_bytes()

When `off' is 0, `0x537F6103 << 32' in the following expression invokes
undefined behavior, the result of which is not necessarily 0.

    (0x537F6103 >> (off * 8)) | (0x537F6103 << (32 - (off * 8)))

Avoid oversized shifting.

CC: libav-stable@libav.org

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

(cherry picked from commit eba1ff3)

Conflicts:
	libavcodec/atrac3.c

flacdec: simplify bounds checking in flac_probe()

Simplify `p->buf > p->buf + p->buf_size - 4' as `p->buf_size < 4'.
Avoid a possible out-of-bounds pointer, which is undefined behavior
in C.

CC: libav-stable@libav.org

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

(cherry picked from commit 8425d69)

lzo: fix overflow checking in copy_backptr()

The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.

Remove the check.  Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.

CC: libav-stable@libav.org

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

(cherry picked from commit ca6c3f2)

Conflicts:
	libavutil/lzo.c

roqvideodec: fix a potential infinite loop in roqvideo_decode_frame().

When there is just 1 byte remanining in the buffer, nothing will be read
and the loop will continue forever. Check that there are at least 8
bytes, which are always read at the beginning.

CC:libav-stable@libav.org
(cherry picked from commit 3e2f200)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 747fbe0c212b81952bb27ec7b99fa709081e2d63)

Conflicts:

	libavcodec/roqvideodec.c

ivi_common: do not call MC for intra frames when dc_transform is unset

CC:libav-stable@libav.org
(cherry picked from commit 3ba40eb)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 74880e78d83031d612c941a383b810ff0c9d50c6)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

wmaprodec: require block_align to be set.

Avoids an infinite loop in the calling programs with decoder not
consuming any input and not returning output.

CC:libav-stable@libav.org
(cherry picked from commit cacad1c)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 20373a66ec68d958c266f643a7d0e5ec254c0fcc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

msrle: convert MS RLE decoding function to bytestream2.

Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
(cherry picked from commit 992f71e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

msrledec: check bounds before constructing a possibly invalid pointer,

CC:libav-stable@libav.org
(cherry picked from commit 9bd6375)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit b7765d00f911fe0f8fcda21b93a540f27d2ba2f5)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Do not (re-)set libx264 parameter b_tff if interlaced encoding was not requested.

Reconfiguring can break x264 lossless encoding.

Fixes ticket xbmc#2165.
(cherry picked from commit 75c7e45)

iff: validate CMAP palette size

Fixes CVE-2013-2495

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org
(cherry picked from commit 50c449a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 31a77177ff323ef83944c60a8654891213ab6691)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Only test the first frame for missing aac_adtstoasc bistream filter.

Many players ignore broken aac frames, so don't abort mov or flv
muxing when encountering one, just print a warning instead.

Fixes ticket xbmc#2380.
(cherry picked from commit 1741fec)

Conflicts:
	libavformat/flvenc.c

Write broken aac frames to mov files instead of skipping them.

Fixes decoding with picky media players.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b448c0a)

Conflicts:
	libavformat/movenc.c

smacker: fix off by one error

Regression since a93b572.

Fixes xbmc#2426.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit e3cc92a)

apichanges: fix date

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad6802f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

apichanges: fix 2 wrong hashes

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2f3bc51)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

ffserver: fix return value of add_codec()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ff814c7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

oggparsevorbis: fix vorbis_cleanup return type

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7a6beed)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

configure: Make warnings from -Wreturn-type fatal errors

These warnings have no false positives and point to serious bugs.
(cherry picked from commit 99853cb)

Conflicts:

	configure

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

doc/APIchanges: List merge commit hashes and version numbers

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

rmdec: flush audio packet on seeking

Fixes Ticket1605

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 519ebb5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Update for 0.10.7

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant