aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
diff options
context:
space:
mode:
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/aacdec_template.c4
-rw-r--r--libavcodec/dvdec.c2
-rw-r--r--libavcodec/g2meet.c7
-rw-r--r--libavcodec/h264_slice.c4
-rw-r--r--libavcodec/ituh263enc.c6
-rw-r--r--libavcodec/mjpegdec.c5
-rw-r--r--libavcodec/motion_est.c16
-rw-r--r--libavcodec/motion_est.h3
-rw-r--r--libavcodec/mpeg12enc.c6
-rw-r--r--libavcodec/mpeg4video.h2
-rw-r--r--libavcodec/mpeg4videoenc.c10
-rw-r--r--libavcodec/mpegvideo_enc.c11
-rw-r--r--libavcodec/mss2.c7
-rw-r--r--libavcodec/pngenc.c13
-rw-r--r--libavcodec/put_bits.h20
-rw-r--r--libavcodec/snowenc.c2
-rw-r--r--libavcodec/wavpackenc.c7
17 files changed, 81 insertions, 44 deletions
diff --git a/libavcodec/aacdec_template.c b/libavcodec/aacdec_template.c
index fb1ce2cb06..ec8264e5f1 100644
--- a/libavcodec/aacdec_template.c
+++ b/libavcodec/aacdec_template.c
@@ -449,6 +449,10 @@ static int output_configure(AACContext *ac,
int type = layout_map[i][0];
int id = layout_map[i][1];
id_map[type][id] = type_counts[type]++;
+ if (id_map[type][id] >= MAX_ELEM_ID) {
+ avpriv_request_sample(ac->avctx, "Remapped id too large\n");
+ return AVERROR_PATCHWELCOME;
+ }
}
// Try to sniff a reasonable channel order, otherwise output the
// channels in the order the PCE declared them.
diff --git a/libavcodec/dvdec.c b/libavcodec/dvdec.c
index 679075e6a9..1a3983b501 100644
--- a/libavcodec/dvdec.c
+++ b/libavcodec/dvdec.c
@@ -347,7 +347,7 @@ retry:
dct_mode * 22 * 64 +
(quant + ff_dv_quant_offset[class1]) * 64];
}
- dc = dc << 2;
+ dc = dc * 4;
/* convert to unsigned because 128 is not added in the
* standard IDCT */
dc += 1024;
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index ba83c67337..7d052224c9 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -631,6 +631,8 @@ static int epic_decode_run_length(ePICContext *dc, int x, int y, int tile_width,
(NN != N) << 1 |
(NNW != NW);
WWneW = ff_els_decode_bit(&dc->els_ctx, &dc->W_ctx_rung[idx]);
+ if (WWneW < 0)
+ return WWneW;
}
if (WWneW)
@@ -837,10 +839,13 @@ static int epic_decode_tile(ePICContext *dc, uint8_t *out, int tile_height,
if (y < 2 || x < 2 || x == tile_width - 1) {
run = 1;
got_pixel = epic_handle_edges(dc, x, y, curr_row, above_row, &pix);
- } else
+ } else {
got_pixel = epic_decode_run_length(dc, x, y, tile_width,
curr_row, above_row,
above2_row, &pix, &run);
+ if (got_pixel < 0)
+ return got_pixel;
+ }
if (!got_pixel && !epic_predict_from_NW_NE(dc, x, y, run,
tile_width, curr_row,
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index 8be803b7fd..63eb463e8e 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -783,7 +783,7 @@ static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, in
cur_poc = h->cur_pic_ptr->field_poc[h->picture_structure - 1];
}
if (sl->ref_count[0] == 1 && sl->ref_count[1] == 1 && !FRAME_MBAFF(h) &&
- sl->ref_list[0][0].poc + sl->ref_list[1][0].poc == 2 * cur_poc) {
+ sl->ref_list[0][0].poc + (int64_t)sl->ref_list[1][0].poc == 2 * cur_poc) {
sl->use_weight = 0;
sl->use_weight_chroma = 0;
return;
@@ -804,7 +804,7 @@ static void implicit_weight_table(const H264Context *h, H264SliceContext *sl, in
sl->chroma_log2_weight_denom = 5;
for (ref0 = ref_start; ref0 < ref_count0; ref0++) {
- int poc0 = sl->ref_list[0][ref0].poc;
+ int64_t poc0 = sl->ref_list[0][ref0].poc;
for (ref1 = ref_start; ref1 < ref_count1; ref1++) {
int w = 32;
if (!sl->ref_list[0][ref0].parent->long_ref && !sl->ref_list[1][ref1].parent->long_ref) {
diff --git a/libavcodec/ituh263enc.c b/libavcodec/ituh263enc.c
index 03f4011bfa..d9596c9f3b 100644
--- a/libavcodec/ituh263enc.c
+++ b/libavcodec/ituh263enc.c
@@ -45,7 +45,7 @@
/**
* Table of number of bits a motion vector component needs.
*/
-static uint8_t mv_penalty[MAX_FCODE+1][MAX_MV*2+1];
+static uint8_t mv_penalty[MAX_FCODE+1][MAX_DMV*2+1];
/**
* Minimal fcode that a motion vector component would need.
@@ -678,7 +678,7 @@ static av_cold void init_mv_penalty_and_fcode(MpegEncContext *s)
int mv;
for(f_code=1; f_code<=MAX_FCODE; f_code++){
- for(mv=-MAX_MV; mv<=MAX_MV; mv++){
+ for(mv=-MAX_DMV; mv<=MAX_DMV; mv++){
int len;
if(mv==0) len= ff_mvtab[0][1];
@@ -699,7 +699,7 @@ static av_cold void init_mv_penalty_and_fcode(MpegEncContext *s)
}
}
- mv_penalty[f_code][mv+MAX_MV]= len;
+ mv_penalty[f_code][mv+MAX_DMV]= len;
}
}
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 3f81fdfc68..ba779949a0 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -632,7 +632,8 @@ unk_pixfmt:
av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) mismatch\n", len);
}
- if (s->rgb && !s->lossless && !s->ls) {
+ if ((s->rgb && !s->lossless && !s->ls) ||
+ (!s->rgb && s->ls && s->nb_components > 1)) {
av_log(s->avctx, AV_LOG_ERROR, "Unsupported coding and pixel format combination\n");
return AVERROR_PATCHWELCOME;
}
@@ -998,7 +999,7 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
return -1;
left[i] = buffer[mb_x][i] =
- mask & (pred + (dc << point_transform));
+ mask & (pred + (dc * (1 << point_transform)));
}
if (s->restart_interval && !--s->restart_count) {
diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c
index 9f71568efd..3df8276778 100644
--- a/libavcodec/motion_est.c
+++ b/libavcodec/motion_est.c
@@ -923,7 +923,7 @@ void ff_estimate_p_frame_motion(MpegEncContext * s,
c->penalty_factor = get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_cmp);
c->sub_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_sub_cmp);
c->mb_penalty_factor = get_penalty_factor(s->lambda, s->lambda2, c->avctx->mb_cmp);
- c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+ c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
get_limits(s, 16*mb_x, 16*mb_y);
c->skip=0;
@@ -1090,7 +1090,7 @@ int ff_pre_estimate_p_frame_motion(MpegEncContext * s,
av_assert0(s->quarter_sample==0 || s->quarter_sample==1);
c->pre_penalty_factor = get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_pre_cmp);
- c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+ c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
get_limits(s, 16*mb_x, 16*mb_y);
c->skip=0;
@@ -1139,7 +1139,7 @@ static int estimate_motion_b(MpegEncContext *s, int mb_x, int mb_y,
const int shift= 1+s->quarter_sample;
const int mot_stride = s->mb_stride;
const int mot_xy = mb_y*mot_stride + mb_x;
- uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_MV;
+ uint8_t * const mv_penalty= c->mv_penalty[f_code] + MAX_DMV;
int mv_scale;
c->penalty_factor = get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_cmp);
@@ -1203,8 +1203,8 @@ static inline int check_bidir_mv(MpegEncContext * s,
//FIXME better f_code prediction (max mv & distance)
//FIXME pointers
MotionEstContext * const c= &s->me;
- uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_MV; // f_code of the prev frame
- uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_MV; // f_code of the prev frame
+ uint8_t * const mv_penalty_f= c->mv_penalty[s->f_code] + MAX_DMV; // f_code of the prev frame
+ uint8_t * const mv_penalty_b= c->mv_penalty[s->b_code] + MAX_DMV; // f_code of the prev frame
int stride= c->stride;
uint8_t *dest_y = c->scratchpad;
uint8_t *ptr;
@@ -1417,7 +1417,7 @@ static inline int direct_search(MpegEncContext * s, int mb_x, int mb_y)
int mx, my, xmin, xmax, ymin, ymax;
int16_t (*mv_table)[2]= s->b_direct_mv_table;
- c->current_mv_penalty= c->mv_penalty[1] + MAX_MV;
+ c->current_mv_penalty= c->mv_penalty[1] + MAX_DMV;
ymin= xmin=(-32)>>shift;
ymax= xmax= 31>>shift;
@@ -1553,11 +1553,11 @@ void ff_estimate_b_frame_motion(MpegEncContext * s,
if (s->avctx->flags & AV_CODEC_FLAG_INTERLACED_ME) {
//FIXME mb type penalty
c->skip=0;
- c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_MV;
+ c->current_mv_penalty= c->mv_penalty[s->f_code] + MAX_DMV;
fimin= interlaced_search(s, 0,
s->b_field_mv_table[0], s->b_field_select_table[0],
s->b_forw_mv_table[xy][0], s->b_forw_mv_table[xy][1], 0);
- c->current_mv_penalty= c->mv_penalty[s->b_code] + MAX_MV;
+ c->current_mv_penalty= c->mv_penalty[s->b_code] + MAX_DMV;
bimin= interlaced_search(s, 2,
s->b_field_mv_table[1], s->b_field_select_table[1],
s->b_back_mv_table[xy][0], s->b_back_mv_table[xy][1], 0);
diff --git a/libavcodec/motion_est.h b/libavcodec/motion_est.h
index e09f705eee..6c0c674b2e 100644
--- a/libavcodec/motion_est.h
+++ b/libavcodec/motion_est.h
@@ -30,6 +30,7 @@
struct MpegEncContext;
#define MAX_MV 4096
+#define MAX_DMV (2*MAX_MV)
#define FF_ME_ZERO 0
#define FF_ME_EPZS 1
@@ -84,7 +85,7 @@ typedef struct MotionEstContext {
op_pixels_func(*hpel_avg)[4];
qpel_mc_func(*qpel_put)[16];
qpel_mc_func(*qpel_avg)[16];
- uint8_t (*mv_penalty)[MAX_MV * 2 + 1]; ///< bit amount needed to encode a MV
+ uint8_t (*mv_penalty)[MAX_DMV * 2 + 1]; ///< bit amount needed to encode a MV
uint8_t *current_mv_penalty;
int (*sub_motion_search)(struct MpegEncContext *s,
int *mx_ptr, int *my_ptr, int dmin,
diff --git a/libavcodec/mpeg12enc.c b/libavcodec/mpeg12enc.c
index 6f87117058..780f21f359 100644
--- a/libavcodec/mpeg12enc.c
+++ b/libavcodec/mpeg12enc.c
@@ -53,7 +53,7 @@ static const uint8_t svcd_scan_offset_placeholder[] = {
0x81, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
};
-static uint8_t mv_penalty[MAX_FCODE + 1][MAX_MV * 2 + 1];
+static uint8_t mv_penalty[MAX_FCODE + 1][MAX_DMV * 2 + 1];
static uint8_t fcode_tab[MAX_MV * 2 + 1];
static uint8_t uni_mpeg1_ac_vlc_len[64 * 64 * 2];
@@ -1053,7 +1053,7 @@ av_cold void ff_mpeg1_encode_init(MpegEncContext *s)
}
for (f_code = 1; f_code <= MAX_FCODE; f_code++)
- for (mv = -MAX_MV; mv <= MAX_MV; mv++) {
+ for (mv = -MAX_DMV; mv <= MAX_DMV; mv++) {
int len;
if (mv == 0) {
@@ -1076,7 +1076,7 @@ av_cold void ff_mpeg1_encode_init(MpegEncContext *s)
2 + bit_size;
}
- mv_penalty[f_code][mv + MAX_MV] = len;
+ mv_penalty[f_code][mv + MAX_DMV] = len;
}
diff --git a/libavcodec/mpeg4video.h b/libavcodec/mpeg4video.h
index 49bc13f87a..5998c7191c 100644
--- a/libavcodec/mpeg4video.h
+++ b/libavcodec/mpeg4video.h
@@ -140,7 +140,7 @@ void ff_mpeg4_encode_mb(MpegEncContext *s,
void ff_mpeg4_pred_ac(MpegEncContext *s, int16_t *block, int n,
int dir);
void ff_set_mpeg4_time(MpegEncContext *s);
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number);
int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb);
void ff_mpeg4_encode_video_packet_header(MpegEncContext *s);
diff --git a/libavcodec/mpeg4videoenc.c b/libavcodec/mpeg4videoenc.c
index ffa08beb87..b3ad4f9042 100644
--- a/libavcodec/mpeg4videoenc.c
+++ b/libavcodec/mpeg4videoenc.c
@@ -1086,7 +1086,7 @@ static void mpeg4_encode_vol_header(MpegEncContext *s,
}
/* write mpeg4 VOP header */
-void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
+int ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
{
int time_incr;
int time_div, time_mod;
@@ -1112,6 +1112,12 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
time_mod = FFUMOD(s->time, s->avctx->time_base.den);
time_incr = time_div - s->last_time_base;
av_assert0(time_incr >= 0);
+
+ // This limits the frame duration to max 1 hour
+ if (time_incr > 3600) {
+ av_log(s->avctx, AV_LOG_ERROR, "time_incr %d too large\n", time_incr);
+ return AVERROR(EINVAL);
+ }
while (time_incr--)
put_bits(&s->pb, 1, 1);
@@ -1137,6 +1143,8 @@ void ff_mpeg4_encode_picture_header(MpegEncContext *s, int picture_number)
put_bits(&s->pb, 3, s->f_code); /* fcode_for */
if (s->pict_type == AV_PICTURE_TYPE_B)
put_bits(&s->pb, 3, s->b_code); /* fcode_back */
+
+ return 0;
}
static av_cold void init_uni_dc_tab(void)
diff --git a/libavcodec/mpegvideo_enc.c b/libavcodec/mpegvideo_enc.c
index 04be96759b..ebd5abbf8a 100644
--- a/libavcodec/mpegvideo_enc.c
+++ b/libavcodec/mpegvideo_enc.c
@@ -76,7 +76,7 @@ static int sse_mb(MpegEncContext *s);
static void denoise_dct_c(MpegEncContext *s, int16_t *block);
static int dct_quantize_trellis_c(MpegEncContext *s, int16_t *block, int n, int qscale, int *overflow);
-static uint8_t default_mv_penalty[MAX_FCODE + 1][MAX_MV * 2 + 1];
+static uint8_t default_mv_penalty[MAX_FCODE + 1][MAX_DMV * 2 + 1];
static uint8_t default_fcode_tab[MAX_MV * 2 + 1];
const AVOption ff_mpv_generic_options[] = {
@@ -342,6 +342,7 @@ av_cold int ff_mpv_encode_init(AVCodecContext *avctx)
break;
}
+ avctx->bits_per_raw_sample = av_clip(avctx->bits_per_raw_sample, 0, 8);
s->bit_rate = avctx->bit_rate;
s->width = avctx->width;
s->height = avctx->height;
@@ -3765,9 +3766,11 @@ static int encode_picture(MpegEncContext *s, int picture_number)
ff_wmv2_encode_picture_header(s, picture_number);
else if (CONFIG_MSMPEG4_ENCODER && s->msmpeg4_version)
ff_msmpeg4_encode_picture_header(s, picture_number);
- else if (CONFIG_MPEG4_ENCODER && s->h263_pred)
- ff_mpeg4_encode_picture_header(s, picture_number);
- else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
+ else if (CONFIG_MPEG4_ENCODER && s->h263_pred) {
+ ret = ff_mpeg4_encode_picture_header(s, picture_number);
+ if (ret < 0)
+ return ret;
+ } else if (CONFIG_RV10_ENCODER && s->codec_id == AV_CODEC_ID_RV10) {
ret = ff_rv10_encode_picture_header(s, picture_number);
if (ret < 0)
return ret;
diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c
index 74e52af6cd..c640934986 100644
--- a/libavcodec/mss2.c
+++ b/libavcodec/mss2.c
@@ -210,8 +210,13 @@ static int decode_555(GetByteContext *gB, uint16_t *dst, int stride,
last_symbol = b << 8 | bytestream2_get_byte(gB);
else if (b > 129) {
repeat = 0;
- while (b-- > 130)
+ while (b-- > 130) {
+ if (repeat >= (INT_MAX >> 8) - 1) {
+ av_log(NULL, AV_LOG_ERROR, "repeat overflow\n");
+ return AVERROR_INVALIDDATA;
+ }
repeat = (repeat << 8) + bytestream2_get_byte(gB) + 1;
+ }
if (last_symbol == -2) {
int skip = FFMIN((unsigned)repeat, dst + w - p);
repeat -= skip;
diff --git a/libavcodec/pngenc.c b/libavcodec/pngenc.c
index f6ad830cd9..edc9011a9b 100644
--- a/libavcodec/pngenc.c
+++ b/libavcodec/pngenc.c
@@ -747,12 +747,11 @@ static int apng_encode_frame(AVCodecContext *avctx, const AVFrame *pict,
// Do disposal
if (last_fctl_chunk.dispose_op != APNG_DISPOSE_OP_PREVIOUS) {
- memcpy(diffFrame->data[0], s->last_frame->data[0],
- s->last_frame->linesize[0] * s->last_frame->height);
+ av_frame_copy(diffFrame, s->last_frame);
if (last_fctl_chunk.dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
for (y = last_fctl_chunk.y_offset; y < last_fctl_chunk.y_offset + last_fctl_chunk.height; ++y) {
- size_t row_start = s->last_frame->linesize[0] * y + bpp * last_fctl_chunk.x_offset;
+ size_t row_start = diffFrame->linesize[0] * y + bpp * last_fctl_chunk.x_offset;
memset(diffFrame->data[0] + row_start, 0, bpp * last_fctl_chunk.width);
}
}
@@ -760,8 +759,7 @@ static int apng_encode_frame(AVCodecContext *avctx, const AVFrame *pict,
if (!s->prev_frame)
continue;
- memcpy(diffFrame->data[0], s->prev_frame->data[0],
- s->prev_frame->linesize[0] * s->prev_frame->height);
+ av_frame_copy(diffFrame, s->prev_frame);
}
// Do inverse blending
@@ -923,13 +921,12 @@ static int encode_apng(AVCodecContext *avctx, AVPacket *pkt,
}
// Do disposal, but not blending
- memcpy(s->prev_frame->data[0], s->last_frame->data[0],
- s->last_frame->linesize[0] * s->last_frame->height);
+ av_frame_copy(s->prev_frame, s->last_frame);
if (s->last_frame_fctl.dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
uint32_t y;
uint8_t bpp = (s->bits_per_pixel + 7) >> 3;
for (y = s->last_frame_fctl.y_offset; y < s->last_frame_fctl.y_offset + s->last_frame_fctl.height; ++y) {
- size_t row_start = s->last_frame->linesize[0] * y + bpp * s->last_frame_fctl.x_offset;
+ size_t row_start = s->prev_frame->linesize[0] * y + bpp * s->last_frame_fctl.x_offset;
memset(s->prev_frame->data[0] + row_start, 0, bpp * s->last_frame_fctl.width);
}
}
diff --git a/libavcodec/put_bits.h b/libavcodec/put_bits.h
index 5b1bc8b8b7..0db8a033ad 100644
--- a/libavcodec/put_bits.h
+++ b/libavcodec/put_bits.h
@@ -163,9 +163,13 @@ static inline void put_bits(PutBitContext *s, int n, unsigned int value)
#ifdef BITSTREAM_WRITER_LE
bit_buf |= value << (32 - bit_left);
if (n >= bit_left) {
- av_assert2(s->buf_ptr+3<s->buf_end);
- AV_WL32(s->buf_ptr, bit_buf);
- s->buf_ptr += 4;
+ if (3 < s->buf_end - s->buf_ptr) {
+ AV_WL32(s->buf_ptr, bit_buf);
+ s->buf_ptr += 4;
+ } else {
+ av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too small\n");
+ av_assert2(0);
+ }
bit_buf = value >> bit_left;
bit_left += 32;
}
@@ -177,9 +181,13 @@ static inline void put_bits(PutBitContext *s, int n, unsigned int value)
} else {
bit_buf <<= bit_left;
bit_buf |= value >> (n - bit_left);
- av_assert2(s->buf_ptr+3<s->buf_end);
- AV_WB32(s->buf_ptr, bit_buf);
- s->buf_ptr += 4;
+ if (3 < s->buf_end - s->buf_ptr) {
+ AV_WB32(s->buf_ptr, bit_buf);
+ s->buf_ptr += 4;
+ } else {
+ av_log(NULL, AV_LOG_ERROR, "Internal error, put_bits buffer too small\n");
+ av_assert2(0);
+ }
bit_left += 32 - n;
bit_buf = value;
}
diff --git a/libavcodec/snowenc.c b/libavcodec/snowenc.c
index 5e5dc35e86..6757971ce3 100644
--- a/libavcodec/snowenc.c
+++ b/libavcodec/snowenc.c
@@ -291,7 +291,7 @@ static int encode_q_branch(SnowContext *s, int level, int x, int y){
c->penalty_factor = get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_cmp);
c->sub_penalty_factor= get_penalty_factor(s->lambda, s->lambda2, c->avctx->me_sub_cmp);
c->mb_penalty_factor = get_penalty_factor(s->lambda, s->lambda2, c->avctx->mb_cmp);
- c->current_mv_penalty= c->mv_penalty[s->m.f_code=1] + MAX_MV;
+ c->current_mv_penalty= c->mv_penalty[s->m.f_code=1] + MAX_DMV;
c->xmin = - x*block_w - 16+3;
c->ymin = - y*block_w - 16+3;
diff --git a/libavcodec/wavpackenc.c b/libavcodec/wavpackenc.c
index 6091e3f39b..751d1fdf92 100644
--- a/libavcodec/wavpackenc.c
+++ b/libavcodec/wavpackenc.c
@@ -128,6 +128,11 @@ static av_cold int wavpack_encode_init(AVCodecContext *avctx)
s->avctx = avctx;
+ if (avctx->channels > 255) {
+ av_log(avctx, AV_LOG_ERROR, "Invalid channel count: %d\n", avctx->channels);
+ return AVERROR(EINVAL);
+ }
+
if (!avctx->frame_size) {
int block_samples;
if (!(avctx->sample_rate & 1))
@@ -2878,7 +2883,7 @@ static int wavpack_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
}
buf_size = s->block_samples * avctx->channels * 8
- + 200 /* for headers */;
+ + 200 * avctx->channels /* for headers */;
if ((ret = ff_alloc_packet2(avctx, avpkt, buf_size, 0)) < 0)
return ret;
buf = avpkt->data;
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-18 12:23:38 +0000