From 893f1376793e67e4be76d074d51313e59805bd40 Mon Sep 17 00:00:00 2001 From: Aneesh Dogra Date: Thu, 5 Jan 2012 00:42:26 +0530 Subject: 4xm: fix calculation of the next output line position in decode_i2_frame(). The current code doesn't work unless width is an exact multiple of 16. Signed-off-by: Ronald S. Bultje --- libavcodec/4xm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index 83f0a12f1c..7cda26ed30 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -640,7 +640,7 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){ } dst+=16; } - dst += 16*stride - width; + dst += 16 * stride - x; } return 0; -- cgit v1.2.3 From 4b84f682232205eee84e0e6bea1858be8e234129 Mon Sep 17 00:00:00 2001 From: Aneesh Dogra Date: Thu, 5 Jan 2012 00:10:01 +0530 Subject: 4xm: pass the correct remaining buffer size to decode_i2_frame(). frame_size is the number of bytes left in the packet, so if we are passing buf-4 we can safely read frame_size+4 bytes. Signed-off-by: Ronald S. Bultje --- libavcodec/4xm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index 7cda26ed30..cfb8279870 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -786,7 +786,7 @@ static int decode_frame(AVCodecContext *avctx, if(frame_4cc == AV_RL32("ifr2")){ p->pict_type= AV_PICTURE_TYPE_I; - if(decode_i2_frame(f, buf-4, frame_size) < 0) + if(decode_i2_frame(f, buf-4, frame_size + 4) < 0) return -1; }else if(frame_4cc == AV_RL32("ifrm")){ p->pict_type= AV_PICTURE_TYPE_I; -- cgit v1.2.3 From 295a7c0238e84b0ffa8f21ed938d45f51f54a4cd Mon Sep 17 00:00:00 2001 From: Aneesh Dogra Date: Thu, 5 Jan 2012 01:28:21 +0530 Subject: 4xm: Prevent buffer overreads. 4xm decoder while decoding i2 frames can overread the buffer if proper checks are not made. Signed-off-by: Ronald S. Bultje --- libavcodec/4xm.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index cfb8279870..d16c232fbf 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -614,16 +614,24 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){ int x, y, x2, y2; const int width= f->avctx->width; const int height= f->avctx->height; + const int mbs = FFALIGN(width, 16) * FFALIGN(height, 16); uint16_t *dst= (uint16_t*)f->current_picture.data[0]; const int stride= f->current_picture.linesize[0]>>1; + GetByteContext g3; + + if(length < mbs * 8) { + av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n"); + return AVERROR_INVALIDDATA; + } + bytestream2_init(&g3, buf, length); for(y=0; y>2) + 8*(y2>>2); -- cgit v1.2.3 From 3fa646e8590cf86d3006e76047daa255a7ecc3f7 Mon Sep 17 00:00:00 2001 From: "Ronald S. Bultje" Date: Wed, 4 Jan 2012 21:27:31 -0800 Subject: Revert "4xm: Prevent buffer overreads." This reverts commit 295a7c0238e84b0ffa8f21ed938d45f51f54a4cd. The patch breaks decoding of regular files (e.g. fate-4xm-2). --- libavcodec/4xm.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index d16c232fbf..cfb8279870 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -614,24 +614,16 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){ int x, y, x2, y2; const int width= f->avctx->width; const int height= f->avctx->height; - const int mbs = FFALIGN(width, 16) * FFALIGN(height, 16); uint16_t *dst= (uint16_t*)f->current_picture.data[0]; const int stride= f->current_picture.linesize[0]>>1; - GetByteContext g3; - - if(length < mbs * 8) { - av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n"); - return AVERROR_INVALIDDATA; - } - bytestream2_init(&g3, buf, length); for(y=0; y>2) + 8*(y2>>2); -- cgit v1.2.3 From 7f09791d28c82c9169d1612a6192851837341ca9 Mon Sep 17 00:00:00 2001 From: Oana Stratulat Date: Thu, 5 Jan 2012 01:08:05 +0200 Subject: Report an error if pitch_lag is zero in AMR-NB decoder. This fixes an infinite loop in the decoder on specially crafted files, and fixes bug 151. Signed-off-by: Ronald S. Bultje --- libavcodec/amrnbdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/amrnbdec.c b/libavcodec/amrnbdec.c index 926014f83c..fff0e7248a 100644 --- a/libavcodec/amrnbdec.c +++ b/libavcodec/amrnbdec.c @@ -977,6 +977,10 @@ static int amrnb_decode_frame(AVCodecContext *avctx, void *data, pitch_sharpening(p, subframe, p->cur_frame_mode, &fixed_sparse); + if (fixed_sparse.pitch_lag == 0) { + av_log(avctx, AV_LOG_ERROR, "The file is corrupted, pitch_lag = 0 is not allowed\n"); + return AVERROR_INVALIDDATA; + } ff_set_fixed_vector(p->fixed_vector, &fixed_sparse, 1.0, AMR_SUBFRAME_SIZE); -- cgit v1.2.3 From 6450599e224164d51a90b1be38598cbc3093bad6 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Thu, 5 Jan 2012 10:14:07 +0100 Subject: lavf: refactor av_read_frame() to make it easier to understand. --- libavformat/utils.c | 58 ++++++++++++++++++++++++++++++----------------------- 1 file changed, 33 insertions(+), 25 deletions(-) diff --git a/libavformat/utils.c b/libavformat/utils.c index db028780ff..0332927b43 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -31,6 +31,7 @@ #include "libavutil/pixdesc.h" #include "metadata.h" #include "id3v2.h" +#include "libavutil/avassert.h" #include "libavutil/avstring.h" #include "libavutil/mathematics.h" #include "libavutil/parseutils.h" @@ -1248,18 +1249,34 @@ static int read_frame_internal(AVFormatContext *s, AVPacket *pkt) return 0; } +static int read_from_packet_buffer(AVFormatContext *s, AVPacket *pkt) +{ + AVPacketList *pktl = s->packet_buffer; + av_assert0(pktl); + *pkt = pktl->pkt; + s->packet_buffer = pktl->next; + av_freep(&pktl); + return 0; +} + int av_read_frame(AVFormatContext *s, AVPacket *pkt) { AVPacketList *pktl; int eof=0; const int genpts= s->flags & AVFMT_FLAG_GENPTS; + if (!genpts) + return s->packet_buffer ? read_from_packet_buffer(s, pkt) : + read_frame_internal(s, pkt); + for(;;){ + int ret; pktl = s->packet_buffer; + if (pktl) { AVPacket *next_pkt= &pktl->pkt; - if(genpts && next_pkt->dts != AV_NOPTS_VALUE){ + if (next_pkt->dts != AV_NOPTS_VALUE) { int wrap_bits = s->streams[next_pkt->stream_index]->pts_wrap_bits; while(pktl && next_pkt->pts == AV_NOPTS_VALUE){ if( pktl->pkt.stream_index == next_pkt->stream_index @@ -1272,33 +1289,24 @@ int av_read_frame(AVFormatContext *s, AVPacket *pkt) pktl = s->packet_buffer; } - if( next_pkt->pts != AV_NOPTS_VALUE - || next_pkt->dts == AV_NOPTS_VALUE - || !genpts || eof){ - /* read packet from packet buffer, if there is data */ - *pkt = *next_pkt; - s->packet_buffer = pktl->next; - av_free(pktl); - return 0; - } + /* read packet from packet buffer, if there is data */ + if (!(next_pkt->pts == AV_NOPTS_VALUE && + next_pkt->dts != AV_NOPTS_VALUE && !eof)) + return read_from_packet_buffer(s, pkt); } - if(genpts){ - int ret= read_frame_internal(s, pkt); - if(ret<0){ - if(pktl && ret != AVERROR(EAGAIN)){ - eof=1; - continue; - }else - return ret; - } - if(av_dup_packet(add_to_pktbuf(&s->packet_buffer, pkt, - &s->packet_buffer_end)) < 0) - return AVERROR(ENOMEM); - }else{ - assert(!s->packet_buffer); - return read_frame_internal(s, pkt); + ret = read_frame_internal(s, pkt); + if (ret < 0) { + if (pktl && ret != AVERROR(EAGAIN)) { + eof = 1; + continue; + } else + return ret; } + + if (av_dup_packet(add_to_pktbuf(&s->packet_buffer, pkt, + &s->packet_buffer_end)) < 0) + return AVERROR(ENOMEM); } } -- cgit v1.2.3 From f9b9dd874030db891b4f1c70e06d48311023a006 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Thu, 5 Jan 2012 10:16:41 +0100 Subject: lavf: cosmetics, reformat av_read_frame(). --- libavformat/utils.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/libavformat/utils.c b/libavformat/utils.c index 0332927b43..a79665801f 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -1261,30 +1261,29 @@ static int read_from_packet_buffer(AVFormatContext *s, AVPacket *pkt) int av_read_frame(AVFormatContext *s, AVPacket *pkt) { - AVPacketList *pktl; - int eof=0; - const int genpts= s->flags & AVFMT_FLAG_GENPTS; + const int genpts = s->flags & AVFMT_FLAG_GENPTS; + int eof = 0; if (!genpts) return s->packet_buffer ? read_from_packet_buffer(s, pkt) : read_frame_internal(s, pkt); - for(;;){ + for (;;) { int ret; - pktl = s->packet_buffer; + AVPacketList *pktl = s->packet_buffer; if (pktl) { - AVPacket *next_pkt= &pktl->pkt; + AVPacket *next_pkt = &pktl->pkt; if (next_pkt->dts != AV_NOPTS_VALUE) { int wrap_bits = s->streams[next_pkt->stream_index]->pts_wrap_bits; - while(pktl && next_pkt->pts == AV_NOPTS_VALUE){ - if( pktl->pkt.stream_index == next_pkt->stream_index - && (0 > av_compare_mod(next_pkt->dts, pktl->pkt.dts, 2LL << (wrap_bits - 1))) - && av_compare_mod(pktl->pkt.pts, pktl->pkt.dts, 2LL << (wrap_bits - 1))) { //not b frame - next_pkt->pts= pktl->pkt.dts; + while (pktl && next_pkt->pts == AV_NOPTS_VALUE) { + if (pktl->pkt.stream_index == next_pkt->stream_index && + (av_compare_mod(next_pkt->dts, pktl->pkt.dts, 2LL << (wrap_bits - 1)) < 0) && + av_compare_mod(pktl->pkt.pts, pktl->pkt.dts, 2LL << (wrap_bits - 1))) { //not b frame + next_pkt->pts = pktl->pkt.dts; } - pktl= pktl->next; + pktl = pktl->next; } pktl = s->packet_buffer; } -- cgit v1.2.3 From dff4af448dd49449e3efdd0bcee19a69855d8081 Mon Sep 17 00:00:00 2001 From: Diego Biurrun Date: Tue, 3 Jan 2012 14:52:02 +0100 Subject: timer: K&R formatting cosmetics --- libavutil/timer.h | 44 ++++++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/libavutil/timer.h b/libavutil/timer.h index 6333cc61ce..78d2b5f8fc 100644 --- a/libavutil/timer.h +++ b/libavutil/timer.h @@ -28,6 +28,7 @@ #include #include + #include "config.h" #if ARCH_ARM @@ -45,29 +46,32 @@ #endif #ifdef AV_READ_TIME -#define START_TIMER \ -uint64_t tend;\ -uint64_t tstart= AV_READ_TIME();\ +#define START_TIMER \ + uint64_t tend; \ + uint64_t tstart = AV_READ_TIME(); \ -#define STOP_TIMER(id) \ -tend= AV_READ_TIME();\ -{\ - static uint64_t tsum=0;\ - static int tcount=0;\ - static int tskip_count=0;\ - if(tcount<2 || tend - tstart < 8*tsum/tcount || tend - tstart < 2000){\ - tsum+= tend - tstart;\ - tcount++;\ - }else\ - tskip_count++;\ - if(((tcount+tskip_count)&(tcount+tskip_count-1))==0){\ - av_log(NULL, AV_LOG_ERROR, "%"PRIu64" decicycles in %s, %d runs, %d skips\n",\ - tsum*10/tcount, id, tcount, tskip_count);\ - }\ -} +#define STOP_TIMER(id) \ + tend = AV_READ_TIME(); \ + { \ + static uint64_t tsum = 0; \ + static int tcount = 0; \ + static int tskip_count = 0; \ + if (tcount < 2 || \ + tend - tstart < 8 * tsum / tcount || \ + tend - tstart < 2000) { \ + tsum+= tend - tstart; \ + tcount++; \ + } else \ + tskip_count++; \ + if (((tcount + tskip_count) & (tcount + tskip_count - 1)) == 0) { \ + av_log(NULL, AV_LOG_ERROR, \ + "%"PRIu64" decicycles in %s, %d runs, %d skips\n", \ + tsum * 10 / tcount, id, tcount, tskip_count); \ + } \ + } #else #define START_TIMER -#define STOP_TIMER(id) {} +#define STOP_TIMER(id) { } #endif #endif /* AVUTIL_TIMER_H */ -- cgit v1.2.3 From 2ba65879b5853b49bbefb75346fd73c8645bccea Mon Sep 17 00:00:00 2001 From: "Ronald S. Bultje" Date: Wed, 4 Jan 2012 19:48:02 -0800 Subject: swscale: remove unused U/V arguments from yuv2rgb_write(). Also document the function somewhat. --- libswscale/swscale.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/libswscale/swscale.c b/libswscale/swscale.c index 11bb7d6c3f..980fc4a401 100644 --- a/libswscale/swscale.c +++ b/libswscale/swscale.c @@ -884,9 +884,17 @@ YUV2PACKED16WRAPPER(yuv2, rgb48, rgb48le, PIX_FMT_RGB48LE) YUV2PACKED16WRAPPER(yuv2, rgb48, bgr48be, PIX_FMT_BGR48BE) YUV2PACKED16WRAPPER(yuv2, rgb48, bgr48le, PIX_FMT_BGR48LE) +/* + * Write out 2 RGB pixels in the target pixel format. This function takes a + * R/G/B LUT as generated by ff_yuv2rgb_c_init_tables(), which takes care of + * things like endianness conversion and shifting. The caller takes care of + * setting the correct offset in these tables from the chroma (U/V) values. + * This function then uses the luminance (Y1/Y2) values to write out the + * correct RGB values into the destination buffer. + */ static av_always_inline void yuv2rgb_write(uint8_t *_dest, int i, unsigned Y1, unsigned Y2, - unsigned U, unsigned V, unsigned A1, unsigned A2, + unsigned A1, unsigned A2, const void *_r, const void *_g, const void *_b, int y, enum PixelFormat target, int hasAlpha) { @@ -1053,7 +1061,7 @@ yuv2rgb_X_c_template(SwsContext *c, const int16_t *lumFilter, g = (c->table_gU[U] + c->table_gV[V]); b = c->table_bU[U]; - yuv2rgb_write(dest, i, Y1, Y2, U, V, hasAlpha ? A1 : 0, hasAlpha ? A2 : 0, + yuv2rgb_write(dest, i, Y1, Y2, hasAlpha ? A1 : 0, hasAlpha ? A2 : 0, r, g, b, y, target, hasAlpha); } } @@ -1089,7 +1097,7 @@ yuv2rgb_2_c_template(SwsContext *c, const int16_t *buf[2], A2 = (abuf0[i * 2 + 1] * yalpha1 + abuf1[i * 2 + 1] * yalpha) >> 19; } - yuv2rgb_write(dest, i, Y1, Y2, U, V, hasAlpha ? A1 : 0, hasAlpha ? A2 : 0, + yuv2rgb_write(dest, i, Y1, Y2, hasAlpha ? A1 : 0, hasAlpha ? A2 : 0, r, g, b, y, target, hasAlpha); } } @@ -1121,7 +1129,7 @@ yuv2rgb_1_c_template(SwsContext *c, const int16_t *buf0, A2 = abuf0[i * 2 + 1] >> 7; } - yuv2rgb_write(dest, i, Y1, Y2, U, V, hasAlpha ? A1 : 0, hasAlpha ? A2 : 0, + yuv2rgb_write(dest, i, Y1, Y2, hasAlpha ? A1 : 0, hasAlpha ? A2 : 0, r, g, b, y, target, hasAlpha); } } else { @@ -1140,7 +1148,7 @@ yuv2rgb_1_c_template(SwsContext *c, const int16_t *buf0, A2 = abuf0[i * 2 + 1] >> 7; } - yuv2rgb_write(dest, i, Y1, Y2, U, V, hasAlpha ? A1 : 0, hasAlpha ? A2 : 0, + yuv2rgb_write(dest, i, Y1, Y2, hasAlpha ? A1 : 0, hasAlpha ? A2 : 0, r, g, b, y, target, hasAlpha); } } -- cgit v1.2.3 From 9b4767e4784577f3107730316fe652ccaccd9b3a Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Tue, 3 Jan 2012 13:38:01 +0100 Subject: vp3: fix streams with non-zero last coefficient Fixes a regression introduced in 8b94df0f2047e972. --- libavcodec/vp3.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c index f44d084dbd..602b5fa7a1 100644 --- a/libavcodec/vp3.c +++ b/libavcodec/vp3.c @@ -1378,6 +1378,8 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag, return i; } } while (i < 64); + // return value is expected to be a valid level + i--; end: // the actual DC+prediction is in the fragment structure block[0] = frag->dc * s->qmat[0][inter][plane][0]; -- cgit v1.2.3 From 5e5cde27452d6725427feb3ae86c89e986506c8e Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Tue, 3 Jan 2012 13:56:42 +0100 Subject: vp3: add fate test for non-zero last coefficient --- tests/fate/vpx.mak | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/fate/vpx.mak b/tests/fate/vpx.mak index 85749f0c80..2d1c8fd619 100644 --- a/tests/fate/vpx.mak +++ b/tests/fate/vpx.mak @@ -7,6 +7,9 @@ fate-ea-vp61: CMD = framecrc -i $(SAMPLES)/ea-vp6/MovieSkirmishGondor.vp6 -t 4 FATE_TESTS += fate-vp3 fate-vp3: CMD = framecrc -i $(SAMPLES)/vp3/vp31.avi +FATE_TESTS += fate-vp3-coeff-level64 +fate-vp3-coeff-level64: CMD = framecrc -i $(SAMPLES)/vp3/coeff_level64.mkv + FATE_TESTS += fate-vp5 fate-vp5: CMD = framecrc -i $(SAMPLES)/vp5/potter512-400-partial.avi -an -- cgit v1.2.3 From e268a352af893e47bd3ea2aed90761cb0b4feca7 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Thu, 5 Jan 2012 03:47:21 +0100 Subject: mjpegdec: parse RSTn to prevent skipping other data in mjpeg_decode_scan Check explicitly if enough bits are left to prevent an infinite loop when the bitstream buffer is not followed by zero-padding. Based on patches by Michael Niedermayer . --- libavcodec/mjpegdec.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 058b08fa83..7a85c16d95 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -881,14 +881,22 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, i } } - if (s->restart_interval && show_bits(&s->gb, 8) == 0xFF){ /* skip RSTn */ - --s->restart_count; - align_get_bits(&s->gb); - while(show_bits(&s->gb, 8) == 0xFF) - skip_bits(&s->gb, 8); - skip_bits(&s->gb, 8); - for (i=0; ilast_dc[i] = 1024; + if (s->restart_interval) { + s->restart_count--; + i = 8 + ((-get_bits_count(&s->gb)) & 7); + /* skip RSTn */ + if (show_bits(&s->gb, i) == (1 << i) - 1) { + int pos = get_bits_count(&s->gb); + align_get_bits(&s->gb); + while (get_bits_left(&s->gb) >= 8 && show_bits(&s->gb, 8) == 0xFF) + skip_bits(&s->gb, 8); + if ((get_bits(&s->gb, 8) & 0xF8) == 0xD0) { + for (i = 0; i < nb_components; i++) /* reset dc */ + s->last_dc[i] = 1024; + } else { + skip_bits_long(&s->gb, pos - get_bits_count(&s->gb)); + } + } } } } -- cgit v1.2.3 From 9b55b4bb3acc5f41b00eed5b93af4cd8400c9145 Mon Sep 17 00:00:00 2001 From: Aneesh Dogra Date: Thu, 5 Jan 2012 01:28:21 +0530 Subject: 4xm: Prevent buffer overreads. 4xm decoder while decoding i2 frames can overread the buffer if proper checks are not made. Signed-off-by: Ronald S. Bultje --- libavcodec/4xm.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index cfb8279870..52edc9942e 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -614,16 +614,24 @@ static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){ int x, y, x2, y2; const int width= f->avctx->width; const int height= f->avctx->height; + const int mbs = (FFALIGN(width, 16) >> 4) * (FFALIGN(height, 16) >> 4); uint16_t *dst= (uint16_t*)f->current_picture.data[0]; const int stride= f->current_picture.linesize[0]>>1; + GetByteContext g3; + + if(length < mbs * 8) { + av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n"); + return AVERROR_INVALIDDATA; + } + bytestream2_init(&g3, buf, length); for(y=0; y>2) + 8*(y2>>2); -- cgit v1.2.3 From 4274e481c01e70085597f6980d3f14330528a0f7 Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Wed, 4 Jan 2012 17:42:15 -0800 Subject: mov: Support MOV_CH_LAYOUT_USE_DESCRIPTIONS for labeled descriptions. --- libavformat/mov.c | 22 +++++++++++++++------- libavformat/mov_chan.c | 16 ++++++++++++++-- libavformat/mov_chan.h | 8 ++++++++ 3 files changed, 37 insertions(+), 9 deletions(-) diff --git a/libavformat/mov.c b/libavformat/mov.c index d3674d9e12..63089b935c 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -559,7 +559,8 @@ static int mov_read_chan(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; uint8_t version; - uint32_t flags, layout_tag, bitmap, num_descr; + uint32_t flags, layout_tag, bitmap, num_descr, label_mask; + int i; if (c->fc->nb_streams < 1) return 0; @@ -581,9 +582,7 @@ static int mov_read_chan(MOVContext *c, AVIOContext *pb, MOVAtom atom) av_dlog(c->fc, "chan: size=%ld version=%u flags=%u layout=%u bitmap=%u num_descr=%u\n", atom.size, version, flags, layout_tag, bitmap, num_descr); -#if 0 - /* TODO: use the channel descriptions if the layout tag is 0 */ - int i; + label_mask = 0; for (i = 0; i < num_descr; i++) { uint32_t label, cflags; float coords[3]; @@ -592,10 +591,19 @@ static int mov_read_chan(MOVContext *c, AVIOContext *pb, MOVAtom atom) AV_WN32(&coords[0], avio_rl32(pb)); // mCoordinates[0] AV_WN32(&coords[1], avio_rl32(pb)); // mCoordinates[1] AV_WN32(&coords[2], avio_rl32(pb)); // mCoordinates[2] + if (layout_tag == 0) { + uint32_t mask_incr = ff_mov_get_channel_label(label); + if (mask_incr == 0) { + label_mask = 0; + break; + } + label_mask |= mask_incr; + } } -#endif - - st->codec->channel_layout = ff_mov_get_channel_layout(layout_tag, bitmap); + if (layout_tag == 0) + st->codec->channel_layout = label_mask; + else + st->codec->channel_layout = ff_mov_get_channel_layout(layout_tag, bitmap); return 0; } diff --git a/libavformat/mov_chan.c b/libavformat/mov_chan.c index 3c1ced6564..5728ebd898 100644 --- a/libavformat/mov_chan.c +++ b/libavformat/mov_chan.c @@ -428,8 +428,7 @@ uint64_t ff_mov_get_channel_layout(uint32_t tag, uint32_t bitmap) int i, channels; const struct MovChannelLayoutMap *layout_map; - /* handle the use of the channel descriptions */ - /* TODO: map MOV channel labels to Libav channels */ + /* use ff_mov_get_channel_label() to build a layout instead */ if (tag == MOV_CH_LAYOUT_USE_DESCRIPTIONS) return 0; @@ -451,6 +450,19 @@ uint64_t ff_mov_get_channel_layout(uint32_t tag, uint32_t bitmap) return layout_map[i].layout; } +uint32_t ff_mov_get_channel_label(uint32_t label) +{ + if (label == 0) + return 0; + if (label <= 18) + return 1U << (label - 1); + if (label == 38) + return AV_CH_STEREO_LEFT; + if (label == 39) + return AV_CH_STEREO_RIGHT; + return 0; +} + uint32_t ff_mov_get_channel_layout_tag(enum CodecID codec_id, uint64_t channel_layout, uint32_t *bitmap) diff --git a/libavformat/mov_chan.h b/libavformat/mov_chan.h index 9723340102..abb6916144 100644 --- a/libavformat/mov_chan.h +++ b/libavformat/mov_chan.h @@ -39,6 +39,14 @@ */ uint64_t ff_mov_get_channel_layout(uint32_t tag, uint32_t bitmap); +/** + * Get the channel layout for the specified channel layout tag. + * + * @param[in] tag channel label + * @return channel layout mask fragment + */ +uint32_t ff_mov_get_channel_label(uint32_t label); + /** * Get the channel layout tag for the specified codec id and channel layout. * If the layout tag was not found, use a channel bitmap if possible. -- cgit v1.2.3 From ce23b2af18485499303ac1ac3aa9226ed69b240f Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Thu, 5 Jan 2012 11:14:23 -0800 Subject: fate: Add missing reference file from 9b4767e4. --- tests/ref/fate/vp3-coeff-level64 | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 tests/ref/fate/vp3-coeff-level64 diff --git a/tests/ref/fate/vp3-coeff-level64 b/tests/ref/fate/vp3-coeff-level64 new file mode 100644 index 0000000000..31a49aa1a9 --- /dev/null +++ b/tests/ref/fate/vp3-coeff-level64 @@ -0,0 +1,8 @@ +0, 0, 4617600, 0x4ba6df50 +0, 6000, 4617600, 0x419fdeaf +0, 12000, 4617600, 0xeb2edced +0, 18000, 4617600, 0xa2bb3a1a +0, 24000, 4617600, 0x411cfb36 +0, 30000, 4617600, 0xb2dc22ed +0, 36000, 4617600, 0x236d23b5 +0, 42000, 4617600, 0x7fef275e -- cgit v1.2.3 From faaec4676cb4c7a2303d50df66c6290bc96a7657 Mon Sep 17 00:00:00 2001 From: Chris Evans Date: Thu, 5 Jan 2012 21:19:30 +0100 Subject: matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc() Fixes bug #190 Chromium bug #100492 related to CVE-2011-3893 Signed-off-by: Reinhard Tartler --- libavformat/matroskadec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c index 2684d6e6d9..e5fbd43266 100644 --- a/libavformat/matroskadec.c +++ b/libavformat/matroskadec.c @@ -1188,7 +1188,6 @@ static int matroska_parse_seekhead_entry(MatroskaDemuxContext *matroska, int idx static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) { EbmlList *seekhead_list = &matroska->seekhead; - MatroskaSeekhead *seekhead = seekhead_list->elem; int64_t before_pos = avio_tell(matroska->ctx->pb); int i; @@ -1198,6 +1197,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) return; for (i = 0; i < seekhead_list->nb_elem; i++) { + MatroskaSeekhead *seekhead = seekhead_list->elem; if (seekhead[i].pos <= before_pos) continue; -- cgit v1.2.3 From bb5b3940b08d8dad5b7e948e8f3b02cd2eb70716 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Thu, 5 Jan 2012 20:50:55 +0100 Subject: adpcm: ADPCM Electronic Arts has always two channels --- libavcodec/adpcm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index 2081ef64d7..b319635ed4 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -91,9 +91,13 @@ typedef struct ADPCMDecodeContext { static av_cold int adpcm_decode_init(AVCodecContext * avctx) { ADPCMDecodeContext *c = avctx->priv_data; + unsigned int min_channels = 1; unsigned int max_channels = 2; switch(avctx->codec->id) { + case CODEC_ID_ADPCM_EA: + min_channels = 2; + break; case CODEC_ID_ADPCM_EA_R1: case CODEC_ID_ADPCM_EA_R2: case CODEC_ID_ADPCM_EA_R3: @@ -101,7 +105,7 @@ static av_cold int adpcm_decode_init(AVCodecContext * avctx) max_channels = 6; break; } - if (avctx->channels <= 0 || avctx->channels > max_channels) { + if (avctx->channels < min_channels || avctx->channels > max_channels) { av_log(avctx, AV_LOG_ERROR, "Invalid number of channels\n"); return AVERROR(EINVAL); } -- cgit v1.2.3 From 32b83aeec1a129d6eef2e89c7f107c614dfb4574 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Fri, 30 Dec 2011 11:38:05 +0200 Subject: avio: Add an URLProtocol flag for indicating that a protocol uses network MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This definition is in two files, since the definitions will move to the private header at the next bump. Signed-off-by: Martin Storsjö --- libavformat/avio.h | 1 + libavformat/gopher.c | 1 + libavformat/http.c | 3 +++ libavformat/librtmp.c | 5 +++++ libavformat/mmsh.c | 1 + libavformat/mmst.c | 1 + libavformat/rtmpproto.c | 1 + libavformat/rtpproto.c | 1 + libavformat/tcp.c | 1 + libavformat/tls.c | 1 + libavformat/udp.c | 1 + libavformat/url.h | 1 + 12 files changed, 18 insertions(+) diff --git a/libavformat/avio.h b/libavformat/avio.h index dec2a5effe..e73264f4aa 100644 --- a/libavformat/avio.h +++ b/libavformat/avio.h @@ -146,6 +146,7 @@ typedef struct URLContext { } URLContext; #define URL_PROTOCOL_FLAG_NESTED_SCHEME 1 /*< The protocol name can be the first part of a nested protocol scheme */ +#define URL_PROTOCOL_FLAG_NETWORK 2 /*< The protocol uses network */ /** * @deprecated This struct is to be made private. Use the higher-level diff --git a/libavformat/gopher.c b/libavformat/gopher.c index c0338619b3..a149f7fd6b 100644 --- a/libavformat/gopher.c +++ b/libavformat/gopher.c @@ -121,4 +121,5 @@ URLProtocol ff_gopher_protocol = { .url_write = gopher_write, .url_close = gopher_close, .priv_data_size = sizeof(GopherContext), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; diff --git a/libavformat/http.c b/libavformat/http.c index 7badf720ed..eea8dedcbc 100644 --- a/libavformat/http.c +++ b/libavformat/http.c @@ -565,6 +565,7 @@ URLProtocol ff_http_protocol = { .url_get_file_handle = http_get_file_handle, .priv_data_size = sizeof(HTTPContext), .priv_data_class = &http_context_class, + .flags = URL_PROTOCOL_FLAG_NETWORK, }; #endif #if CONFIG_HTTPS_PROTOCOL @@ -578,6 +579,7 @@ URLProtocol ff_https_protocol = { .url_get_file_handle = http_get_file_handle, .priv_data_size = sizeof(HTTPContext), .priv_data_class = &https_context_class, + .flags = URL_PROTOCOL_FLAG_NETWORK, }; #endif @@ -693,5 +695,6 @@ URLProtocol ff_httpproxy_protocol = { .url_close = http_proxy_close, .url_get_file_handle = http_get_file_handle, .priv_data_size = sizeof(HTTPContext), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; #endif diff --git a/libavformat/librtmp.c b/libavformat/librtmp.c index c04c833c01..2d028b05e2 100644 --- a/libavformat/librtmp.c +++ b/libavformat/librtmp.c @@ -162,6 +162,7 @@ URLProtocol ff_rtmp_protocol = { .url_read_seek = rtmp_read_seek, .url_get_file_handle = rtmp_get_file_handle, .priv_data_size = sizeof(RTMP), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; URLProtocol ff_rtmpt_protocol = { @@ -174,6 +175,7 @@ URLProtocol ff_rtmpt_protocol = { .url_read_seek = rtmp_read_seek, .url_get_file_handle = rtmp_get_file_handle, .priv_data_size = sizeof(RTMP), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; URLProtocol ff_rtmpe_protocol = { @@ -186,6 +188,7 @@ URLProtocol ff_rtmpe_protocol = { .url_read_seek = rtmp_read_seek, .url_get_file_handle = rtmp_get_file_handle, .priv_data_size = sizeof(RTMP), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; URLProtocol ff_rtmpte_protocol = { @@ -198,6 +201,7 @@ URLProtocol ff_rtmpte_protocol = { .url_read_seek = rtmp_read_seek, .url_get_file_handle = rtmp_get_file_handle, .priv_data_size = sizeof(RTMP), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; URLProtocol ff_rtmps_protocol = { @@ -210,4 +214,5 @@ URLProtocol ff_rtmps_protocol = { .url_read_seek = rtmp_read_seek, .url_get_file_handle = rtmp_get_file_handle, .priv_data_size = sizeof(RTMP), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; diff --git a/libavformat/mmsh.c b/libavformat/mmsh.c index fa1a467223..5e9d0bc134 100644 --- a/libavformat/mmsh.c +++ b/libavformat/mmsh.c @@ -364,4 +364,5 @@ URLProtocol ff_mmsh_protocol = { .url_read = mmsh_read, .url_close = mmsh_close, .priv_data_size = sizeof(MMSHContext), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; diff --git a/libavformat/mmst.c b/libavformat/mmst.c index fe21a32357..93ad073869 100644 --- a/libavformat/mmst.c +++ b/libavformat/mmst.c @@ -625,4 +625,5 @@ URLProtocol ff_mmst_protocol = { .url_read = mms_read, .url_close = mms_close, .priv_data_size = sizeof(MMSTContext), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index 53d912e3c6..867969a670 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -1000,4 +1000,5 @@ URLProtocol ff_rtmp_protocol = { .url_write = rtmp_write, .url_close = rtmp_close, .priv_data_size = sizeof(RTMPContext), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; diff --git a/libavformat/rtpproto.c b/libavformat/rtpproto.c index 93cad3c8e6..03794ae1ce 100644 --- a/libavformat/rtpproto.c +++ b/libavformat/rtpproto.c @@ -330,4 +330,5 @@ URLProtocol ff_rtp_protocol = { .url_close = rtp_close, .url_get_file_handle = rtp_get_file_handle, .priv_data_size = sizeof(RTPContext), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; diff --git a/libavformat/tcp.c b/libavformat/tcp.c index 0d3aeaf48c..fdb457e8c5 100644 --- a/libavformat/tcp.c +++ b/libavformat/tcp.c @@ -204,4 +204,5 @@ URLProtocol ff_tcp_protocol = { .url_close = tcp_close, .url_get_file_handle = tcp_get_file_handle, .priv_data_size = sizeof(TCPContext), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; diff --git a/libavformat/tls.c b/libavformat/tls.c index 26f5ee5106..fb84fa82b6 100644 --- a/libavformat/tls.c +++ b/libavformat/tls.c @@ -248,4 +248,5 @@ URLProtocol ff_tls_protocol = { .url_write = tls_write, .url_close = tls_close, .priv_data_size = sizeof(TLSContext), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; diff --git a/libavformat/udp.c b/libavformat/udp.c index 2bdd3dc773..8bb63c6298 100644 --- a/libavformat/udp.c +++ b/libavformat/udp.c @@ -491,4 +491,5 @@ URLProtocol ff_udp_protocol = { .url_close = udp_close, .url_get_file_handle = udp_get_file_handle, .priv_data_size = sizeof(UDPContext), + .flags = URL_PROTOCOL_FLAG_NETWORK, }; diff --git a/libavformat/url.h b/libavformat/url.h index ea8c7abb8f..14832af79b 100644 --- a/libavformat/url.h +++ b/libavformat/url.h @@ -33,6 +33,7 @@ #if !FF_API_OLD_AVIO #define URL_PROTOCOL_FLAG_NESTED_SCHEME 1 /*< The protocol name can be the first part of a nested protocol scheme */ +#define URL_PROTOCOL_FLAG_NETWORK 2 /*< The protocol uses network */ extern int (*url_interrupt_cb)(void); -- cgit v1.2.3 From acb074301c8612dfd5f135a0513bbe93a2dc51d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Fri, 30 Dec 2011 11:43:10 +0200 Subject: avio: Only do implicit network initialization for network protocols MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The implicit network initialization is set to be removed in the future, but is kept for compatibility. By not doing the implicit initialization for non-network protocols, we avoid the warning about avformat_network_init() not being called for these, where it really doesn't make much sense. Signed-off-by: Martin Storsjö --- libavformat/avio.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavformat/avio.c b/libavformat/avio.c index 4750a9d544..ee4dfb6c8c 100644 --- a/libavformat/avio.c +++ b/libavformat/avio.c @@ -129,7 +129,7 @@ static int url_alloc_for_protocol (URLContext **puc, struct URLProtocol *up, int err; #if CONFIG_NETWORK - if (!ff_network_init()) + if (up->flags & URL_PROTOCOL_FLAG_NETWORK && !ff_network_init()) return AVERROR(EIO); #endif uc = av_mallocz(sizeof(URLContext) + strlen(filename) + 1); @@ -159,7 +159,8 @@ static int url_alloc_for_protocol (URLContext **puc, struct URLProtocol *up, fail: *puc = NULL; #if CONFIG_NETWORK - ff_network_close(); + if (up->flags & URL_PROTOCOL_FLAG_NETWORK) + ff_network_close(); #endif return err; } @@ -380,7 +381,8 @@ int ffurl_close(URLContext *h) if (h->is_connected && h->prot->url_close) ret = h->prot->url_close(h); #if CONFIG_NETWORK - ff_network_close(); + if (h->prot->flags & URL_PROTOCOL_FLAG_NETWORK) + ff_network_close(); #endif if (h->prot->priv_data_size) { if (h->prot->priv_data_class) -- cgit v1.2.3 From 696ace50ea91a65dff887aaf5296f42a2fbc8f6c Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Thu, 5 Jan 2012 21:28:03 +0100 Subject: truemotion2: check size before GetBitContext initialisation Prevents null ptr derefence for negative sizes. --- libavcodec/truemotion2.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index 8d72bb6df0..4045342ffa 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -272,6 +272,8 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i len = AV_RB32(buf); buf += 4; cur += 4; } if(len > 0) { + if (skip <= cur) + return -1; init_get_bits(&ctx->gb, buf, (skip - cur) * 8); if(tm2_read_deltas(ctx, stream_id) == -1) return -1; @@ -286,6 +288,8 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i buf += 4; cur += 4; buf += 4; cur += 4; /* unused by decoder */ + if (skip <= cur) + return -1; init_get_bits(&ctx->gb, buf, (skip - cur) * 8); if(tm2_build_huff_table(ctx, &codes) == -1) return -1; @@ -303,6 +307,8 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i ctx->tok_lens[stream_id] = toks; len = AV_RB32(buf); buf += 4; cur += 4; if(len > 0) { + if (skip <= cur) + return -1; init_get_bits(&ctx->gb, buf, (skip - cur) * 8); for(i = 0; i < toks; i++) { if (get_bits_left(&ctx->gb) <= 0) { -- cgit v1.2.3 From f5be84cfbc9c132a867ae8a8c0e0de26ed1a4e88 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Thu, 5 Jan 2012 21:57:22 +0100 Subject: ipmovie: do not read audio packets before the codec is known Prevents a division by zero. --- libavformat/ipmovie.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavformat/ipmovie.c b/libavformat/ipmovie.c index 4bd3580bc2..bd5ec30016 100644 --- a/libavformat/ipmovie.c +++ b/libavformat/ipmovie.c @@ -116,6 +116,11 @@ static int load_ipmovie_packet(IPMVEContext *s, AVIOContext *pb, int chunk_type; if (s->audio_chunk_offset) { + if (s->audio_type == CODEC_ID_NONE) { + av_log(NULL, AV_LOG_ERROR, "Can not read audio packet before" + "audio codec is known\n"); + return CHUNK_BAD; + } /* adjust for PCM audio by skipping chunk header */ if (s->audio_type != CODEC_ID_INTERPLAY_DPCM) { -- cgit v1.2.3