From 5e239c7f9e57d09c6a4c1d5762f441950f8d979c Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Thu, 23 Feb 2012 11:08:47 -0800 Subject: aacdec: Remove erroneous reference to global gain from the out of bounds scalefactor error message. --- libavcodec/aacdec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'libavcodec') diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index f491a098c3..186de96856 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -1016,7 +1016,6 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb, int offset[3] = { global_gain, global_gain - 90, 0 }; int clipped_offset; int noise_flag = 1; - static const char *const sf_str[3] = { "Global gain", "Noise gain", "Intensity stereo position" }; for (g = 0; g < ics->num_window_groups; g++) { for (i = 0; i < ics->max_sfb;) { int run_end = band_type_run_end[idx]; @@ -1055,7 +1054,7 @@ static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb, offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60; if (offset[0] > 255U) { av_log(ac->avctx, AV_LOG_ERROR, - "%s (%d) out of range.\n", sf_str[0], offset[0]); + "Scalefactor (%d) out of range.\n", offset[0]); return -1; } sf[idx] = -ff_aac_pow2sf_tab[offset[0] - 100 + POW_SF2_ZERO]; -- cgit v1.2.3 From bd7a647c0d3071456e066a2d2b6dc4ea807c6ffc Mon Sep 17 00:00:00 2001 From: Diego Biurrun Date: Sat, 18 Feb 2012 13:43:59 +0100 Subject: msmpeg4: Replace forward declaration by proper #include. --- libavcodec/msmpeg4.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'libavcodec') diff --git a/libavcodec/msmpeg4.c b/libavcodec/msmpeg4.c index 7aeb0bedce..1f3dc3a3a1 100644 --- a/libavcodec/msmpeg4.c +++ b/libavcodec/msmpeg4.c @@ -34,6 +34,7 @@ #include "libavutil/x86_cpu.h" #include "h263.h" #include "mpeg4video.h" +#include "vc1data.h" /* * You can also call this codec : MPEG4 with a twist ! @@ -59,9 +60,6 @@ static uint32_t v2_dc_lum_table[512][2]; static uint32_t v2_dc_chroma_table[512][2]; -/* vc1 externs */ -extern const uint8_t ff_wmv3_dc_scale_table[32]; - #include "msmpeg4data.h" #if CONFIG_ENCODERS //strangely gcc includes this even if it is not referenced -- cgit v1.2.3 From fc9bc08dca9ac32526251e19fcf738d23b8c68d1 Mon Sep 17 00:00:00 2001 From: "Ronald S. Bultje" Date: Tue, 28 Feb 2012 10:22:28 -0800 Subject: Indeo3: fix crashes on corrupt bitstreams. Splits at borders of cells are invalid, since it leaves one of the cells with a width/height of zero. Also, propagate errors on buffer allocation failures, so we don't continue decoding (which crashes). Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org --- libavcodec/indeo3.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'libavcodec') diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c index 4fbbfbbf51..ed3535adc7 100644 --- a/libavcodec/indeo3.c +++ b/libavcodec/indeo3.c @@ -724,6 +724,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx, SPLIT_CELL(ref_cell->height, curr_cell.height); ref_cell->ypos += curr_cell.height; ref_cell->height -= curr_cell.height; + if (ref_cell->height <= 0 || curr_cell.height <= 0) + return AVERROR_INVALIDDATA; } else if (code == V_SPLIT) { if (curr_cell.width > strip_width) { /* split strip */ @@ -732,6 +734,8 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx, SPLIT_CELL(ref_cell->width, curr_cell.width); ref_cell->xpos += curr_cell.width; ref_cell->width -= curr_cell.width; + if (ref_cell->width <= 0 || curr_cell.width <= 0) + return AVERROR_INVALIDDATA; } while (1) { /* loop until return */ @@ -887,13 +891,16 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx, return AVERROR_INVALIDDATA; if (width != ctx->width || height != ctx->height) { + int res; + av_dlog(avctx, "Frame dimensions changed!\n"); ctx->width = width; ctx->height = height; free_frame_buffers(ctx); - allocate_frame_buffers(ctx, avctx); + if ((res = allocate_frame_buffers(ctx, avctx)) < 0) + return res; avcodec_set_dimensions(avctx, width, height); } -- cgit v1.2.3 From cfac648e6af31e1ea58ddc753677761d83d89710 Mon Sep 17 00:00:00 2001 From: Diego Biurrun Date: Tue, 21 Feb 2012 23:33:01 +0100 Subject: doxygen: Remove documentation for non-existing parameters; misc small fixes. --- libavcodec/aacdec.c | 4 ---- libavcodec/wmaprodec.c | 1 - libavcodec/wmavoice.c | 3 --- libavdevice/x11grab.c | 1 - libavformat/mov_chan.h | 4 ++-- libavformat/mpegts.h | 4 ---- libavformat/rl2.c | 1 - libavutil/avutil.h | 3 +-- 8 files changed, 3 insertions(+), 18 deletions(-) (limited to 'libavcodec') diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index 186de96856..811ec0bd9d 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -399,8 +399,6 @@ static uint64_t sniff_channel_order(uint8_t (*layout_map)[3], int tags) /** * Configure output channel order based on the current program configuration element. * - * @param che_pos current channel position configuration - * * @return Returns error status. 0 - OK, !0 - error */ static av_cold int output_configure(AACContext *ac, @@ -442,8 +440,6 @@ static av_cold int output_configure(AACContext *ac, /** * Decode an array of 4 bit element IDs, optionally interleaved with a stereo/mono switching bit. * - * @param cpe_map Stereo (Channel Pair Element) map, NULL if stereo bit is not present. - * @param sce_map mono (Single Channel Element) map * @param type speaker type/position for these channels */ static void decode_channel_map(uint8_t layout_map[][3], diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c index 444e8a543e..2b9f4a5d8b 100644 --- a/libavcodec/wmaprodec.c +++ b/libavcodec/wmaprodec.c @@ -1481,7 +1481,6 @@ static void save_bits(WMAProDecodeCtx *s, GetBitContext* gb, int len, *@brief Decode a single WMA packet. *@param avctx codec context *@param data the output buffer - *@param data_size number of bytes that were written to the output buffer *@param avpkt input packet *@return number of bytes that were read from the input buffer */ diff --git a/libavcodec/wmavoice.c b/libavcodec/wmavoice.c index 8854e35d93..9553089cc7 100644 --- a/libavcodec/wmavoice.c +++ b/libavcodec/wmavoice.c @@ -1725,9 +1725,6 @@ static int check_bits_for_superframe(GetBitContext *orig_gb, * (if less than 480), usually used to prevent blanks at track boundaries. * * @param ctx WMA Voice decoder context - * @param samples pointer to output buffer for voice samples - * @param data_size pointer containing the size of #samples on input, and the - * amount of #samples filled on output * @return 0 on success, <0 on error or 1 if there was not enough data to * fully parse the superframe */ diff --git a/libavdevice/x11grab.c b/libavdevice/x11grab.c index bf3011bac8..305fda6e76 100644 --- a/libavdevice/x11grab.c +++ b/libavdevice/x11grab.c @@ -146,7 +146,6 @@ x11grab_region_win_init(struct x11_grab *s) * Initialize the x11 grab device demuxer (public device demuxer API). * * @param s1 Context from avformat core - * @param ap Parameters from avformat core * @return
    *
  • AVERROR(ENOMEM) no memory left
    • *
  • AVERROR(EIO) other failure case
    • diff --git a/libavformat/mov_chan.h b/libavformat/mov_chan.h index abb6916144..bd6adf6ad4 100644 --- a/libavformat/mov_chan.h +++ b/libavformat/mov_chan.h @@ -40,9 +40,9 @@ uint64_t ff_mov_get_channel_layout(uint32_t tag, uint32_t bitmap); /** - * Get the channel layout for the specified channel layout tag. + * Get the channel layout for the specified channel label. * - * @param[in] tag channel label + * @param[in] label channel label * @return channel layout mask fragment */ uint32_t ff_mov_get_channel_label(uint32_t label); diff --git a/libavformat/mpegts.h b/libavformat/mpegts.h index e38f2e09a3..9f2ba3f8f3 100644 --- a/libavformat/mpegts.h +++ b/libavformat/mpegts.h @@ -96,10 +96,6 @@ typedef struct { * @param stream_type STREAM_TYPE_xxx * @param pp Descriptor buffer pointer * @param desc_list_end End of buffer - * @param mp4_dec_config_descr_len Length of 'mp4_dec_config_descr', or zero if not present - * @param mp4_es_id - * @param pid - * @param mp4_dec_config_descr * @return <0 to stop processing */ int ff_parse_mpeg2_descriptor(AVFormatContext *fc, AVStream *st, int stream_type, diff --git a/libavformat/rl2.c b/libavformat/rl2.c index bb0a961a66..d84b8b9fd6 100644 --- a/libavformat/rl2.c +++ b/libavformat/rl2.c @@ -69,7 +69,6 @@ static int rl2_probe(AVProbeData *p) /** * read rl2 header data and setup the avstreams * @param s demuxer context - * @param ap format parameters * @return 0 on success, AVERROR otherwise */ static av_cold int rl2_read_header(AVFormatContext *s) diff --git a/libavutil/avutil.h b/libavutil/avutil.h index c9c71415e9..e4219eb87f 100644 --- a/libavutil/avutil.h +++ b/libavutil/avutil.h @@ -31,7 +31,7 @@ * * @section libav_intro Introduction * - * This document describe the usage of the different libraries + * This document describes the usage of the different libraries * provided by Libav. * * @li @ref libavc "libavcodec" encoding/decoding library @@ -40,7 +40,6 @@ * @li @ref lavd "libavdevice" special devices muxing/demuxing library * @li @ref lavu "libavutil" common utility library * @li @subpage libswscale color conversion and scaling library - * */ /** -- cgit v1.2.3 From bbeb29133b55b7256d18f5aaab8b5c8e919a173a Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Tue, 28 Feb 2012 11:50:22 -0800 Subject: adpcm: Clip step_index values read from the bitstream at the beginning of each frame. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind --- libavcodec/adpcm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'libavcodec') diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index bd86ab0e61..302f2ffe57 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -696,7 +696,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, for (channel = 0; channel < avctx->channels; channel++) { cs = &c->status[channel]; cs->predictor = (int16_t)bytestream_get_le16(&src); - cs->step_index = *src++; + cs->step_index = av_clip(*src++, 0, 88); src++; *samples++ = cs->predictor; } @@ -719,8 +719,8 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, c->status[0].predictor = (int16_t)AV_RL16(src + 10); c->status[1].predictor = (int16_t)AV_RL16(src + 12); - c->status[0].step_index = src[14]; - c->status[1].step_index = src[15]; + c->status[0].step_index = av_clip(src[14], 0, 88); + c->status[1].step_index = av_clip(src[15], 0, 88); /* sign extend the predictors */ src += 16; diff_channel = c->status[1].predictor; @@ -760,7 +760,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, for (channel = 0; channel < avctx->channels; channel++) { cs = &c->status[channel]; cs->predictor = (int16_t)bytestream_get_le16(&src); - cs->step_index = *src++; + cs->step_index = av_clip(*src++, 0, 88); src++; } @@ -823,7 +823,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, src += 4; // skip sample count (already read) for (i=0; i<=st; i++) - c->status[i].step_index = bytestream_get_le32(&src); + c->status[i].step_index = av_clip(bytestream_get_le32(&src), 0, 88); for (i=0; i<=st; i++) c->status[i].predictor = bytestream_get_le32(&src); @@ -1037,11 +1037,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data, case CODEC_ID_ADPCM_IMA_SMJPEG: if (avctx->codec->id == CODEC_ID_ADPCM_IMA_AMV) { c->status[0].predictor = sign_extend(bytestream_get_le16(&src), 16); - c->status[0].step_index = bytestream_get_le16(&src); + c->status[0].step_index = av_clip(bytestream_get_le16(&src), 0, 88); src += 4; } else { c->status[0].predictor = sign_extend(bytestream_get_be16(&src), 16); - c->status[0].step_index = bytestream_get_byte(&src); + c->status[0].step_index = av_clip(bytestream_get_byte(&src), 0, 88); src += 1; } -- cgit v1.2.3