diff -Nru ffmpeg-2.7.2/Changelog ffmpeg-2.7.3/Changelog --- ffmpeg-2.7.2/Changelog 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/Changelog 2015-11-19 03:14:20.000000000 +0100 @@ -1,7 +1,106 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. -version : +version 2.7.3: +- rtmpcrypt: Do the xtea decryption in little endian mode +- Update versions for 2.7.3 +- avformat/matroskadec: Check subtitle stream before dereferencing +- avformat/utils: Do not init parser if probing is unfinished +- avcodec/jpeg2000dec: Fix potential integer overflow with tile dimensions +- avcodec/jpeg2000dec: Check SIZ dimensions to be within the supported range +- avcodec/jpeg2000: Check comp coords to be within the supported size +- avcodec/jpeg2000: Use av_image_check_size() in ff_jpeg2000_init_component() +- avcodec/wmaprodec: Check for overread in decode_packet() +- avcodec/smacker: Check that the data size is a multiple of a sample vector +- avcodec/takdec: Skip last p2 sample (which is unused) +- avcodec/dxtory: Fix input size check in dxtory_decode_v1_410() +- avcodec/dxtory: Fix input size check in dxtory_decode_v1_420() +- avcodec/error_resilience: avoid accessing previous or next frames tables beyond height +- avcodec/dpx: Move need_align to act per line +- avcodec/flashsv: Check size before updating it +- avcodec/ivi: Check image dimensions +- avcodec/utils: Better check for channels in av_get_audio_frame_duration() +- avcodec/jpeg2000dec: Check for duplicate SIZ marker +- tests/fate/avformat: Fix fate-lavf +- doc/ffmpeg: Clarify that the sdp_file option requires an rtp output. +- ffmpeg: Don't try and write sdp info if none of the outputs had an rtp format. +- apng: use correct size for output buffer +- jvdec: avoid unsigned overflow in comparison +- avcodec/hevc_ps: Check chroma_format_idc +- avcodec/jpeg2000dec: Clip all tile coordinates +- avcodec/microdvddec: Check for string end in 'P' case +- avcodec/dirac_parser: Fix undefined memcpy() use +- avformat/xmv: Discard remainder of packet on error +- avformat/xmv: factor return check out of if/else +- avcodec/mpeg12dec: Do not call show_bits() with invalid bits +- libavutil/channel_layout: Check strtol*() for failure +- avcodec/ffv1dec: Check for 0 quant tables +- avcodec/mjpegdec: Reinitialize IDCT on BPP changes +- avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it +- avutil/file_open: avoid file handle inheritance on Windows +- avcodec/h264_slice: Disable slice threads if there are multiple access units in a packet +- opusdec: Don't run vector_fmul_scalar on zero length arrays +- avcodec/ffv1: Initialize vlc_state on allocation +- avcodec/ffv1dec: update progress in case of broken pointer chains +- avcodec/ffv1dec: Clear slice coordinates if they are invalid or slice header decoding fails for other reasons +- avformat/httpauth: Add space after commas in HTTP/RTSP auth header +- avcodec/x86/sbrdsp: Fix using uninitialized upper 32bit of noise +- avcodec/ffv1dec: Fix off by 1 error in quant_table_count check +- avcodec/ffv1dec: Explicitly check read_quant_table() return value +- avcodec/rangecoder: Check e +- avutil/log: fix zero length gnu_printf format string warning +- lavf/webvttenc: Require webvtt file to contain exactly one WebVTT stream. +- avcodec/mjpegdec: Fix decoding RGBA RCT LJPEG +- avfilter/af_asyncts: use llabs for int64_t +- avcodec/g2meet: Also clear tile dimensions on header_fail +- avcodec/g2meet: Fix potential overflow in tile dimensions check +- avcodec/svq1dec: Check init_get_bits8() for failure +- avcodec/tta: Check init_get_bits8() for failure +- avcodec/vp3: Check init_get_bits8() for failure +- swresample/swresample: Fix integer overflow in seed calculation +- avformat/mov: Fix integer overflow in FFABS +- avutil/common: Add FFNABS() +- avutil/common: Document FFABS() corner case +- avformat/dump: Fix integer overflow in aspect ratio calculation +- avformat/mxg: Use memmove() +- avcodec/truemotion1: Check for even width +- avcodec/mpeg12dec: Set dimensions in mpeg1_decode_sequence() only in absence of errors +- avcodec/libopusenc: Fix infinite loop on flushing after 0 input +- avformat/hevc: Check num_long_term_ref_pics_sps to avoid potentially long loops +- avformat/hevc: Fix parsing errors +- ffmpeg: Use correct codec_id for av_parser_change() check +- ffmpeg: Check av_parser_change() for failure +- ffmpeg: Check for RAWVIDEO and do not relay only on AVFMT_RAWPICTURE +- ffmpeg: check avpicture_fill() return value +- avformat/mux: Update sidedata in ff_write_chained() +- avcodec/flashsvenc: Correct max dimension in error message +- avcodec/svq1enc: Check dimensions +- avcodec/dcaenc: clear bitstream end +- libavcodec/aacdec_template: Use init_get_bits8() in aac_decode_frame() +- rawdec: fix mjpeg probing buffer size check +- rawdec: fix mjpeg probing +- configure: loongson disable expensive optimizations in gcc O3 optimization +- videodsp: don't overread edges in vfix3 emu_edge. +- avformat/mp3dec: improve junk skipping heuristic +- avformat/hls: add support for EXT-X-MAP +- avformat/hls: fix segment selection regression on track changes of live streams +- lavf/matroskadec: Fully parse and repack MP3 packets +- avcodec/h264_mp4toannexb_bsf: Reorder operations in nal_size check +- avformat/oggenc: Check segments_count for headers too +- avformat/segment: atomically update list if possible +- avformat/avidec: Workaround broken initial frame +- hevc: properly handle no_rasl_output_flag when removing pictures from the DPB +- hevc: fix wpp threading deadlock. +- avcodec/ffv1: separate slice_count from max_slice_count +- lavf/img2dec: Fix memory leak +- avcodec/mp3: fix skipping zeros +- avformat/srtdec: make sure we probe a number +- avformat/srtdec: more lenient first line probing +- doc: mention libavcodec can decode Opus natively +- avcodec/ffv1enc: fix assertion failure with unset bits per raw sample +- MAINTAINERS: Remove myself as leader +- mips/hevcdsp: fix string concatenation on macros + version 2.7.2: - imc: use correct position for flcoeffs2 calculation diff -Nru ffmpeg-2.7.2/configure ffmpeg-2.7.3/configure --- ffmpeg-2.7.2/configure 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/configure 2015-11-19 03:14:20.000000000 +0100 @@ -3965,7 +3965,7 @@ enable fast_cmov enable fast_unaligned disable aligned_stack - cpuflags="-march=loongson3a -mhard-float" + cpuflags="-march=loongson3a -mhard-float -fno-expensive-optimizations" ;; generic) disable mips32r5 diff -Nru ffmpeg-2.7.2/debian/changelog ffmpeg-2.7.3/debian/changelog --- ffmpeg-2.7.2/debian/changelog 2015-08-07 11:43:52.000000000 +0200 +++ ffmpeg-2.7.3/debian/changelog 2015-11-21 12:17:04.000000000 +0100 @@ -1,8 +1,14 @@ -ffmpeg (7:2.7.2-1build1) wily; urgency=medium +ffmpeg (7:2.7.3-0ubuntu0.15.10.1) wily-security; urgency=medium - * No-change rebuild for opencv library renames. + [ Andreas Cadhalpun ] + * Import new upstream bugfix release 2.7.3. (LP: #1518549) - -- Matthias Klose Fri, 07 Aug 2015 11:43:18 +0200 + [ Fabian Greffrath ] + * Add alternative Depends: libavcodec-ffmpeg-extra56 to libavcodec-dev and + ffmpeg-dbg to allow for building and debugging with this library installed. + (LP: #1509632) + + -- Andreas Cadhalpun Sat, 21 Nov 2015 12:16:22 +0100 ffmpeg (7:2.7.2-1) unstable; urgency=medium diff -Nru ffmpeg-2.7.2/debian/control ffmpeg-2.7.3/debian/control --- ffmpeg-2.7.2/debian/control 2015-07-20 14:14:02.000000000 +0200 +++ ffmpeg-2.7.3/debian/control 2015-11-20 23:54:33.000000000 +0100 @@ -179,7 +179,7 @@ Multi-Arch: same Depends: ffmpeg (= ${binary:Version}), - libavcodec-ffmpeg56 (= ${binary:Version}), + libavcodec-ffmpeg56 (= ${binary:Version}) | libavcodec-ffmpeg-extra56 (= ${binary:Version}), libavdevice-ffmpeg56 (= ${binary:Version}), libavfilter-ffmpeg5 (= ${binary:Version}), libavformat-ffmpeg56 (= ${binary:Version}), @@ -302,7 +302,7 @@ Conflicts: libavcodec-libav-dev Depends: - libavcodec-ffmpeg56 (= ${binary:Version}), + libavcodec-ffmpeg56 (= ${binary:Version}) | libavcodec-ffmpeg-extra56 (= ${binary:Version}), libavutil-dev (= ${binary:Version}), libswresample-dev (= ${binary:Version}), ${misc:Depends} diff -Nru ffmpeg-2.7.2/debian/gbp.conf ffmpeg-2.7.3/debian/gbp.conf --- ffmpeg-2.7.2/debian/gbp.conf 2015-07-20 14:13:59.000000000 +0200 +++ ffmpeg-2.7.3/debian/gbp.conf 2015-11-20 23:17:05.000000000 +0100 @@ -1,2 +1,4 @@ [DEFAULT] pristine-tar = True +debian-branch = wily +upstream-branch = upstream-wily diff -Nru ffmpeg-2.7.2/doc/Doxyfile ffmpeg-2.7.3/doc/Doxyfile --- ffmpeg-2.7.2/doc/Doxyfile 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/doc/Doxyfile 2015-11-19 03:14:20.000000000 +0100 @@ -31,7 +31,7 @@ # This could be handy for archiving the generated documentation or # if some version control system is used. -PROJECT_NUMBER = 2.7.2 +PROJECT_NUMBER = 2.7.3 # With the PROJECT_LOGO tag one can specify a logo or icon that is included # in the documentation. The maximum height of the logo should not exceed 55 diff -Nru ffmpeg-2.7.2/doc/ffmpeg.texi ffmpeg-2.7.3/doc/ffmpeg.texi --- ffmpeg-2.7.2/doc/ffmpeg.texi 2015-06-19 22:44:36.000000000 +0200 +++ ffmpeg-2.7.3/doc/ffmpeg.texi 2015-11-19 03:14:20.000000000 +0100 @@ -1193,9 +1193,9 @@ specified to @command{ffserver} but can be to @command{ffmpeg}. @item -sdp_file @var{file} (@emph{global}) -Print sdp information to @var{file}. +Print sdp information for an output stream to @var{file}. This allows dumping sdp information when at least one output isn't an -rtp stream. +rtp stream. (Requires at least one of the output formats to be rtp). @item -discard (@emph{input}) Allows discarding specific streams or frames of streams at the demuxer. diff -Nru ffmpeg-2.7.2/doc/general.texi ffmpeg-2.7.3/doc/general.texi --- ffmpeg-2.7.2/doc/general.texi 2015-06-19 22:44:36.000000000 +0200 +++ ffmpeg-2.7.3/doc/general.texi 2015-11-19 03:14:20.000000000 +0100 @@ -954,8 +954,8 @@ @item Musepack SV8 @tab @tab X @item Nellymoser Asao @tab X @tab X @item On2 AVC (Audio for Video Codec) @tab @tab X -@item Opus @tab E @tab E - @tab supported through external library libopus +@item Opus @tab E @tab X + @tab encoding supported through external library libopus @item PCM A-law @tab X @tab X @item PCM mu-law @tab X @tab X @item PCM signed 8-bit planar @tab X @tab X diff -Nru ffmpeg-2.7.2/ffmpeg.c ffmpeg-2.7.3/ffmpeg.c --- ffmpeg-2.7.2/ffmpeg.c 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/ffmpeg.c 2015-11-19 03:14:20.000000000 +0100 @@ -1800,17 +1800,21 @@ opkt.duration = av_rescale_q(pkt->duration, ist->st->time_base, ost->st->time_base); opkt.flags = pkt->flags; - // FIXME remove the following 2 lines they shall be replaced by the bitstream filters - if ( ost->enc_ctx->codec_id != AV_CODEC_ID_H264 - && ost->enc_ctx->codec_id != AV_CODEC_ID_MPEG1VIDEO - && ost->enc_ctx->codec_id != AV_CODEC_ID_MPEG2VIDEO - && ost->enc_ctx->codec_id != AV_CODEC_ID_VC1 + if ( ost->st->codec->codec_id != AV_CODEC_ID_H264 + && ost->st->codec->codec_id != AV_CODEC_ID_MPEG1VIDEO + && ost->st->codec->codec_id != AV_CODEC_ID_MPEG2VIDEO + && ost->st->codec->codec_id != AV_CODEC_ID_VC1 ) { - if (av_parser_change(ost->parser, ost->st->codec, + int ret = av_parser_change(ost->parser, ost->st->codec, &opkt.data, &opkt.size, pkt->data, pkt->size, - pkt->flags & AV_PKT_FLAG_KEY)) { + pkt->flags & AV_PKT_FLAG_KEY); + if (ret < 0) { + av_log(NULL, AV_LOG_FATAL, "av_parser_change failed\n"); + exit_program(1); + } + if (ret) { opkt.buf = av_buffer_create(opkt.data, opkt.size, av_buffer_default_free, NULL, 0); if (!opkt.buf) exit_program(1); @@ -1821,9 +1825,15 @@ } av_copy_packet_side_data(&opkt, pkt); - if (ost->st->codec->codec_type == AVMEDIA_TYPE_VIDEO && (of->ctx->oformat->flags & AVFMT_RAWPICTURE)) { + if (ost->st->codec->codec_type == AVMEDIA_TYPE_VIDEO && + ost->st->codec->codec_id == AV_CODEC_ID_RAWVIDEO && + (of->ctx->oformat->flags & AVFMT_RAWPICTURE)) { /* store AVPicture in AVPacket, as expected by the output format */ - avpicture_fill(&pict, opkt.data, ost->st->codec->pix_fmt, ost->st->codec->width, ost->st->codec->height); + int ret = avpicture_fill(&pict, opkt.data, ost->st->codec->pix_fmt, ost->st->codec->width, ost->st->codec->height); + if (ret < 0) { + av_log(NULL, AV_LOG_FATAL, "avpicture_fill failed\n"); + exit_program(1); + } opkt.data = (uint8_t *)&pict; opkt.size = sizeof(AVPicture); opkt.flags |= AV_PKT_FLAG_KEY; @@ -2360,6 +2370,9 @@ } } + if (!j) + goto fail; + av_sdp_create(avc, j, sdp, sizeof(sdp)); if (!sdp_filename) { @@ -2375,6 +2388,7 @@ } } +fail: av_freep(&avc); } diff -Nru ffmpeg-2.7.2/libavcodec/aacdec.c ffmpeg-2.7.3/libavcodec/aacdec.c --- ffmpeg-2.7.2/libavcodec/aacdec.c 2015-06-19 22:44:36.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/aacdec.c 2015-11-19 03:14:20.000000000 +0100 @@ -3178,7 +3178,7 @@ if (INT_MAX / 8 <= buf_size) return AVERROR_INVALIDDATA; - if ((err = init_get_bits(&gb, buf, buf_size * 8)) < 0) + if ((err = init_get_bits8(&gb, buf, buf_size)) < 0) return err; switch (ac->oc[1].m4ac.object_type) { diff -Nru ffmpeg-2.7.2/libavcodec/dcaenc.c ffmpeg-2.7.3/libavcodec/dcaenc.c --- ffmpeg-2.7.2/libavcodec/dcaenc.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/dcaenc.c 2015-11-19 03:14:20.000000000 +0100 @@ -938,6 +938,10 @@ for (i = 0; i < SUBFRAMES; i++) put_subframe(c, i); + + for (i = put_bits_count(&c->pb); i < 8*c->frame_size; i++) + put_bits(&c->pb, 1, 0); + flush_put_bits(&c->pb); avpkt->pts = frame->pts; diff -Nru ffmpeg-2.7.2/libavcodec/dirac_parser.c ffmpeg-2.7.3/libavcodec/dirac_parser.c --- ffmpeg-2.7.2/libavcodec/dirac_parser.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/dirac_parser.c 2015-11-19 03:14:20.000000000 +0100 @@ -123,7 +123,7 @@ DiracParseContext *pc = s->priv_data; if (pc->overread_index) { - memcpy(pc->buffer, pc->buffer + pc->overread_index, + memmove(pc->buffer, pc->buffer + pc->overread_index, pc->index - pc->overread_index); pc->index -= pc->overread_index; pc->overread_index = 0; diff -Nru ffmpeg-2.7.2/libavcodec/dpx.c ffmpeg-2.7.3/libavcodec/dpx.c --- ffmpeg-2.7.2/libavcodec/dpx.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/dpx.c 2015-11-19 03:14:20.000000000 +0100 @@ -348,11 +348,11 @@ // For 12 bit, ignore alpha if (elements == 4) buf += 2; - // Jump to next aligned position - buf += need_align; } for (i = 0; i < 3; i++) ptr[i] += p->linesize[i]; + // Jump to next aligned position + buf += need_align; } break; case 16: diff -Nru ffmpeg-2.7.2/libavcodec/dxtory.c ffmpeg-2.7.3/libavcodec/dxtory.c --- ffmpeg-2.7.2/libavcodec/dxtory.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/dxtory.c 2015-11-19 03:14:20.000000000 +0100 @@ -65,7 +65,7 @@ uint8_t *Y1, *Y2, *Y3, *Y4, *U, *V; int ret; - if (src_size < avctx->width * avctx->height * 9LL / 8) { + if (src_size < FFALIGN(avctx->width, 4) * FFALIGN(avctx->height, 4) * 9LL / 8) { av_log(avctx, AV_LOG_ERROR, "packet too small\n"); return AVERROR_INVALIDDATA; } @@ -108,7 +108,7 @@ uint8_t *Y1, *Y2, *U, *V; int ret; - if (src_size < avctx->width * avctx->height * 3LL / 2) { + if (src_size < FFALIGN(avctx->width, 2) * FFALIGN(avctx->height, 2) * 3LL / 2) { av_log(avctx, AV_LOG_ERROR, "packet too small\n"); return AVERROR_INVALIDDATA; } diff -Nru ffmpeg-2.7.2/libavcodec/error_resilience.c ffmpeg-2.7.3/libavcodec/error_resilience.c --- ffmpeg-2.7.2/libavcodec/error_resilience.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/error_resilience.c 2015-11-19 03:14:20.000000000 +0100 @@ -381,14 +381,19 @@ #define MV_UNCHANGED 1 const int mb_stride = s->mb_stride; const int mb_width = s->mb_width; - const int mb_height = s->mb_height; + int mb_height = s->mb_height; int i, depth, num_avail; int mb_x, mb_y, mot_step, mot_stride; + if (s->last_pic.f && s->last_pic.f->data[0]) + mb_height = FFMIN(mb_height, (s->last_pic.f->height+15)>>4); + if (s->next_pic.f && s->next_pic.f->data[0]) + mb_height = FFMIN(mb_height, (s->next_pic.f->height+15)>>4); + set_mv_strides(s, &mot_step, &mot_stride); num_avail = 0; - for (i = 0; i < s->mb_num; i++) { + for (i = 0; i < mb_width * mb_height; i++) { const int mb_xy = s->mb_index2xy[i]; int f = 0; int error = s->error_status_table[mb_xy]; @@ -413,7 +418,7 @@ if ((!(s->avctx->error_concealment&FF_EC_GUESS_MVS)) || num_avail <= mb_width / 2) { - for (mb_y = 0; mb_y < s->mb_height; mb_y++) { + for (mb_y = 0; mb_y < mb_height; mb_y++) { for (mb_x = 0; mb_x < s->mb_width; mb_x++) { const int mb_xy = mb_x + mb_y * s->mb_stride; int mv_dir = (s->last_pic.f && s->last_pic.f->data[0]) ? MV_DIR_FORWARD : MV_DIR_BACKWARD; @@ -442,7 +447,7 @@ int score_sum = 0; changed = 0; - for (mb_y = 0; mb_y < s->mb_height; mb_y++) { + for (mb_y = 0; mb_y < mb_height; mb_y++) { for (mb_x = 0; mb_x < s->mb_width; mb_x++) { const int mb_xy = mb_x + mb_y * s->mb_stride; int mv_predictor[8][2] = { { 0 } }; @@ -675,7 +680,7 @@ if (none_left) return; - for (i = 0; i < s->mb_num; i++) { + for (i = 0; i < mb_width * mb_height; i++) { int mb_xy = s->mb_index2xy[i]; if (fixed[mb_xy]) fixed[mb_xy] = MV_FROZEN; diff -Nru ffmpeg-2.7.2/libavcodec/ffv1.c ffmpeg-2.7.3/libavcodec/ffv1.c --- ffmpeg-2.7.2/libavcodec/ffv1.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/ffv1.c 2015-11-19 03:14:20.000000000 +0100 @@ -66,7 +66,7 @@ av_cold int ffv1_init_slice_state(FFV1Context *f, FFV1Context *fs) { - int j; + int j, i; fs->plane_count = f->plane_count; fs->transparency = f->transparency; @@ -80,10 +80,15 @@ if (!p->state) return AVERROR(ENOMEM); } else { - if (!p->vlc_state) - p->vlc_state = av_malloc_array(p->context_count, sizeof(VlcState)); - if (!p->vlc_state) - return AVERROR(ENOMEM); + if (!p->vlc_state) { + p->vlc_state = av_mallocz_array(p->context_count, sizeof(VlcState)); + if (!p->vlc_state) + return AVERROR(ENOMEM); + for (i = 0; i < p->context_count; i++) { + p->vlc_state[i].error_sum = 4; + p->vlc_state[i].count = 1; + } + } } } @@ -101,7 +106,7 @@ av_cold int ffv1_init_slices_state(FFV1Context *f) { int i, ret; - for (i = 0; i < f->slice_count; i++) { + for (i = 0; i < f->max_slice_count; i++) { FFV1Context *fs = f->slice_context[i]; if ((ret = ffv1_init_slice_state(f, fs)) < 0) return AVERROR(ENOMEM); @@ -113,10 +118,10 @@ { int i; - f->slice_count = f->num_h_slices * f->num_v_slices; - av_assert0(f->slice_count > 0); + f->max_slice_count = f->num_h_slices * f->num_v_slices; + av_assert0(f->max_slice_count > 0); - for (i = 0; i < f->slice_count; i++) { + for (i = 0; i < f->max_slice_count; i++) { int sx = i % f->num_h_slices; int sy = i / f->num_h_slices; int sxs = f->avctx->width * sx / f->num_h_slices; @@ -210,7 +215,7 @@ ff_thread_release_buffer(avctx, &s->last_picture); av_frame_free(&s->last_picture.f); - for (j = 0; j < s->slice_count; j++) { + for (j = 0; j < s->max_slice_count; j++) { FFV1Context *fs = s->slice_context[j]; for (i = 0; i < s->plane_count; i++) { PlaneContext *p = &fs->plane[i]; @@ -224,14 +229,14 @@ av_freep(&avctx->stats_out); for (j = 0; j < s->quant_table_count; j++) { av_freep(&s->initial_states[j]); - for (i = 0; i < s->slice_count; i++) { + for (i = 0; i < s->max_slice_count; i++) { FFV1Context *sf = s->slice_context[i]; av_freep(&sf->rc_stat2[j]); } av_freep(&s->rc_stat2[j]); } - for (i = 0; i < s->slice_count; i++) + for (i = 0; i < s->max_slice_count; i++) av_freep(&s->slice_context[i]); return 0; diff -Nru ffmpeg-2.7.2/libavcodec/ffv1dec.c ffmpeg-2.7.3/libavcodec/ffv1dec.c --- ffmpeg-2.7.2/libavcodec/ffv1dec.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/ffv1dec.c 2015-11-19 03:14:20.000000000 +0100 @@ -47,8 +47,11 @@ else { int i, e, a; e = 0; - while (get_rac(c, state + 1 + FFMIN(e, 9))) // 1..10 + while (get_rac(c, state + 1 + FFMIN(e, 9))) { // 1..10 e++; + if (e > 31) + return AVERROR_INVALIDDATA; + } a = 1; for (i = e - 1; i >= 0; i--) @@ -302,7 +305,7 @@ for (i = 0; i < f->plane_count; i++) { PlaneContext * const p = &fs->plane[i]; int idx = get_symbol(c, state, 0); - if (idx > (unsigned)f->quant_table_count) { + if (idx >= (unsigned)f->quant_table_count) { av_log(f->avctx, AV_LOG_ERROR, "quant_table_index out of range\n"); return -1; } @@ -405,6 +408,7 @@ if (ffv1_init_slice_state(f, fs) < 0) return AVERROR(ENOMEM); if (decode_slice_header(f, fs) < 0) { + fs->slice_x = fs->slice_y = fs->slice_height = fs->slice_width = 0; fs->slice_damaged = 1; return AVERROR_INVALIDDATA; } @@ -499,7 +503,10 @@ int context_count = 1; for (i = 0; i < 5; i++) { - context_count *= read_quant_table(c, quant_table[i], context_count); + int ret = read_quant_table(c, quant_table[i], context_count); + if (ret < 0) + return ret; + context_count *= ret; if (context_count > 32768U) { return AVERROR_INVALIDDATA; } @@ -561,7 +568,7 @@ } f->quant_table_count = get_symbol(c, state, 0); - if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES) + if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES || !f->quant_table_count) return AVERROR_INVALIDDATA; for (i = 0; i < f->quant_table_count; i++) { @@ -772,6 +779,7 @@ av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\n"); return AVERROR_INVALIDDATA; } + f->slice_count = f->max_slice_count; } else if (f->version < 3) { f->slice_count = get_symbol(c, state, 0); } else { @@ -786,8 +794,8 @@ p -= size + trailer; } } - if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0) { - av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid\n", f->slice_count); + if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0 || f->slice_count > f->max_slice_count) { + av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid (max=%d)\n", f->slice_count, f->max_slice_count); return AVERROR_INVALIDDATA; } @@ -929,6 +937,7 @@ else v = buf_p - c->bytestream_start; if (buf_p - c->bytestream_start < v) { av_log(avctx, AV_LOG_ERROR, "Slice pointer chain broken\n"); + ff_thread_report_progress(&f->picture, INT_MAX, 0); return AVERROR_INVALIDDATA; } buf_p -= v; @@ -1010,6 +1019,7 @@ f->picture.f = NULL; f->last_picture.f = NULL; f->sample_buffer = NULL; + f->max_slice_count = 0; f->slice_count = 0; for (i = 0; i < f->quant_table_count; i++) { @@ -1085,7 +1095,7 @@ av_assert0(!fdst->sample_buffer); } - av_assert1(fdst->slice_count == fsrc->slice_count); + av_assert1(fdst->max_slice_count == fsrc->max_slice_count); ff_thread_release_buffer(dst, &fdst->picture); diff -Nru ffmpeg-2.7.2/libavcodec/ffv1enc.c ffmpeg-2.7.3/libavcodec/ffv1enc.c --- ffmpeg-2.7.2/libavcodec/ffv1enc.c 2015-06-19 22:47:55.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/ffv1enc.c 2015-11-19 03:14:20.000000000 +0100 @@ -755,6 +755,8 @@ s->transparency = desc->nb_components == 4; if (!avctx->bits_per_raw_sample && !s->bits_per_raw_sample) s->bits_per_raw_sample = 8; + else if (!s->bits_per_raw_sample) + s->bits_per_raw_sample = 8; break; case AV_PIX_FMT_RGB32: s->colorspace = 1; @@ -974,6 +976,7 @@ if ((ret = ffv1_init_slice_contexts(s)) < 0) return ret; + s->slice_count = s->max_slice_count; if ((ret = ffv1_init_slices_state(s)) < 0) return ret; @@ -983,7 +986,7 @@ if (!avctx->stats_out) return AVERROR(ENOMEM); for (i = 0; i < s->quant_table_count; i++) - for (j = 0; j < s->slice_count; j++) { + for (j = 0; j < s->max_slice_count; j++) { FFV1Context *sf = s->slice_context[j]; av_assert0(!sf->rc_stat2[i]); sf->rc_stat2[i] = av_mallocz(s->context_count[i] * @@ -1207,6 +1210,7 @@ for (i = 0; i < f->quant_table_count; i++) memset(f->rc_stat2[i], 0, f->context_count[i] * sizeof(*f->rc_stat2[i])); + av_assert0(f->slice_count == f->max_slice_count); for (j = 0; j < f->slice_count; j++) { FFV1Context *fs = f->slice_context[j]; for (i = 0; i < 256; i++) { diff -Nru ffmpeg-2.7.2/libavcodec/ffv1.h ffmpeg-2.7.3/libavcodec/ffv1.h --- ffmpeg-2.7.2/libavcodec/ffv1.h 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/ffv1.h 2015-11-19 03:14:20.000000000 +0100 @@ -117,6 +117,7 @@ struct FFV1Context *slice_context[MAX_SLICES]; int slice_count; + int max_slice_count; int num_v_slices; int num_h_slices; int slice_width; diff -Nru ffmpeg-2.7.2/libavcodec/flashsv.c ffmpeg-2.7.3/libavcodec/flashsv.c --- ffmpeg-2.7.2/libavcodec/flashsv.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/flashsv.c 2015-11-19 03:14:20.000000000 +0100 @@ -413,6 +413,10 @@ } if (has_diff) { + if (size < 3) { + av_log(avctx, AV_LOG_ERROR, "size too small for diff\n"); + return AVERROR_INVALIDDATA; + } if (!s->keyframe) { av_log(avctx, AV_LOG_ERROR, "Inter frame without keyframe\n"); @@ -440,6 +444,10 @@ int row = get_bits(&gb, 8); av_log(avctx, AV_LOG_DEBUG, "%dx%d zlibprime_curr %dx%d\n", i, j, col, row); + if (size < 3) { + av_log(avctx, AV_LOG_ERROR, "size too small for zlibprime_curr\n"); + return AVERROR_INVALIDDATA; + } size -= 2; avpriv_request_sample(avctx, "zlibprime_curr"); return AVERROR_PATCHWELCOME; diff -Nru ffmpeg-2.7.2/libavcodec/flashsvenc.c ffmpeg-2.7.3/libavcodec/flashsvenc.c --- ffmpeg-2.7.2/libavcodec/flashsvenc.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/flashsvenc.c 2015-11-19 03:14:20.000000000 +0100 @@ -111,7 +111,7 @@ if (avctx->width > 4095 || avctx->height > 4095) { av_log(avctx, AV_LOG_ERROR, - "Input dimensions too large, input must be max 4096x4096 !\n"); + "Input dimensions too large, input must be max 4095x4095 !\n"); return AVERROR_INVALIDDATA; } diff -Nru ffmpeg-2.7.2/libavcodec/g2meet.c ffmpeg-2.7.3/libavcodec/g2meet.c --- ffmpeg-2.7.2/libavcodec/g2meet.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/g2meet.c 2015-11-19 03:14:20.000000000 +0100 @@ -746,7 +746,7 @@ c->tile_height = bytestream2_get_be32(&bc); if (c->tile_width <= 0 || c->tile_height <= 0 || ((c->tile_width | c->tile_height) & 0xF) || - c->tile_width * 4LL * c->tile_height >= INT_MAX + c->tile_width * (uint64_t)c->tile_height >= INT_MAX / 4 ) { av_log(avctx, AV_LOG_ERROR, "Invalid tile dimensions %dx%d\n", @@ -877,6 +877,8 @@ c->height = 0; c->tiles_x = c->tiles_y = 0; + c->tile_width = + c->tile_height = 0; return ret; } diff -Nru ffmpeg-2.7.2/libavcodec/h264_mp4toannexb_bsf.c ffmpeg-2.7.3/libavcodec/h264_mp4toannexb_bsf.c --- ffmpeg-2.7.2/libavcodec/h264_mp4toannexb_bsf.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/h264_mp4toannexb_bsf.c 2015-11-19 03:14:20.000000000 +0100 @@ -182,7 +182,7 @@ buf += ctx->length_size; unit_type = *buf & 0x1f; - if (buf + nal_size > buf_end || nal_size < 0) + if (nal_size > buf_end - buf || nal_size < 0) goto fail; if (unit_type == 7) diff -Nru ffmpeg-2.7.2/libavcodec/h264_slice.c ffmpeg-2.7.3/libavcodec/h264_slice.c --- ffmpeg-2.7.2/libavcodec/h264_slice.c 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/h264_slice.c 2015-11-19 03:14:20.000000000 +0100 @@ -1159,6 +1159,15 @@ if (first_mb_in_slice == 0) { // FIXME better field boundary detection if (h->current_slice) { + if (h->max_contexts > 1) { + if (!h->single_decode_warning) { + av_log(h->avctx, AV_LOG_WARNING, "Cannot decode multiple access units as slice threads\n"); + h->single_decode_warning = 1; + } + h->max_contexts = 1; + return SLICE_SINGLETHREAD; + } + if (h->cur_pic_ptr && FIELD_PICTURE(h) && h->first_field) { ff_h264_field_end(h, h->slice_ctx, 1); h->current_slice = 0; diff -Nru ffmpeg-2.7.2/libavcodec/hevc.c ffmpeg-2.7.3/libavcodec/hevc.c --- ffmpeg-2.7.2/libavcodec/hevc.c 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/hevc.c 2015-11-19 03:14:20.000000000 +0100 @@ -795,6 +795,8 @@ s->HEVClc->tu.cu_qp_offset_cb = 0; s->HEVClc->tu.cu_qp_offset_cr = 0; + s->no_rasl_output_flag = IS_IDR(s) || IS_BLA(s) || (s->nal_unit_type == NAL_CRA_NUT && s->last_eos); + return 0; } @@ -2385,6 +2387,8 @@ if (more_data < 0) { s->tab_slice_address[ctb_addr_rs] = -1; + avpriv_atomic_int_set(&s1->wpp_err, 1); + ff_thread_report_progress2(s->avctx, ctb_row ,thread, SHIFT_CTB_WPP); return more_data; } @@ -3353,6 +3357,7 @@ s->pocTid0 = s0->pocTid0; s->max_ra = s0->max_ra; s->eos = s0->eos; + s->no_rasl_output_flag = s0->no_rasl_output_flag; s->is_nalff = s0->is_nalff; s->nal_length_size = s0->nal_length_size; @@ -3457,6 +3462,7 @@ s->enable_parallel_tiles = 0; s->picture_struct = 0; + s->eos = 1; if(avctx->active_thread_type & FF_THREAD_SLICE) s->threads_number = avctx->thread_count; @@ -3498,6 +3504,7 @@ HEVCContext *s = avctx->priv_data; ff_hevc_flush_dpb(s); s->max_ra = INT_MAX; + s->eos = 1; } #define OFFSET(x) offsetof(HEVCContext, x) diff -Nru ffmpeg-2.7.2/libavcodec/hevc.h ffmpeg-2.7.3/libavcodec/hevc.h --- ffmpeg-2.7.2/libavcodec/hevc.h 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/hevc.h 2015-11-19 03:14:20.000000000 +0100 @@ -842,6 +842,7 @@ int bs_height; int is_decoded; + int no_rasl_output_flag; HEVCPredContext hpc; HEVCDSPContext hevcdsp; diff -Nru ffmpeg-2.7.2/libavcodec/hevc_ps.c ffmpeg-2.7.3/libavcodec/hevc_ps.c --- ffmpeg-2.7.2/libavcodec/hevc_ps.c 2015-06-19 22:47:55.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/hevc_ps.c 2015-11-19 03:14:20.000000000 +0100 @@ -806,6 +806,9 @@ } sps->chroma_format_idc = get_ue_golomb_long(gb); + if (sps->chroma_format_idc > 3U) { + return AVERROR_INVALIDDATA; + } if (sps->chroma_format_idc == 3) sps->separate_colour_plane_flag = get_bits1(gb); diff -Nru ffmpeg-2.7.2/libavcodec/hevc_refs.c ffmpeg-2.7.3/libavcodec/hevc_refs.c --- ffmpeg-2.7.2/libavcodec/hevc_refs.c 2015-06-19 22:44:38.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/hevc_refs.c 2015-11-19 03:14:20.000000000 +0100 @@ -174,7 +174,7 @@ int min_poc = INT_MAX; int i, min_idx, ret; - if (s->sh.no_output_of_prior_pics_flag == 1) { + if (s->sh.no_output_of_prior_pics_flag == 1 && s->no_rasl_output_flag == 1) { for (i = 0; i < FF_ARRAY_ELEMS(s->DPB); i++) { HEVCFrame *frame = &s->DPB[i]; if (!(frame->flags & HEVC_FRAME_FLAG_BUMPING) && frame->poc != s->poc && diff -Nru ffmpeg-2.7.2/libavcodec/ivi.c ffmpeg-2.7.3/libavcodec/ivi.c --- ffmpeg-2.7.2/libavcodec/ivi.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/ivi.c 2015-11-19 03:14:20.000000000 +0100 @@ -30,6 +30,7 @@ #define BITSTREAM_READER_LE #include "libavutil/attributes.h" +#include "libavutil/imgutils.h" #include "libavutil/timer.h" #include "avcodec.h" #include "get_bits.h" @@ -310,7 +311,7 @@ ivi_free_buffers(planes); - if (cfg->pic_width < 1 || cfg->pic_height < 1 || + if (av_image_check_size(cfg->pic_width, cfg->pic_height, 0, NULL) < 0 || cfg->luma_bands < 1 || cfg->chroma_bands < 1) return AVERROR_INVALIDDATA; diff -Nru ffmpeg-2.7.2/libavcodec/jpeg2000.c ffmpeg-2.7.3/libavcodec/jpeg2000.c --- ffmpeg-2.7.2/libavcodec/jpeg2000.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/jpeg2000.c 2015-11-19 03:14:20.000000000 +0100 @@ -28,6 +28,7 @@ #include "libavutil/attributes.h" #include "libavutil/avassert.h" #include "libavutil/common.h" +#include "libavutil/imgutils.h" #include "libavutil/mem.h" #include "avcodec.h" #include "jpeg2000.h" @@ -210,9 +211,17 @@ codsty->nreslevels2decode - 1, codsty->transform)) return ret; - // component size comp->coord is uint16_t so ir cannot overflow + + if (av_image_check_size(comp->coord[0][1] - comp->coord[0][0], + comp->coord[1][1] - comp->coord[1][0], 0, avctx)) + return AVERROR_INVALIDDATA; csize = (comp->coord[0][1] - comp->coord[0][0]) * (comp->coord[1][1] - comp->coord[1][0]); + if (comp->coord[0][1] > 32768 || + comp->coord[1][1] > 32768) { + av_log(avctx, AV_LOG_ERROR, "component size too large\n"); + return AVERROR_PATCHWELCOME; + } if (codsty->transform == FF_DWT97) { comp->i_data = NULL; diff -Nru ffmpeg-2.7.2/libavcodec/jpeg2000dec.c ffmpeg-2.7.3/libavcodec/jpeg2000dec.c --- ffmpeg-2.7.2/libavcodec/jpeg2000dec.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/jpeg2000dec.c 2015-11-19 03:14:20.000000000 +0100 @@ -252,6 +252,10 @@ avpriv_request_sample(s->avctx, "Support for image offsets"); return AVERROR_PATCHWELCOME; } + if (s->width > 32768U || s->height > 32768U) { + avpriv_request_sample(s->avctx, "Large Dimensions"); + return AVERROR_PATCHWELCOME; + } if (ncomponents <= 0) { av_log(s->avctx, AV_LOG_ERROR, "Invalid number of components: %d\n", @@ -705,10 +709,10 @@ Jpeg2000QuantStyle *qntsty = tile->qntsty + compno; int ret; // global bandno - comp->coord_o[0][0] = FFMAX(tilex * s->tile_width + s->tile_offset_x, s->image_offset_x); - comp->coord_o[0][1] = FFMIN((tilex + 1) * s->tile_width + s->tile_offset_x, s->width); - comp->coord_o[1][0] = FFMAX(tiley * s->tile_height + s->tile_offset_y, s->image_offset_y); - comp->coord_o[1][1] = FFMIN((tiley + 1) * s->tile_height + s->tile_offset_y, s->height); + comp->coord_o[0][0] = av_clip(tilex * (int64_t)s->tile_width + s->tile_offset_x, s->image_offset_x, s->width); + comp->coord_o[0][1] = av_clip((tilex + 1) * (int64_t)s->tile_width + s->tile_offset_x, s->image_offset_x, s->width); + comp->coord_o[1][0] = av_clip(tiley * (int64_t)s->tile_height + s->tile_offset_y, s->image_offset_y, s->height); + comp->coord_o[1][1] = av_clip((tiley + 1) * (int64_t)s->tile_height + s->tile_offset_y, s->image_offset_y, s->height); if (compno) { comp->coord_o[0][0] /= s->cdx[compno]; comp->coord_o[0][1] /= s->cdx[compno]; @@ -1400,6 +1404,7 @@ memset(s->codsty, 0, sizeof(s->codsty)); memset(s->qntsty, 0, sizeof(s->qntsty)); s->numXtiles = s->numYtiles = 0; + s->ncomponents = 0; } static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s) @@ -1454,6 +1459,10 @@ switch (marker) { case JPEG2000_SIZ: + if (s->ncomponents) { + av_log(s->avctx, AV_LOG_ERROR, "Duplicate SIZ\n"); + return AVERROR_INVALIDDATA; + } ret = get_siz(s); if (!s->tile) s->numXtiles = s->numYtiles = 0; diff -Nru ffmpeg-2.7.2/libavcodec/libopusenc.c ffmpeg-2.7.3/libavcodec/libopusenc.c --- ffmpeg-2.7.2/libavcodec/libopusenc.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/libopusenc.c 2015-11-19 03:14:20.000000000 +0100 @@ -326,7 +326,7 @@ } else audio = frame->data[0]; } else { - if (!opus->afq.remaining_samples) + if (!opus->afq.remaining_samples || (!opus->afq.frame_alloc && !opus->afq.frame_count)) return 0; audio = opus->samples; memset(audio, 0, opus->opts.packet_size * sample_size); diff -Nru ffmpeg-2.7.2/libavcodec/microdvddec.c ffmpeg-2.7.3/libavcodec/microdvddec.c --- ffmpeg-2.7.2/libavcodec/microdvddec.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/microdvddec.c 2015-11-19 03:14:20.000000000 +0100 @@ -164,6 +164,8 @@ /* Position */ case 'P': + if (!*s) + break; tag.persistent = MICRODVD_PERSISTENT_ON; tag.data1 = (*s++ == '1'); if (*s != '}') diff -Nru ffmpeg-2.7.2/libavcodec/mips/hevcdsp_mips.h ffmpeg-2.7.3/libavcodec/mips/hevcdsp_mips.h --- ffmpeg-2.7.2/libavcodec/mips/hevcdsp_mips.h 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/mips/hevcdsp_mips.h 2015-11-19 03:14:20.000000000 +0100 @@ -24,7 +24,7 @@ #include "libavcodec/hevcdsp.h" #define MC(PEL, DIR, WIDTH) \ -void ff_hevc_put_hevc_##PEL##_##DIR####WIDTH##_8_msa(int16_t *dst, \ +void ff_hevc_put_hevc_##PEL##_##DIR##WIDTH##_8_msa(int16_t *dst, \ uint8_t *src, \ ptrdiff_t src_stride, \ int height, \ @@ -102,7 +102,7 @@ #undef MC #define UNI_MC(PEL, DIR, WIDTH) \ -void ff_hevc_put_hevc_uni_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_uni_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t dst_stride, \ uint8_t *src, \ ptrdiff_t src_stride, \ @@ -181,7 +181,7 @@ #undef UNI_MC #define UNI_W_MC(PEL, DIR, WIDTH) \ -void ff_hevc_put_hevc_uni_w_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_uni_w_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t \ dst_stride, \ uint8_t *src, \ @@ -265,7 +265,7 @@ #undef UNI_W_MC #define BI_MC(PEL, DIR, WIDTH) \ -void ff_hevc_put_hevc_bi_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_bi_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t dst_stride, \ uint8_t *src, \ ptrdiff_t src_stride, \ @@ -345,7 +345,7 @@ #undef BI_MC #define BI_W_MC(PEL, DIR, WIDTH) \ -void ff_hevc_put_hevc_bi_w_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_bi_w_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t \ dst_stride, \ uint8_t *src, \ diff -Nru ffmpeg-2.7.2/libavcodec/mips/hevcdsp_msa.c ffmpeg-2.7.3/libavcodec/mips/hevcdsp_msa.c --- ffmpeg-2.7.2/libavcodec/mips/hevcdsp_msa.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/mips/hevcdsp_msa.c 2015-11-19 03:14:20.000000000 +0100 @@ -3792,7 +3792,7 @@ #undef MC_COPY #define MC(PEL, DIR, WIDTH, TAP, DIR1, FILT_DIR) \ -void ff_hevc_put_hevc_##PEL##_##DIR####WIDTH##_8_msa(int16_t *dst, \ +void ff_hevc_put_hevc_##PEL##_##DIR##WIDTH##_8_msa(int16_t *dst, \ uint8_t *src, \ ptrdiff_t src_stride, \ int height, \ @@ -3843,7 +3843,7 @@ #undef MC #define MC_HV(PEL, DIR, WIDTH, TAP, DIR1) \ -void ff_hevc_put_hevc_##PEL##_##DIR####WIDTH##_8_msa(int16_t *dst, \ +void ff_hevc_put_hevc_##PEL##_##DIR##WIDTH##_8_msa(int16_t *dst, \ uint8_t *src, \ ptrdiff_t src_stride, \ int height, \ diff -Nru ffmpeg-2.7.2/libavcodec/mips/hevc_mc_bi_msa.c ffmpeg-2.7.3/libavcodec/mips/hevc_mc_bi_msa.c --- ffmpeg-2.7.2/libavcodec/mips/hevc_mc_bi_msa.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/mips/hevc_mc_bi_msa.c 2015-11-19 03:14:20.000000000 +0100 @@ -4369,7 +4369,7 @@ #undef BI_MC_COPY #define BI_MC(PEL, DIR, WIDTH, TAP, DIR1, FILT_DIR) \ -void ff_hevc_put_hevc_bi_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_bi_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t dst_stride, \ uint8_t *src, \ ptrdiff_t src_stride, \ @@ -4423,7 +4423,7 @@ #undef BI_MC #define BI_MC_HV(PEL, DIR, WIDTH, TAP, DIR1) \ -void ff_hevc_put_hevc_bi_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_bi_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t dst_stride, \ uint8_t *src, \ ptrdiff_t src_stride, \ diff -Nru ffmpeg-2.7.2/libavcodec/mips/hevc_mc_biw_msa.c ffmpeg-2.7.3/libavcodec/mips/hevc_mc_biw_msa.c --- ffmpeg-2.7.2/libavcodec/mips/hevc_mc_biw_msa.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/mips/hevc_mc_biw_msa.c 2015-11-19 03:14:20.000000000 +0100 @@ -5454,7 +5454,7 @@ #undef BI_W_MC_COPY #define BI_W_MC(PEL, DIR, WIDTH, TAP, DIR1, FILT_DIR) \ -void ff_hevc_put_hevc_bi_w_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_bi_w_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t \ dst_stride, \ uint8_t *src, \ @@ -5521,7 +5521,7 @@ #undef BI_W_MC #define BI_W_MC_HV(PEL, DIR, WIDTH, TAP, DIR1) \ -void ff_hevc_put_hevc_bi_w_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_bi_w_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t \ dst_stride, \ uint8_t *src, \ diff -Nru ffmpeg-2.7.2/libavcodec/mips/hevc_mc_uni_msa.c ffmpeg-2.7.3/libavcodec/mips/hevc_mc_uni_msa.c --- ffmpeg-2.7.2/libavcodec/mips/hevc_mc_uni_msa.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/mips/hevc_mc_uni_msa.c 2015-11-19 03:14:20.000000000 +0100 @@ -3871,7 +3871,7 @@ #undef UNI_MC_COPY #define UNI_MC(PEL, DIR, WIDTH, TAP, DIR1, FILT_DIR) \ -void ff_hevc_put_hevc_uni_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_uni_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t \ dst_stride, \ uint8_t *src, \ @@ -3925,7 +3925,7 @@ #undef UNI_MC #define UNI_MC_HV(PEL, DIR, WIDTH, TAP, DIR1) \ -void ff_hevc_put_hevc_uni_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_uni_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t \ dst_stride, \ uint8_t *src, \ diff -Nru ffmpeg-2.7.2/libavcodec/mips/hevc_mc_uniw_msa.c ffmpeg-2.7.3/libavcodec/mips/hevc_mc_uniw_msa.c --- ffmpeg-2.7.2/libavcodec/mips/hevc_mc_uniw_msa.c 2015-06-19 22:44:39.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/mips/hevc_mc_uniw_msa.c 2015-11-19 03:14:20.000000000 +0100 @@ -4687,7 +4687,7 @@ #undef UNIWGT_MC_COPY #define UNI_W_MC(PEL, DIR, WIDTH, TAP, DIR1, FILT_DIR) \ -void ff_hevc_put_hevc_uni_w_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_uni_w_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t \ dst_stride, \ uint8_t *src, \ @@ -4746,7 +4746,7 @@ #undef UNI_W_MC #define UNI_W_MC_HV(PEL, DIR, WIDTH, TAP, DIR1) \ -void ff_hevc_put_hevc_uni_w_##PEL##_##DIR####WIDTH##_8_msa(uint8_t *dst, \ +void ff_hevc_put_hevc_uni_w_##PEL##_##DIR##WIDTH##_8_msa(uint8_t *dst, \ ptrdiff_t \ dst_stride, \ uint8_t *src, \ diff -Nru ffmpeg-2.7.2/libavcodec/mjpegdec.c ffmpeg-2.7.3/libavcodec/mjpegdec.c --- ffmpeg-2.7.2/libavcodec/mjpegdec.c 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/mjpegdec.c 2015-11-19 03:14:20.000000000 +0100 @@ -98,6 +98,15 @@ av_log(s->avctx, AV_LOG_INFO, "AVID: len:%d %d\n", len, len > 14 ? buf[12] : -1); } +static void init_idct(AVCodecContext *avctx) +{ + MJpegDecodeContext *s = avctx->priv_data; + + ff_idctdsp_init(&s->idsp, avctx); + ff_init_scantable(s->idsp.idct_permutation, &s->scantable, + ff_zigzag_direct); +} + av_cold int ff_mjpeg_decode_init(AVCodecContext *avctx) { MJpegDecodeContext *s = avctx->priv_data; @@ -112,9 +121,7 @@ s->avctx = avctx; ff_blockdsp_init(&s->bdsp, avctx); ff_hpeldsp_init(&s->hdsp, avctx->flags); - ff_idctdsp_init(&s->idsp, avctx); - ff_init_scantable(s->idsp.idct_permutation, &s->scantable, - ff_zigzag_direct); + init_idct(avctx); s->buffer_size = 0; s->buffer = NULL; s->start_code = -1; @@ -267,7 +274,6 @@ /* XXX: verify len field validity */ len = get_bits(&s->gb, 16); - s->avctx->bits_per_raw_sample = bits = get_bits(&s->gb, 8); if (bits > 16 || bits < 1) { @@ -275,6 +281,11 @@ return AVERROR_INVALIDDATA; } + if (s->avctx->bits_per_raw_sample != bits) { + av_log(s->avctx, AV_LOG_INFO, "Changeing bps to %d\n", bits); + s->avctx->bits_per_raw_sample = bits; + init_idct(s->avctx); + } if (s->pegasus_rct) bits = 9; if (bits == 9 && !s->pegasus_rct) @@ -990,7 +1001,14 @@ skip_bits(&s->gb, 16); /* skip RSTn */ } } - if (s->nb_components == 4) { + if (s->rct && s->nb_components == 4) { + for (mb_x = 0; mb_x < s->mb_width; mb_x++) { + ptr[4*mb_x + 2] = buffer[mb_x][0] - ((buffer[mb_x][1] + buffer[mb_x][2] - 0x200) >> 2); + ptr[4*mb_x + 1] = buffer[mb_x][1] + ptr[4*mb_x + 2]; + ptr[4*mb_x + 3] = buffer[mb_x][2] + ptr[4*mb_x + 2]; + ptr[4*mb_x + 0] = buffer[mb_x][3]; + } + } else if (s->nb_components == 4) { for(i=0; icomp_index[i]; if (s->bits <= 8) { @@ -1081,7 +1099,10 @@ dc = mjpeg_decode_dc(s, s->dc_index[i]); if(dc == 0xFFFFF) return -1; - if(bits<=8){ + if ( h * mb_x + x >= s->width + || v * mb_y + y >= s->height) { + // Nothing to do + } else if (bits<=8) { ptr = s->picture_ptr->data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap if(y==0 && toprow){ if(x==0 && leftcol){ @@ -1149,7 +1170,10 @@ dc = mjpeg_decode_dc(s, s->dc_index[i]); if(dc == 0xFFFFF) return -1; - if(bits<=8){ + if ( h * mb_x + x >= s->width + || v * mb_y + y >= s->height) { + // Nothing to do + } else if (bits<=8) { ptr = s->picture_ptr->data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap diff -Nru ffmpeg-2.7.2/libavcodec/mpeg12dec.c ffmpeg-2.7.3/libavcodec/mpeg12dec.c --- ffmpeg-2.7.2/libavcodec/mpeg12dec.c 2015-06-19 22:44:40.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/mpeg12dec.c 2015-11-19 03:14:20.000000000 +0100 @@ -1928,7 +1928,7 @@ (left && show_bits(&s->gb, FFMIN(left, 23)) && !is_d10) || ((avctx->err_recognition & (AV_EF_BITSTREAM | AV_EF_AGGRESSIVE)) && left > 8)) { av_log(avctx, AV_LOG_ERROR, "end mismatch left=%d %0X\n", - left, show_bits(&s->gb, FFMIN(left, 23))); + left, left>0 ? show_bits(&s->gb, FFMIN(left, 23)) : 0); return AVERROR_INVALIDDATA; } else goto eos; @@ -2152,8 +2152,6 @@ if (check_marker(&s->gb, "in sequence header") == 0) { return AVERROR_INVALIDDATA; } - s->width = width; - s->height = height; s->avctx->rc_buffer_size = get_bits(&s->gb, 10) * 1024 * 16; skip_bits(&s->gb, 1); @@ -2185,6 +2183,9 @@ return AVERROR_INVALIDDATA; } + s->width = width; + s->height = height; + /* We set MPEG-2 parameters so that it emulates MPEG-1. */ s->progressive_sequence = 1; s->progressive_frame = 1; diff -Nru ffmpeg-2.7.2/libavcodec/mpegaudiodec_template.c ffmpeg-2.7.3/libavcodec/mpegaudiodec_template.c --- ffmpeg-2.7.2/libavcodec/mpegaudiodec_template.c 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/mpegaudiodec_template.c 2015-11-19 03:14:20.000000000 +0100 @@ -1657,9 +1657,11 @@ uint32_t header; int ret; + int skipped = 0; while(buf_size && !*buf){ buf++; buf_size--; + skipped++; } if (buf_size < HEADER_SIZE) @@ -1714,7 +1716,7 @@ return ret; } s->frame_size = 0; - return buf_size; + return buf_size + skipped; } static void mp_flush(MPADecodeContext *ctx) diff -Nru ffmpeg-2.7.2/libavcodec/opusdec.c ffmpeg-2.7.3/libavcodec/opusdec.c --- ffmpeg-2.7.2/libavcodec/opusdec.c 2015-06-19 22:44:40.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/opusdec.c 2015-11-19 03:14:20.000000000 +0100 @@ -538,7 +538,7 @@ memset(frame->extended_data[i], 0, frame->linesize[0]); } - if (c->gain_i) { + if (c->gain_i && decoded_samples > 0) { c->fdsp->vector_fmul_scalar((float*)frame->extended_data[i], (float*)frame->extended_data[i], c->gain, FFALIGN(decoded_samples, 8)); diff -Nru ffmpeg-2.7.2/libavcodec/pngdec.c ffmpeg-2.7.3/libavcodec/pngdec.c --- ffmpeg-2.7.2/libavcodec/pngdec.c 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/pngdec.c 2015-11-19 03:14:20.000000000 +0100 @@ -946,7 +946,7 @@ for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += s->bpp, background += s->bpp) { size_t b; uint8_t foreground_alpha, background_alpha, output_alpha; - uint8_t output[4]; + uint8_t output[10]; // Since we might be blending alpha onto alpha, we use the following equations: // output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha @@ -986,6 +986,8 @@ output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha); + av_assert0(s->bpp <= 10); + for (b = 0; b < s->bpp - 1; ++b) { if (output_alpha == 0) { output[b] = 0; diff -Nru ffmpeg-2.7.2/libavcodec/smacker.c ffmpeg-2.7.3/libavcodec/smacker.c --- ffmpeg-2.7.2/libavcodec/smacker.c 2015-06-19 22:44:45.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/smacker.c 2015-11-19 03:14:20.000000000 +0100 @@ -668,6 +668,10 @@ /* get output buffer */ frame->nb_samples = unp_size / (avctx->channels * (bits + 1)); + if (unp_size % (avctx->channels * (bits + 1))) { + av_log(avctx, AV_LOG_ERROR, "unp_size %d is odd\n", unp_size); + return AVERROR(EINVAL); + } if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) return ret; samples = (int16_t *)frame->data[0]; diff -Nru ffmpeg-2.7.2/libavcodec/snow.h ffmpeg-2.7.3/libavcodec/snow.h --- ffmpeg-2.7.2/libavcodec/snow.h 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/snow.h 2015-11-19 03:14:20.000000000 +0100 @@ -563,6 +563,8 @@ e= 0; while(get_rac(c, state+1 + FFMIN(e,9))){ //1..10 e++; + if (e > 31) + return AVERROR_INVALIDDATA; } a= 1; diff -Nru ffmpeg-2.7.2/libavcodec/svq1dec.c ffmpeg-2.7.3/libavcodec/svq1dec.c --- ffmpeg-2.7.2/libavcodec/svq1dec.c 2015-06-19 22:44:45.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/svq1dec.c 2015-11-19 03:14:20.000000000 +0100 @@ -618,9 +618,12 @@ uint8_t *current; int result, i, x, y, width, height; svq1_pmv *pmv; + int ret; /* initialize bit buffer */ - init_get_bits8(&s->gb, buf, buf_size); + ret = init_get_bits8(&s->gb, buf, buf_size); + if (ret < 0) + return ret; /* decode frame header */ s->frame_code = get_bits(&s->gb, 22); diff -Nru ffmpeg-2.7.2/libavcodec/svq1enc.c ffmpeg-2.7.3/libavcodec/svq1enc.c --- ffmpeg-2.7.2/libavcodec/svq1enc.c 2015-06-19 22:44:45.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/svq1enc.c 2015-11-19 03:14:20.000000000 +0100 @@ -515,6 +515,11 @@ SVQ1EncContext *const s = avctx->priv_data; int ret; + if (avctx->width >= 4096 || avctx->height >= 4096) { + av_log(avctx, AV_LOG_ERROR, "Dimensions too large, maximum is 4095x4095\n"); + return AVERROR(EINVAL); + } + ff_hpeldsp_init(&s->hdsp, avctx->flags); ff_me_cmp_init(&s->mecc, avctx); ff_mpegvideoencdsp_init(&s->m.mpvencdsp, avctx); diff -Nru ffmpeg-2.7.2/libavcodec/takdec.c ffmpeg-2.7.3/libavcodec/takdec.c --- ffmpeg-2.7.2/libavcodec/takdec.c 2015-06-19 22:47:55.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/takdec.c 2015-11-19 03:14:20.000000000 +0100 @@ -632,7 +632,7 @@ for (; length2 > 0; length2 -= tmp) { tmp = FFMIN(length2, x); - for (i = 0; i < tmp; i++) + for (i = 0; i < tmp - (tmp == length2); i++) s->residues[filter_order + i] = *p2++ >> dshift; for (i = 0; i < tmp; i++) { diff -Nru ffmpeg-2.7.2/libavcodec/truemotion1.c ffmpeg-2.7.3/libavcodec/truemotion1.c --- ffmpeg-2.7.2/libavcodec/truemotion1.c 2015-06-19 22:44:45.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/truemotion1.c 2015-11-19 03:14:20.000000000 +0100 @@ -402,6 +402,10 @@ new_pix_fmt = AV_PIX_FMT_RGB555; // RGB565 is supported as well s->w >>= width_shift; + if (s->w & 1) { + avpriv_request_sample(s->avctx, "Frame with odd width"); + return AVERROR_PATCHWELCOME; + } if (s->w != s->avctx->width || s->h != s->avctx->height || new_pix_fmt != s->avctx->pix_fmt) { diff -Nru ffmpeg-2.7.2/libavcodec/tta.c ffmpeg-2.7.3/libavcodec/tta.c --- ffmpeg-2.7.2/libavcodec/tta.c 2015-06-19 22:44:45.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/tta.c 2015-11-19 03:14:20.000000000 +0100 @@ -123,6 +123,7 @@ TTAContext *s = avctx->priv_data; GetBitContext gb; int total_frames; + int ret; s->avctx = avctx; @@ -131,7 +132,10 @@ return AVERROR_INVALIDDATA; s->crc_table = av_crc_get_table(AV_CRC_32_IEEE_LE); - init_get_bits8(&gb, avctx->extradata, avctx->extradata_size); + ret = init_get_bits8(&gb, avctx->extradata, avctx->extradata_size); + if (ret < 0) + return ret; + if (show_bits_long(&gb, 32) == AV_RL32("TTA1")) { /* signature */ skip_bits_long(&gb, 32); diff -Nru ffmpeg-2.7.2/libavcodec/utils.c ffmpeg-2.7.3/libavcodec/utils.c --- ffmpeg-2.7.2/libavcodec/utils.c 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/utils.c 2015-11-19 03:14:20.000000000 +0100 @@ -3418,7 +3418,7 @@ return frame_bytes * 8 / bps; } - if (ch > 0) { + if (ch > 0 && ch < INT_MAX/16) { /* calc from frame_bytes and channels */ switch (id) { case AV_CODEC_ID_ADPCM_AFC: diff -Nru ffmpeg-2.7.2/libavcodec/vp3.c ffmpeg-2.7.3/libavcodec/vp3.c --- ffmpeg-2.7.2/libavcodec/vp3.c 2015-06-19 22:44:45.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/vp3.c 2015-11-19 03:14:20.000000000 +0100 @@ -2473,6 +2473,7 @@ const uint8_t *header_start[3]; int header_len[3]; int i; + int ret; avctx->pix_fmt = AV_PIX_FMT_YUV420P; @@ -2492,7 +2493,9 @@ for (i = 0; i < 3; i++) { if (header_len[i] <= 0) continue; - init_get_bits8(&gb, header_start[i], header_len[i]); + ret = init_get_bits8(&gb, header_start[i], header_len[i]); + if (ret < 0) + return ret; ptype = get_bits(&gb, 8); diff -Nru ffmpeg-2.7.2/libavcodec/wmaprodec.c ffmpeg-2.7.3/libavcodec/wmaprodec.c --- ffmpeg-2.7.2/libavcodec/wmaprodec.c 2015-06-19 22:44:46.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/wmaprodec.c 2015-11-19 03:14:20.000000000 +0100 @@ -1623,6 +1623,11 @@ s->packet_done = 1; } + if (remaining_bits(s, gb) < 0) { + av_log(avctx, AV_LOG_ERROR, "Overread %d\n", -remaining_bits(s, gb)); + s->packet_loss = 1; + } + if (s->packet_done && !s->packet_loss && remaining_bits(s, gb) > 0) { /** save the rest of the data so that it can be decoded diff -Nru ffmpeg-2.7.2/libavcodec/x86/sbrdsp.asm ffmpeg-2.7.3/libavcodec/x86/sbrdsp.asm --- ffmpeg-2.7.2/libavcodec/x86/sbrdsp.asm 2015-06-19 22:44:46.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/x86/sbrdsp.asm 2015-11-19 03:14:20.000000000 +0100 @@ -382,6 +382,7 @@ %else %define count m_maxq %endif + movsxdifnidn noiseq, noised dec noiseq shl count, 2 %ifdef PIC diff -Nru ffmpeg-2.7.2/libavcodec/x86/videodsp.asm ffmpeg-2.7.3/libavcodec/x86/videodsp.asm --- ffmpeg-2.7.2/libavcodec/x86/videodsp.asm 2015-06-19 22:44:48.000000000 +0200 +++ ffmpeg-2.7.3/libavcodec/x86/videodsp.asm 2015-11-19 03:14:20.000000000 +0100 @@ -194,8 +194,12 @@ %elif (%2-%%off) == 2 mov valw, [srcq+%2-2] %elifidn %1, body - mov vald, [srcq+%2-3] -%else + mov valb, [srcq+%2-1] + sal vald, 16 + mov valw, [srcq+%2-3] +%elifidn %1, bottom + movd mm %+ %%mmx_idx, [srcq+%2-4] +%else ; top movd mm %+ %%mmx_idx, [srcq+%2-3] %endif %endif ; (%2-%%off) >= 1 @@ -251,12 +255,15 @@ mov [dstq+%2-2], valw %elifidn %1, body mov [dstq+%2-3], valw - shr vald, 16 + sar vald, 16 mov [dstq+%2-1], valb %else movd vald, mm %+ %%mmx_idx +%ifidn %1, bottom + sar vald, 8 +%endif mov [dstq+%2-3], valw - shr vald, 16 + sar vald, 16 mov [dstq+%2-1], valb %endif %endif ; (%2-%%off) >= 1 diff -Nru ffmpeg-2.7.2/libavfilter/af_asyncts.c ffmpeg-2.7.3/libavfilter/af_asyncts.c --- ffmpeg-2.7.2/libavfilter/af_asyncts.c 2015-06-18 20:55:02.000000000 +0200 +++ ffmpeg-2.7.3/libavfilter/af_asyncts.c 2015-11-19 03:14:20.000000000 +0100 @@ -205,7 +205,7 @@ delta = pts - s->pts - get_delay(s); out_size = avresample_available(s->avr); - if (labs(delta) > s->min_delta || + if (llabs(delta) > s->min_delta || (s->first_frame && delta && s->first_pts != AV_NOPTS_VALUE)) { av_log(ctx, AV_LOG_VERBOSE, "Discontinuity - %"PRId64" samples.\n", delta); out_size = av_clipl_int32((int64_t)out_size + delta); diff -Nru ffmpeg-2.7.2/libavformat/avidec.c ffmpeg-2.7.3/libavformat/avidec.c --- ffmpeg-2.7.2/libavformat/avidec.c 2015-06-19 22:44:51.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/avidec.c 2015-11-19 03:14:20.000000000 +0100 @@ -1577,7 +1577,8 @@ ast = st->priv_data; if (first_packet && first_packet_pos) { - data_offset = first_packet_pos - pos; + if (avi->movi_list + 4 != pos || pos + 500 > first_packet_pos) + data_offset = first_packet_pos - pos; first_packet = 0; } pos += data_offset; diff -Nru ffmpeg-2.7.2/libavformat/dump.c ffmpeg-2.7.3/libavformat/dump.c --- ffmpeg-2.7.2/libavformat/dump.c 2015-06-19 22:44:51.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/dump.c 2015-11-19 03:14:20.000000000 +0100 @@ -420,8 +420,8 @@ av_cmp_q(st->sample_aspect_ratio, st->codec->sample_aspect_ratio)) { AVRational display_aspect_ratio; av_reduce(&display_aspect_ratio.num, &display_aspect_ratio.den, - st->codec->width * st->sample_aspect_ratio.num, - st->codec->height * st->sample_aspect_ratio.den, + st->codec->width * (int64_t)st->sample_aspect_ratio.num, + st->codec->height * (int64_t)st->sample_aspect_ratio.den, 1024 * 1024); av_log(NULL, AV_LOG_INFO, ", SAR %d:%d DAR %d:%d", st->sample_aspect_ratio.num, st->sample_aspect_ratio.den, diff -Nru ffmpeg-2.7.2/libavformat/hevc.c ffmpeg-2.7.3/libavformat/hevc.c --- ffmpeg-2.7.2/libavformat/hevc.c 2015-06-19 22:47:55.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/hevc.c 2015-11-19 03:14:20.000000000 +0100 @@ -565,7 +565,10 @@ } if (get_bits1(gb)) { // long_term_ref_pics_present_flag - for (i = 0; i < get_ue_golomb_long(gb); i++) { // num_long_term_ref_pics_sps + unsigned num_long_term_ref_pics_sps = get_ue_golomb_long(gb); + if (num_long_term_ref_pics_sps > 31U) + return AVERROR_INVALIDDATA; + for (i = 0; i < num_long_term_ref_pics_sps; i++) { // num_long_term_ref_pics_sps int len = FFMIN(log2_max_pic_order_cnt_lsb_minus4 + 4, 16); skip_bits (gb, len); // lt_ref_pic_poc_lsb_sps[i] skip_bits1(gb); // used_by_curr_pic_lt_sps_flag[i] @@ -616,11 +619,12 @@ get_se_golomb_long(gb); // pps_cr_qp_offset /* + * pps_slice_chroma_qp_offsets_present_flag u(1) * weighted_pred_flag u(1) * weighted_bipred_flag u(1) * transquant_bypass_enabled_flag u(1) */ - skip_bits(gb, 3); + skip_bits(gb, 4); tiles_enabled_flag = get_bits1(gb); entropy_coding_sync_enabled_flag = get_bits1(gb); diff -Nru ffmpeg-2.7.2/libavformat/hls.c ffmpeg-2.7.3/libavformat/hls.c --- ffmpeg-2.7.2/libavformat/hls.c 2015-06-19 22:44:51.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/hls.c 2015-11-19 03:14:20.000000000 +0100 @@ -73,6 +73,8 @@ char *key; enum KeyType key_type; uint8_t iv[16]; + /* associated Media Initialization Section, treated as a segment */ + struct segment *init_section; }; struct rendition; @@ -110,6 +112,13 @@ int64_t cur_seg_offset; int64_t last_load_time; + /* Currently active Media Initialization Section */ + struct segment *cur_init_section; + uint8_t *init_sec_buf; + unsigned int init_sec_buf_size; + unsigned int init_sec_data_len; + unsigned int init_sec_buf_read_offset; + char key_url[MAX_URL_SIZE]; uint8_t key[16]; @@ -135,6 +144,11 @@ * multiple (playlist-less) renditions associated with them. */ int n_renditions; struct rendition **renditions; + + /* Media Initialization Sections (EXT-X-MAP) associated with this + * playlist, if any. */ + int n_init_sections; + struct segment **init_sections; }; /* @@ -204,16 +218,29 @@ pls->n_segments = 0; } +static void free_init_section_list(struct playlist *pls) +{ + int i; + for (i = 0; i < pls->n_init_sections; i++) { + av_freep(&pls->init_sections[i]->url); + av_freep(&pls->init_sections[i]); + } + av_freep(&pls->init_sections); + pls->n_init_sections = 0; +} + static void free_playlist_list(HLSContext *c) { int i; for (i = 0; i < c->n_playlists; i++) { struct playlist *pls = c->playlists[i]; free_segment_list(pls); + free_init_section_list(pls); av_freep(&pls->renditions); av_freep(&pls->id3_buf); av_dict_free(&pls->id3_initial); ff_id3v2_free_extra_meta(&pls->id3_deferred_extra); + av_freep(&pls->init_sec_buf); av_free_packet(&pls->pkt); av_freep(&pls->pb.buffer); if (pls->input) @@ -351,6 +378,60 @@ } } +struct init_section_info { + char uri[MAX_URL_SIZE]; + char byterange[32]; +}; + +static struct segment *new_init_section(struct playlist *pls, + struct init_section_info *info, + const char *url_base) +{ + struct segment *sec; + char *ptr; + char tmp_str[MAX_URL_SIZE]; + + if (!info->uri[0]) + return NULL; + + sec = av_mallocz(sizeof(*sec)); + if (!sec) + return NULL; + + ff_make_absolute_url(tmp_str, sizeof(tmp_str), url_base, info->uri); + sec->url = av_strdup(tmp_str); + if (!sec->url) { + av_free(sec); + return NULL; + } + + if (info->byterange[0]) { + sec->size = atoi(info->byterange); + ptr = strchr(info->byterange, '@'); + if (ptr) + sec->url_offset = atoi(ptr+1); + } else { + /* the entire file is the init section */ + sec->size = -1; + } + + dynarray_add(&pls->init_sections, &pls->n_init_sections, sec); + + return sec; +} + +static void handle_init_section_args(struct init_section_info *info, const char *key, + int key_len, char **dest, int *dest_len) +{ + if (!strncmp(key, "URI=", key_len)) { + *dest = info->uri; + *dest_len = sizeof(info->uri); + } else if (!strncmp(key, "BYTERANGE=", key_len)) { + *dest = info->byterange; + *dest_len = sizeof(info->byterange); + } +} + struct rendition_info { char type[16]; char uri[MAX_URL_SIZE]; @@ -511,6 +592,7 @@ uint8_t *new_url = NULL; struct variant_info variant_info; char tmp_str[MAX_URL_SIZE]; + struct segment *cur_init_section = NULL; if (!in) { AVDictionary *opts = NULL; @@ -589,6 +671,14 @@ pls->type = PLS_TYPE_EVENT; else if (!strcmp(ptr, "VOD")) pls->type = PLS_TYPE_VOD; + } else if (av_strstart(line, "#EXT-X-MAP:", &ptr)) { + struct init_section_info info = {{0}}; + ret = ensure_playlist(c, &pls, url); + if (ret < 0) + goto fail; + ff_parse_key_value(ptr, (ff_parse_key_val_cb) handle_init_section_args, + &info); + cur_init_section = new_init_section(pls, &info, url); } else if (av_strstart(line, "#EXT-X-ENDLIST", &ptr)) { if (pls) pls->finished = 1; @@ -667,6 +757,8 @@ seg->url_offset = 0; seg_offset = 0; } + + seg->init_section = cur_init_section; } } } @@ -680,17 +772,22 @@ return ret; } +static struct segment *current_segment(struct playlist *pls) +{ + return pls->segments[pls->cur_seq_no - pls->start_seq_no]; +} + enum ReadFromURLMode { READ_NORMAL, READ_COMPLETE, }; /* read from URLContext, limiting read to current segment */ -static int read_from_url(struct playlist *pls, uint8_t *buf, int buf_size, +static int read_from_url(struct playlist *pls, struct segment *seg, + uint8_t *buf, int buf_size, enum ReadFromURLMode mode) { int ret; - struct segment *seg = pls->segments[pls->cur_seq_no - pls->start_seq_no]; /* limit read if the segment was only a part of a file */ if (seg->size >= 0) @@ -813,12 +910,13 @@ int bytes; int id3_buf_pos = 0; int fill_buf = 0; + struct segment *seg = current_segment(pls); /* gather all the id3 tags */ while (1) { /* see if we can retrieve enough data for ID3 header */ if (*len < ID3v2_HEADER_SIZE && buf_size >= ID3v2_HEADER_SIZE) { - bytes = read_from_url(pls, buf + *len, ID3v2_HEADER_SIZE - *len, READ_COMPLETE); + bytes = read_from_url(pls, seg, buf + *len, ID3v2_HEADER_SIZE - *len, READ_COMPLETE); if (bytes > 0) { if (bytes == ID3v2_HEADER_SIZE - *len) @@ -839,7 +937,6 @@ break; if (ff_id3v2_match(buf, ID3v2_DEFAULT_MAGIC)) { - struct segment *seg = pls->segments[pls->cur_seq_no - pls->start_seq_no]; int64_t maxsize = seg->size >= 0 ? seg->size : 1024*1024; int taglen = ff_id3v2_tag_len(buf); int tag_got_bytes = FFMIN(taglen, *len); @@ -871,7 +968,7 @@ if (remaining > 0) { /* read the rest of the tag in */ - if (read_from_url(pls, pls->id3_buf + id3_buf_pos, remaining, READ_COMPLETE) != remaining) + if (read_from_url(pls, seg, pls->id3_buf + id3_buf_pos, remaining, READ_COMPLETE) != remaining) break; id3_buf_pos += remaining; av_log(pls->ctx, AV_LOG_DEBUG, "Stripped additional %d HLS ID3 bytes\n", remaining); @@ -885,7 +982,7 @@ /* re-fill buffer for the caller unless EOF */ if (*len >= 0 && (fill_buf || *len == 0)) { - bytes = read_from_url(pls, buf + *len, buf_size - *len, READ_NORMAL); + bytes = read_from_url(pls, seg, buf + *len, buf_size - *len, READ_NORMAL); /* ignore error if we already had some data */ if (bytes >= 0) @@ -913,12 +1010,11 @@ av_freep(dest); } -static int open_input(HLSContext *c, struct playlist *pls) +static int open_input(HLSContext *c, struct playlist *pls, struct segment *seg) { AVDictionary *opts = NULL; AVDictionary *opts2 = NULL; int ret; - struct segment *seg = pls->segments[pls->cur_seq_no - pls->start_seq_no]; // broker prior HTTP options that should be consistent across requests av_dict_set(&opts, "user-agent", c->user_agent, 0); @@ -1010,6 +1106,66 @@ return ret; } +static int update_init_section(struct playlist *pls, struct segment *seg) +{ + static const int max_init_section_size = 1024*1024; + HLSContext *c = pls->parent->priv_data; + int64_t sec_size; + int64_t urlsize; + int ret; + + if (seg->init_section == pls->cur_init_section) + return 0; + + pls->cur_init_section = NULL; + + if (!seg->init_section) + return 0; + + /* this will clobber playlist URLContext stuff, so this should be + * called between segments only */ + ret = open_input(c, pls, seg->init_section); + if (ret < 0) { + av_log(pls->parent, AV_LOG_WARNING, + "Failed to open an initialization section in playlist %d\n", + pls->index); + return ret; + } + + if (seg->init_section->size >= 0) + sec_size = seg->init_section->size; + else if ((urlsize = ffurl_size(pls->input)) >= 0) + sec_size = urlsize; + else + sec_size = max_init_section_size; + + av_log(pls->parent, AV_LOG_DEBUG, + "Downloading an initialization section of size %"PRId64"\n", + sec_size); + + sec_size = FFMIN(sec_size, max_init_section_size); + + av_fast_malloc(&pls->init_sec_buf, &pls->init_sec_buf_size, sec_size); + + ret = read_from_url(pls, seg->init_section, pls->init_sec_buf, + pls->init_sec_buf_size, READ_COMPLETE); + ffurl_close(pls->input); + pls->input = NULL; + + if (ret < 0) + return ret; + + pls->cur_init_section = seg->init_section; + pls->init_sec_data_len = ret; + pls->init_sec_buf_read_offset = 0; + + /* spec says audio elementary streams do not have media initialization + * sections, so there should be no ID3 timestamps */ + pls->is_id3_timestamped = 0; + + return 0; +} + static int64_t default_reload_interval(struct playlist *pls) { return pls->n_segments > 0 ? @@ -1030,6 +1186,7 @@ if (!v->input) { int64_t reload_interval; + struct segment *seg; /* Check that the playlist is still needed before opening a new * segment. */ @@ -1083,7 +1240,14 @@ goto reload; } - ret = open_input(c, v); + seg = current_segment(v); + + /* load/update Media Initialization Section, if any */ + ret = update_init_section(v, seg); + if (ret) + return ret; + + ret = open_input(c, v, seg); if (ret < 0) { av_log(v->parent, AV_LOG_WARNING, "Failed to open segment of playlist %d\n", v->index); @@ -1093,7 +1257,15 @@ just_opened = 1; } - ret = read_from_url(v, buf, buf_size, READ_NORMAL); + if (v->init_sec_buf_read_offset < v->init_sec_data_len) { + /* Push init section out first before first actual segment */ + int copy_size = FFMIN(v->init_sec_data_len - v->init_sec_buf_read_offset, buf_size); + memcpy(buf, v->init_sec_buf, copy_size); + v->init_sec_buf_read_offset += copy_size; + return copy_size; + } + + ret = read_from_url(v, current_segment(v), buf, buf_size, READ_NORMAL); if (ret > 0) { if (just_opened && v->is_id3_timestamped != 0) { /* Intercept ID3 tags here, elementary audio streams are required @@ -1535,6 +1707,7 @@ int ret, i, minplaylist = -1; recheck_discard_flags(s, c->first_packet); + c->first_packet = 0; for (i = 0; i < c->n_playlists; i++) { struct playlist *pls = c->playlists[i]; diff -Nru ffmpeg-2.7.2/libavformat/httpauth.c ffmpeg-2.7.3/libavformat/httpauth.c --- ffmpeg-2.7.2/libavformat/httpauth.c 2015-06-19 22:44:51.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/httpauth.c 2015-11-19 03:14:20.000000000 +0100 @@ -220,21 +220,21 @@ /* TODO: Escape the quoted strings properly. */ av_strlcatf(authstr, len, "username=\"%s\"", username); - av_strlcatf(authstr, len, ",realm=\"%s\"", state->realm); - av_strlcatf(authstr, len, ",nonce=\"%s\"", digest->nonce); - av_strlcatf(authstr, len, ",uri=\"%s\"", uri); - av_strlcatf(authstr, len, ",response=\"%s\"", response); + av_strlcatf(authstr, len, ", realm=\"%s\"", state->realm); + av_strlcatf(authstr, len, ", nonce=\"%s\"", digest->nonce); + av_strlcatf(authstr, len, ", uri=\"%s\"", uri); + av_strlcatf(authstr, len, ", response=\"%s\"", response); // we are violating the RFC and use "" because all others seem to do that too. if (digest->algorithm[0]) - av_strlcatf(authstr, len, ",algorithm=\"%s\"", digest->algorithm); + av_strlcatf(authstr, len, ", algorithm=\"%s\"", digest->algorithm); if (digest->opaque[0]) - av_strlcatf(authstr, len, ",opaque=\"%s\"", digest->opaque); + av_strlcatf(authstr, len, ", opaque=\"%s\"", digest->opaque); if (digest->qop[0]) { - av_strlcatf(authstr, len, ",qop=\"%s\"", digest->qop); - av_strlcatf(authstr, len, ",cnonce=\"%s\"", cnonce); - av_strlcatf(authstr, len, ",nc=%s", nc); + av_strlcatf(authstr, len, ", qop=\"%s\"", digest->qop); + av_strlcatf(authstr, len, ", cnonce=\"%s\"", cnonce); + av_strlcatf(authstr, len, ", nc=%s", nc); } av_strlcatf(authstr, len, "\r\n"); diff -Nru ffmpeg-2.7.2/libavformat/img2dec.c ffmpeg-2.7.3/libavformat/img2dec.c --- ffmpeg-2.7.2/libavformat/img2dec.c 2015-06-19 22:44:51.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/img2dec.c 2015-11-19 03:14:20.000000000 +0100 @@ -444,14 +444,17 @@ } res = av_new_packet(pkt, size[0] + size[1] + size[2]); - if (res < 0) - return res; + if (res < 0) { + goto fail; + } pkt->stream_index = 0; pkt->flags |= AV_PKT_FLAG_KEY; if (s->ts_from_file) { struct stat img_stat; - if (stat(filename, &img_stat)) - return AVERROR(EIO); + if (stat(filename, &img_stat)) { + res = AVERROR(EIO); + goto fail; + } pkt->pts = (int64_t)img_stat.st_mtime; #if HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC if (s->ts_from_file == 2) @@ -485,18 +488,29 @@ if (ret[0] <= 0 || ret[1] < 0 || ret[2] < 0) { av_free_packet(pkt); if (ret[0] < 0) { - return ret[0]; + res = ret[0]; } else if (ret[1] < 0) { - return ret[1]; - } else if (ret[2] < 0) - return ret[2]; - return AVERROR_EOF; + res = ret[1]; + } else if (ret[2] < 0) { + res = ret[2]; + } else { + res = AVERROR_EOF; + } + goto fail; } else { s->img_count++; s->img_number++; s->pts++; return 0; } + +fail: + if (!s->is_pipe) { + for (i = 0; i < 3; i++) { + avio_closep(&f[i]); + } + } + return res; } static int img_read_close(struct AVFormatContext* s1) diff -Nru ffmpeg-2.7.2/libavformat/jvdec.c ffmpeg-2.7.3/libavformat/jvdec.c --- ffmpeg-2.7.2/libavformat/jvdec.c 2015-06-19 22:44:51.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/jvdec.c 2015-11-19 03:14:20.000000000 +0100 @@ -54,7 +54,7 @@ static int read_probe(AVProbeData *pd) { - if (pd->buf[0] == 'J' && pd->buf[1] == 'V' && strlen(MAGIC) <= pd->buf_size - 4 && + if (pd->buf[0] == 'J' && pd->buf[1] == 'V' && strlen(MAGIC) + 4 <= pd->buf_size && !memcmp(pd->buf + 4, MAGIC, strlen(MAGIC))) return AVPROBE_SCORE_MAX; return 0; diff -Nru ffmpeg-2.7.2/libavformat/matroskadec.c ffmpeg-2.7.3/libavformat/matroskadec.c --- ffmpeg-2.7.2/libavformat/matroskadec.c 2015-06-19 22:47:55.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/matroskadec.c 2015-11-19 03:14:20.000000000 +0100 @@ -2053,7 +2053,9 @@ st->codec->channels = track->audio.channels; if (!st->codec->bits_per_coded_sample) st->codec->bits_per_coded_sample = track->audio.bitdepth; - if (st->codec->codec_id != AV_CODEC_ID_AAC) + if (st->codec->codec_id == AV_CODEC_ID_MP3) + st->need_parsing = AVSTREAM_PARSE_FULL; + else if (st->codec->codec_id != AV_CODEC_ID_AAC) st->need_parsing = AVSTREAM_PARSE_HEADERS; if (track->codec_delay > 0) { st->codec->delay = av_rescale_q(track->codec_delay, @@ -3074,6 +3076,7 @@ tracks[i].audio.buf_timecode = AV_NOPTS_VALUE; tracks[i].end_timecode = 0; if (tracks[i].type == MATROSKA_TRACK_TYPE_SUBTITLE && + tracks[i].stream && tracks[i].stream->discard != AVDISCARD_ALL) { index_sub = av_index_search_timestamp( tracks[i].stream, st->index_entries[index].timestamp, diff -Nru ffmpeg-2.7.2/libavformat/mov.c ffmpeg-2.7.3/libavformat/mov.c --- ffmpeg-2.7.2/libavformat/mov.c 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/mov.c 2015-11-19 03:14:20.000000000 +0100 @@ -2354,7 +2354,7 @@ av_log(c->fc, AV_LOG_TRACE, "count=%d, duration=%d\n", count, duration); - if (FFABS(duration) > (1<<28) && i+2fc, AV_LOG_WARNING, "CTTS invalid\n"); av_freep(&sc->ctts_data); sc->ctts_count = 0; diff -Nru ffmpeg-2.7.2/libavformat/mp3dec.c ffmpeg-2.7.3/libavformat/mp3dec.c --- ffmpeg-2.7.2/libavformat/mp3dec.c 2015-06-19 22:44:51.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/mp3dec.c 2015-11-19 03:14:20.000000000 +0100 @@ -42,6 +42,9 @@ #define XING_TOC_COUNT 100 +#define SAME_HEADER_MASK \ + (0xffe00000 | (3 << 17) | (3 << 10) | (3 << 19)) + typedef struct { AVClass *class; int64_t filesize; @@ -54,7 +57,7 @@ int is_cbr; } MP3DecContext; -static int check(AVFormatContext *s, int64_t pos); +static int check(AVFormatContext *s, int64_t pos, uint32_t *header); /* mp3 read */ @@ -374,12 +377,21 @@ off = avio_tell(s->pb); for (i = 0; i < 64 * 1024; i++) { + uint32_t header, header2; + int frame_size; if (!(i&1023)) ffio_ensure_seekback(s->pb, i + 1024 + 4); - if (check(s, off + i) >= 0) { - av_log(s, AV_LOG_INFO, "Skipping %d bytes of junk at %lld.\n", i, (long long)off); - avio_seek(s->pb, off + i, SEEK_SET); - break; + frame_size = check(s, off + i, &header); + if (frame_size > 0) { + avio_seek(s->pb, off, SEEK_SET); + ffio_ensure_seekback(s->pb, i + 1024 + frame_size + 4); + if (check(s, off + i + frame_size, &header2) >= 0 && + (header & SAME_HEADER_MASK) == (header2 & SAME_HEADER_MASK)) + { + av_log(s, AV_LOG_INFO, "Skipping %d bytes of junk at %"PRId64".\n", i, off); + avio_seek(s->pb, off + i, SEEK_SET); + break; + } } avio_seek(s->pb, off, SEEK_SET); } @@ -425,7 +437,7 @@ return ret; } -static int check(AVFormatContext *s, int64_t pos) +static int check(AVFormatContext *s, int64_t pos, uint32_t *ret_header) { int64_t ret = avio_seek(s->pb, pos, SEEK_SET); unsigned header; @@ -437,6 +449,9 @@ return -1; if (avpriv_mpegaudio_decode_header(&sd, header) == 1) return -1; + + if (ret_header) + *ret_header = header; return sd.frame_size; } @@ -490,7 +505,7 @@ continue; for(j=0; jpos - pos)*dir <= 0 && abs(MIN_VALID/2-j) < score) { diff -Nru ffmpeg-2.7.2/libavformat/mux.c ffmpeg-2.7.3/libavformat/mux.c --- ffmpeg-2.7.2/libavformat/mux.c 2015-06-19 22:44:52.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/mux.c 2015-11-19 03:14:20.000000000 +0100 @@ -1043,6 +1043,8 @@ if (interleave) ret = av_interleaved_write_frame(dst, &local_pkt); else ret = av_write_frame(dst, &local_pkt); pkt->buf = local_pkt.buf; + pkt->side_data = local_pkt.side_data; + pkt->side_data_elems = local_pkt.side_data_elems; pkt->destruct = local_pkt.destruct; return ret; } diff -Nru ffmpeg-2.7.2/libavformat/mxg.c ffmpeg-2.7.3/libavformat/mxg.c --- ffmpeg-2.7.2/libavformat/mxg.c 2015-06-19 22:44:52.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/mxg.c 2015-11-19 03:14:20.000000000 +0100 @@ -182,7 +182,7 @@ if (mxg->soi_ptr - mxg->buffer > mxg->cache_size) { if (mxg->cache_size > 0) { - memcpy(mxg->buffer, mxg->buffer_ptr, mxg->cache_size); + memmove(mxg->buffer, mxg->buffer_ptr, mxg->cache_size); } mxg->buffer_ptr = mxg->buffer; diff -Nru ffmpeg-2.7.2/libavformat/oggenc.c ffmpeg-2.7.3/libavformat/oggenc.c --- ffmpeg-2.7.2/libavformat/oggenc.c 2015-06-19 22:44:52.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/oggenc.c 2015-11-19 03:14:20.000000000 +0100 @@ -260,7 +260,7 @@ if (i == total_segments) page->granule = granule; - if (!header) { + { AVStream *st = s->streams[page->stream_index]; int64_t start = av_rescale_q(page->start_granule, st->time_base, @@ -268,10 +268,13 @@ int64_t next = av_rescale_q(page->granule, st->time_base, AV_TIME_BASE_Q); - if (page->segments_count == 255 || - (ogg->pref_size > 0 && page->size >= ogg->pref_size) || - (ogg->pref_duration > 0 && next - start >= ogg->pref_duration)) { + if (page->segments_count == 255) { ogg_buffer_page(s, oggstream); + } else if (!header) { + if ((ogg->pref_size > 0 && page->size >= ogg->pref_size) || + (ogg->pref_duration > 0 && next - start >= ogg->pref_duration)) { + ogg_buffer_page(s, oggstream); + } } } } diff -Nru ffmpeg-2.7.2/libavformat/rawdec.c ffmpeg-2.7.3/libavformat/rawdec.c --- ffmpeg-2.7.2/libavformat/rawdec.c 2015-06-19 22:44:52.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/rawdec.c 2015-11-19 03:14:20.000000000 +0100 @@ -188,10 +188,10 @@ } if (nb_invalid*4 + 1 < nb_frames) { - static const char ct_jpeg[] = "\r\nContent-Type: image/jpeg\r\n\r\n"; + static const char ct_jpeg[] = "\r\nContent-Type: image/jpeg\r\n"; int i; - for (i=0; ibuf_size - sizeof(ct_jpeg), 100); i++) + for (i=0; ibuf_size - (int)sizeof(ct_jpeg), 100); i++) if (!memcmp(p->buf + i, ct_jpeg, sizeof(ct_jpeg) - 1)) return AVPROBE_SCORE_EXTENSION; diff -Nru ffmpeg-2.7.2/libavformat/rtmpcrypt.c ffmpeg-2.7.3/libavformat/rtmpcrypt.c --- ffmpeg-2.7.2/libavformat/rtmpcrypt.c 2015-06-19 22:44:52.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/rtmpcrypt.c 2015-11-19 03:14:20.000000000 +0100 @@ -184,9 +184,14 @@ static void rtmpe8_sig(const uint8_t *in, uint8_t *out, int key_id) { struct AVXTEA ctx; + uint8_t tmpbuf[8]; av_xtea_init(&ctx, rtmpe8_keys[key_id]); - av_xtea_crypt(&ctx, out, in, 1, NULL, 0); + AV_WB32(tmpbuf, AV_RL32(in)); + AV_WB32(tmpbuf + 4, AV_RL32(in + 4)); + av_xtea_crypt(&ctx, tmpbuf, tmpbuf, 1, NULL, 0); + AV_WL32(out, AV_RB32(tmpbuf)); + AV_WL32(out + 4, AV_RB32(tmpbuf + 4)); } static void rtmpe9_sig(const uint8_t *in, uint8_t *out, int key_id) diff -Nru ffmpeg-2.7.2/libavformat/segment.c ffmpeg-2.7.3/libavformat/segment.c --- ffmpeg-2.7.2/libavformat/segment.c 2015-06-19 22:44:53.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/segment.c 2015-11-19 03:14:20.000000000 +0100 @@ -113,6 +113,9 @@ int reference_stream_index; int break_non_keyframes; + int use_rename; + char temp_list_filename[1024]; + SegmentListEntry cur_entry; SegmentListEntry *segment_list_entries; SegmentListEntry *segment_list_entries_end; @@ -258,7 +261,8 @@ SegmentContext *seg = s->priv_data; int ret; - ret = avio_open2(&seg->list_pb, seg->list, AVIO_FLAG_WRITE, + snprintf(seg->temp_list_filename, sizeof(seg->temp_list_filename), seg->use_rename ? "%s.tmp" : "%s", seg->list); + ret = avio_open2(&seg->list_pb, seg->temp_list_filename, AVIO_FLAG_WRITE, &s->interrupt_callback, NULL); if (ret < 0) { av_log(s, AV_LOG_ERROR, "Failed to open segment list '%s'\n", seg->list); @@ -368,6 +372,8 @@ if (seg->list_type == LIST_TYPE_M3U8 && is_last) avio_printf(seg->list_pb, "#EXT-X-ENDLIST\n"); avio_closep(&seg->list_pb); + if (seg->use_rename) + ff_rename(seg->temp_list_filename, seg->list, s); } else { segment_list_print_entry(seg->list_pb, seg->list_type, &seg->cur_entry, s); avio_flush(seg->list_pb); @@ -644,9 +650,13 @@ else if (av_match_ext(seg->list, "ffcat,ffconcat")) seg->list_type = LIST_TYPE_FFCONCAT; else seg->list_type = LIST_TYPE_FLAT; } - if (!seg->list_size && seg->list_type != LIST_TYPE_M3U8) + if (!seg->list_size && seg->list_type != LIST_TYPE_M3U8) { if ((ret = segment_list_open(s)) < 0) goto fail; + } else { + const char *proto = avio_find_protocol_name(s->filename); + seg->use_rename = proto && !strcmp(proto, "file"); + } } if (seg->list_type == LIST_TYPE_EXT) av_log(s, AV_LOG_WARNING, "'ext' list type option is deprecated in favor of 'csv'\n"); diff -Nru ffmpeg-2.7.2/libavformat/srtdec.c ffmpeg-2.7.3/libavformat/srtdec.c --- ffmpeg-2.7.2/libavformat/srtdec.c 2015-06-19 22:44:53.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/srtdec.c 2015-11-19 03:14:20.000000000 +0100 @@ -41,9 +41,11 @@ ff_text_r8(&tr); /* Check if the first non-empty line is a number. We do not check what the - * number is because in practice it can be anything. */ + * number is because in practice it can be anything. + * Also, that number can be followed by random garbage, so we can not + * unfortunately check that we only have a number. */ if (ff_subtitles_read_line(&tr, buf, sizeof(buf)) < 0 || - strtol(buf, &pbuf, 10) < 0 || *pbuf) + strtol(buf, &pbuf, 10) < 0 || pbuf == buf) return 0; /* Check if the next line matches a SRT timestamp */ diff -Nru ffmpeg-2.7.2/libavformat/utils.c ffmpeg-2.7.3/libavformat/utils.c --- ffmpeg-2.7.2/libavformat/utils.c 2015-06-19 22:44:53.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/utils.c 2015-11-19 03:14:20.000000000 +0100 @@ -3068,7 +3068,7 @@ st->codec->time_base = st->time_base; } // only for the split stuff - if (!st->parser && !(ic->flags & AVFMT_FLAG_NOPARSE)) { + if (!st->parser && !(ic->flags & AVFMT_FLAG_NOPARSE) && st->request_probe <= 0) { st->parser = av_parser_init(st->codec->codec_id); if (st->parser) { if (st->need_parsing == AVSTREAM_PARSE_HEADERS) { diff -Nru ffmpeg-2.7.2/libavformat/webvttenc.c ffmpeg-2.7.3/libavformat/webvttenc.c --- ffmpeg-2.7.2/libavformat/webvttenc.c 2015-06-19 22:44:53.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/webvttenc.c 2015-11-19 03:14:20.000000000 +0100 @@ -46,8 +46,14 @@ static int webvtt_write_header(AVFormatContext *ctx) { AVStream *s = ctx->streams[0]; + AVCodecContext *avctx = ctx->streams[0]->codec; AVIOContext *pb = ctx->pb; + if (ctx->nb_streams != 1 || avctx->codec_id != AV_CODEC_ID_WEBVTT) { + av_log(ctx, AV_LOG_ERROR, "Exactly one WebVTT stream is needed.\n"); + return AVERROR(EINVAL); + } + avpriv_set_pts_info(s, 64, 1, 1000); avio_printf(pb, "WEBVTT\n"); diff -Nru ffmpeg-2.7.2/libavformat/xmv.c ffmpeg-2.7.3/libavformat/xmv.c --- ffmpeg-2.7.2/libavformat/xmv.c 2015-06-19 22:44:53.000000000 +0200 +++ ffmpeg-2.7.3/libavformat/xmv.c 2015-11-19 03:14:20.000000000 +0100 @@ -549,16 +549,17 @@ /* Fetch a video frame */ result = xmv_fetch_video_packet(s, pkt); - if (result) - return result; - } else { /* Fetch an audio frame */ result = xmv_fetch_audio_packet(s, pkt, xmv->current_stream - 1); - if (result) - return result; } + if (result) { + xmv->current_stream = 0; + xmv->video.current_frame = xmv->video.frame_count; + return result; + } + /* Increase our counters */ if (++xmv->current_stream >= xmv->stream_count) { diff -Nru ffmpeg-2.7.2/libavutil/channel_layout.c ffmpeg-2.7.3/libavutil/channel_layout.c --- ffmpeg-2.7.2/libavutil/channel_layout.c 2015-06-18 20:55:40.000000000 +0200 +++ ffmpeg-2.7.3/libavutil/channel_layout.c 2015-11-19 03:14:20.000000000 +0100 @@ -125,6 +125,8 @@ strlen(channel_names[i].name) == name_len && !memcmp(channel_names[i].name, name, name_len)) return (int64_t)1 << i; + + errno = 0; i = strtol(name, &end, 10); #if FF_API_GET_CHANNEL_LAYOUT_COMPAT @@ -143,14 +145,15 @@ } } else { #endif - if ((end + 1 - name == name_len && *end == 'c')) + if (!errno && (end + 1 - name == name_len && *end == 'c')) return av_get_default_channel_layout(i); #if FF_API_GET_CHANNEL_LAYOUT_COMPAT } #endif + errno = 0; layout = strtoll(name, &end, 0); - if (end - name == name_len) + if (!errno && end - name == name_len) return FFMAX(layout, 0); return 0; } diff -Nru ffmpeg-2.7.2/libavutil/common.h ffmpeg-2.7.3/libavutil/common.h --- ffmpeg-2.7.2/libavutil/common.h 2015-06-19 22:44:53.000000000 +0200 +++ ffmpeg-2.7.3/libavutil/common.h 2015-11-19 03:14:20.000000000 +0100 @@ -58,9 +58,24 @@ : ((a) + (1<<(b)) - 1) >> (b)) #define FFUDIV(a,b) (((a)>0 ?(a):(a)-(b)+1) / (b)) #define FFUMOD(a,b) ((a)-(b)*FFUDIV(a,b)) + +/** + * Absolute value, Note, INT_MIN / INT64_MIN result in undefined behavior as they + * are not representable as absolute values of their type. This is the same + * as with *abs() + * @see FFNABS() + */ #define FFABS(a) ((a) >= 0 ? (a) : (-(a))) #define FFSIGN(a) ((a) > 0 ? 1 : -1) +/** + * Negative Absolute value. + * this works for all integers of all types. + * As with many macros, this evaluates its argument twice, it thus must not have + * a sideeffect, that is FFNABS(x++) has undefined behavior. + */ +#define FFNABS(a) ((a) <= 0 ? (a) : (-(a))) + #define FFMAX(a,b) ((a) > (b) ? (a) : (b)) #define FFMAX3(a,b,c) FFMAX(FFMAX(a,b),c) #define FFMIN(a,b) ((a) > (b) ? (b) : (a)) diff -Nru ffmpeg-2.7.2/libavutil/file_open.c ffmpeg-2.7.3/libavutil/file_open.c --- ffmpeg-2.7.2/libavutil/file_open.c 2015-06-19 22:44:53.000000000 +0200 +++ ffmpeg-2.7.3/libavutil/file_open.c 2015-11-19 03:14:20.000000000 +0100 @@ -77,6 +77,9 @@ #ifdef O_CLOEXEC flags |= O_CLOEXEC; #endif +#ifdef O_NOINHERIT + flags |= O_NOINHERIT; +#endif fd = open(filename, flags, mode); #if HAVE_FCNTL diff -Nru ffmpeg-2.7.2/libavutil/log.c ffmpeg-2.7.3/libavutil/log.c --- ffmpeg-2.7.2/libavutil/log.c 2015-06-19 22:44:54.000000000 +0200 +++ ffmpeg-2.7.3/libavutil/log.c 2015-11-19 03:14:20.000000000 +0100 @@ -343,7 +343,7 @@ #if CONFIG_VALGRIND_BACKTRACE if (level <= BACKTRACE_LOGLEVEL) - VALGRIND_PRINTF_BACKTRACE(""); + VALGRIND_PRINTF_BACKTRACE("%s", ""); #endif end: av_bprint_finalize(part+3, NULL); diff -Nru ffmpeg-2.7.2/libswresample/swresample.c ffmpeg-2.7.3/libswresample/swresample.c --- ffmpeg-2.7.2/libswresample/swresample.c 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/libswresample/swresample.c 2015-11-19 03:14:20.000000000 +0100 @@ -643,7 +643,7 @@ return ret; if(ret) for(ch=0; chdither.noise.ch_count; ch++) - if((ret=swri_get_dither(s, s->dither.noise.ch[ch], s->dither.noise.count, 12345678913579<dither.noise.fmt))<0) + if((ret=swri_get_dither(s, s->dither.noise.ch[ch], s->dither.noise.count, (12345678913579ULL*ch + 3141592) % 2718281828U, s->dither.noise.fmt))<0) return ret; av_assert0(s->dither.noise.ch_count == preout->ch_count); diff -Nru ffmpeg-2.7.2/MAINTAINERS ffmpeg-2.7.3/MAINTAINERS --- ffmpeg-2.7.2/MAINTAINERS 2015-06-19 22:44:35.000000000 +0200 +++ ffmpeg-2.7.3/MAINTAINERS 2015-11-19 03:14:20.000000000 +0100 @@ -14,7 +14,6 @@ Project Leader ============== -Michael Niedermayer final design decisions diff -Nru ffmpeg-2.7.2/RELEASE ffmpeg-2.7.3/RELEASE --- ffmpeg-2.7.2/RELEASE 2015-07-20 03:22:52.000000000 +0200 +++ ffmpeg-2.7.3/RELEASE 2015-11-19 03:14:20.000000000 +0100 @@ -1 +1 @@ -2.7.2 +2.7.3 diff -Nru ffmpeg-2.7.2/tests/fate/acodec.mak ffmpeg-2.7.3/tests/fate/acodec.mak --- ffmpeg-2.7.2/tests/fate/acodec.mak 2015-06-19 22:44:54.000000000 +0200 +++ ffmpeg-2.7.3/tests/fate/acodec.mak 2015-11-19 03:14:20.000000000 +0100 @@ -103,7 +103,7 @@ fate-acodec-dca: SRC = tests/data/asynth-44100-2.wav fate-acodec-dca: CMD = md5 -i $(TARGET_PATH)/$(SRC) -c:a dca -strict -2 -f dts -flags +bitexact fate-acodec-dca: CMP = oneline -fate-acodec-dca: REF = fe28cef432ed88de4ee01b87537fd2bd +fate-acodec-dca: REF = c54ca9a13711755ef90fa143a9b38386 FATE_ACODEC-$(call ENCDEC, DCA, WAV) += fate-acodec-dca2 fate-acodec-dca2: CMD = enc_dec_pcm dts wav s16le $(SRC) -c:a dca -strict -2 -flags +bitexact diff -Nru ffmpeg-2.7.2/tests/fate/avformat.mak ffmpeg-2.7.3/tests/fate/avformat.mak --- ffmpeg-2.7.2/tests/fate/avformat.mak 2015-06-19 22:44:54.000000000 +0200 +++ ffmpeg-2.7.3/tests/fate/avformat.mak 2015-11-19 03:14:20.000000000 +0100 @@ -61,6 +61,7 @@ $(FATE_LAVF): $(AREF) $(VREF) $(FATE_LAVF): CMD = lavftest +$(FATE_LAVF): CMP = FATE_AVCONV += $(FATE_LAVF) fate-lavf: $(FATE_LAVF) diff -Nru ffmpeg-2.7.2/VERSION ffmpeg-2.7.3/VERSION --- ffmpeg-2.7.2/VERSION 2015-07-20 03:27:14.000000000 +0200 +++ ffmpeg-2.7.3/VERSION 2015-11-19 03:14:20.000000000 +0100 @@ -1 +1 @@ -2.7.2 +2.7.3