Signed-off-by: Diego Biurrun <diego@biurrun.de>

Rationale is the same as for video width/height etc.

ZeroCodec relies on the keyframe flag being set in the container, and
prev is the previously decoded frame. A keyframe flags incorrectly set
will lead to this condition.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

This fixes a number of unused-but-set gcc warnings.

libavcodec/dvdec.c:344:12: warning: assignment discards ‘const’ qualifier from pointer target type

Signed-off-by: Diego Biurrun <diego@biurrun.de>

This is logical and also fixes checking for the fourth plane offset.

Signed-off-by: Mans Rullgard <mans@mansr.com>

This is required for SIMD optimisations.
Signed-off-by: Mans Rullgard <mans@mansr.com>

Signed-off-by: Mans Rullgard <mans@mansr.com>

Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

Based on observations made by Jakub Stachowski <qbast@go2.pl>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

Wrong bit depth can lead to invalid rowsize values, which crashes the
decoder further down.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

CC: libav-stable@libav.org

The decoder assumes in various places that the image size
is a multiple of the block size, and there is no obvious
way to support odd sizes.  Bailing out early if the header
specifies a bad size avoids various errors later on.

Fixes CVE-2012-0947.
Signed-off-by: Mans Rullgard <mans@mansr.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Prevents illegal reads on truncated and malformed input.

CC: libav-stable@libav.org

Progressive data is allocated later in decode_sof(), not allocating
that data leads to NULL dereferences.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>

Prevents crashes because the old check was incomplete.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Fixes crashes in codepaths not covered by original checks.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

This prevents sample_rate/data_length from going negative, which
caused various crashes and undefined behaviour further down.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

This properly synchronizes frame size changes between threads if
subsequent threads abort decoding before frame size is initialized, i.e.
it prevents the thread after that from ping-ponging back to the original
value.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

Fixes a compile error with clang at -O0.

Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

The index of the motion vector has to be checked before being
multiplied by 2 for the array index.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

ModeTab.fmode has only 3 elements, so indexing it with ftype
in the initialier for 'size' is invalid when ftype == FT_PPC.

This fixes crashes with gcc 4.8.
Signed-off-by: Mans Rullgard <mans@mansr.com>

Reviewed-by: Mashiat Sarker Shakkhar <mashiat.sarker@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

This fixes decoding of frames which span more than two packets. Tested with
recit24.wma.
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>

Indexing outside array limits is invalid and breaks with gcc 4.8.
Signed-off-by: Mans Rullgard <mans@mansr.com>

Signed-off-by: Mans Rullgard <mans@mansr.com>

The shift parameter was removed from this interface in 7e1ce6a6.
This updates the Altivec implementation to match.
Signed-off-by: Mans Rullgard <mans@mansr.com>