1. 05 Aug, 2019 1 commit
  2. 29 Sep, 2016 1 commit
  3. 18 Aug, 2016 1 commit
    • Anton Khirnov's avatar
      mss12: validate display dimensions · 6755eb5b
      Anton Khirnov authored
      The code currently reads the coded dimensions from the extradata, but
      expects the display dimensions to be set by the caller, and does not
      check that they are compatible (i.e. that the displayed size is smaller
      than the coded size).
      
      Make sure that when the display dimensions are set, they are also valid.
      Fixes possible invalid memory access.
      
      CC: libav-stable@libav.org
      Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
      6755eb5b
  4. 28 Feb, 2016 1 commit
    • Reimar Döffinger's avatar
      mss2: Fix buffer overflow. · 0f199f0a
      Reimar Döffinger authored
      Reported as https://trac.mplayerhq.hu/ticket/2264 but have
      not been able to reproduce with FFmpeg-only.
      I have no idea what coded_height is used for here exactly,
      so this might not be the best fix.
      Fixes the following chain of events:
      ff_mss12_decode_init sets coded_height while not setting height.
      ff_mpv_decode_init then copies coded_height into MpegEncContext height.
      This is then used by init_context_frame to allocate the data structures.
      However the wmv9rects are validated/initialized based on avctx->height, not
      avctx->coded_height.
      Thus the decode_wmv9 function will try to decode a larger video that we
      allocated data structures for, causing out-of-bounds writes.
      Signed-off-by: 's avatarReimar Döffinger <Reimar.Doeffinger@gmx.de>
      0f199f0a
  5. 17 Jan, 2015 1 commit
  6. 22 Mar, 2014 1 commit
  7. 24 Jan, 2013 1 commit
  8. 14 Oct, 2012 1 commit
  9. 03 Sep, 2012 3 commits
  10. 31 Aug, 2012 2 commits
  11. 27 Aug, 2012 2 commits
  12. 07 Aug, 2012 1 commit
  13. 15 Jul, 2012 1 commit
  14. 10 Jul, 2012 1 commit
  15. 27 Jun, 2012 2 commits
  16. 26 Jun, 2012 1 commit
  17. 25 Jun, 2012 2 commits
  18. 20 Jun, 2012 1 commit