Browse code

Merge branch 'release/0.8' into release/0.7

* release/0.8:
matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
vorbis: Avoid some out-of-bounds reads
vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)
avserver: Fix a bug where the socket is IPv4, but IPv6 is autoselected for the loopback address.
vp3: fix streams with non-zero last coefficient
Update for 0.8.9
vp3: fix regression with mplayer-crash.ogv
h264: fix init of topleft ref/mv. Fixes Ticket778
Update for 0.8.8

Conflicts:
Doxyfile
RELEASE
VERSION

Merged-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2012/01/09 08:08:15
Showing 4 changed files
... ...
@@ -518,6 +518,7 @@ static int socket_open_listen(struct sockaddr_in *my_addr)
518 518
     tmp = 1;
519 519
     setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &tmp, sizeof(tmp));
520 520
 
521
+    my_addr->sin_family = AF_INET;
521 522
     if (bind (server_fd, (struct sockaddr *) my_addr, sizeof (*my_addr)) < 0) {
522 523
         char bindmsg[32];
523 524
         snprintf(bindmsg, sizeof(bindmsg), "bind(port %d)", ntohs(my_addr->sin_port));
... ...
@@ -150,7 +150,7 @@ void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values)
150 150
     }
151 151
 }
152 152
 
153
-static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1,
153
+static inline void render_line_unrolled(intptr_t x, uint8_t y, int x1,
154 154
                                         intptr_t sy, int ady, int adx,
155 155
                                         float *buf)
156 156
 {
... ...
@@ -173,7 +173,7 @@ static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1,
173 173
     }
174 174
 }
175 175
 
176
-static void render_line(int x0, int y0, int x1, int y1, float *buf)
176
+static void render_line(int x0, uint8_t y0, int x1, int y1, float *buf)
177 177
 {
178 178
     int dy  = y1 - y0;
179 179
     int adx = x1 - x0;
... ...
@@ -183,10 +183,10 @@ static void render_line(int x0, int y0, int x1, int y1, float *buf)
183 183
     if (ady*2 <= adx) { // optimized common case
184 184
         render_line_unrolled(x0, y0, x1, sy, ady, adx, buf);
185 185
     } else {
186
-        int base = dy / adx;
187
-        int x    = x0;
188
-        int y    = y0;
189
-        int err  = -adx;
186
+        int base  = dy / adx;
187
+        int x     = x0;
188
+        uint8_t y = y0;
189
+        int err   = -adx;
190 190
         ady -= FFABS(base) * adx;
191 191
         while (++x < x1) {
192 192
             y += base;
... ...
@@ -204,7 +204,8 @@ void ff_vorbis_floor1_render_list(vorbis_floor1_entry * list, int values,
204 204
                                   uint16_t *y_list, int *flag,
205 205
                                   int multiplier, float *out, int samples)
206 206
 {
207
-    int lx, ly, i;
207
+    int lx, i;
208
+    uint8_t ly;
208 209
     lx = 0;
209 210
     ly = y_list[0] * multiplier;
210 211
     for (i = 1; i < values; i++) {
... ...
@@ -1323,6 +1323,8 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
1323 1323
             return i;
1324 1324
         }
1325 1325
     } while (i < 64);
1326
+    // return value is expected to be a valid level
1327
+    i--;
1326 1328
 end:
1327 1329
     // the actual DC+prediction is in the fragment structure
1328 1330
     block[0] = frag->dc * s->qmat[0][inter][plane][0];
... ...
@@ -1169,7 +1169,6 @@ static void matroska_convert_tags(AVFormatContext *s)
1169 1169
 static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
1170 1170
 {
1171 1171
     EbmlList *seekhead_list = &matroska->seekhead;
1172
-    MatroskaSeekhead *seekhead = seekhead_list->elem;
1173 1172
     uint32_t level_up = matroska->level_up;
1174 1173
     int64_t before_pos = avio_tell(matroska->ctx->pb);
1175 1174
     uint32_t saved_id = matroska->current_id;
... ...
@@ -1182,6 +1181,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)
1182 1182
         return;
1183 1183
 
1184 1184
     for (i=0; i<seekhead_list->nb_elem; i++) {
1185
+        MatroskaSeekhead *seekhead = seekhead_list->elem;
1185 1186
         int64_t offset = seekhead[i].pos + matroska->segment_start;
1186 1187
 
1187 1188
         if (seekhead[i].pos <= before_pos