* release/0.8:
matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
vorbis: Avoid some out-of-bounds reads
vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)
avserver: Fix a bug where the socket is IPv4, but IPv6 is autoselected for the loopback address.
vp3: fix streams with non-zero last coefficient
Update for 0.8.9
vp3: fix regression with mplayer-crash.ogv
h264: fix init of topleft ref/mv. Fixes Ticket778
Update for 0.8.8
Conflicts:
Doxyfile
RELEASE
VERSION
Merged-by: Michael Niedermayer <michaelni@gmx.at>
... | ... |
@@ -518,6 +518,7 @@ static int socket_open_listen(struct sockaddr_in *my_addr) |
518 | 518 |
tmp = 1; |
519 | 519 |
setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &tmp, sizeof(tmp)); |
520 | 520 |
|
521 |
+ my_addr->sin_family = AF_INET; |
|
521 | 522 |
if (bind (server_fd, (struct sockaddr *) my_addr, sizeof (*my_addr)) < 0) { |
522 | 523 |
char bindmsg[32]; |
523 | 524 |
snprintf(bindmsg, sizeof(bindmsg), "bind(port %d)", ntohs(my_addr->sin_port)); |
... | ... |
@@ -150,7 +150,7 @@ void ff_vorbis_ready_floor1_list(vorbis_floor1_entry * list, int values) |
150 | 150 |
} |
151 | 151 |
} |
152 | 152 |
|
153 |
-static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1, |
|
153 |
+static inline void render_line_unrolled(intptr_t x, uint8_t y, int x1, |
|
154 | 154 |
intptr_t sy, int ady, int adx, |
155 | 155 |
float *buf) |
156 | 156 |
{ |
... | ... |
@@ -173,7 +173,7 @@ static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1, |
173 | 173 |
} |
174 | 174 |
} |
175 | 175 |
|
176 |
-static void render_line(int x0, int y0, int x1, int y1, float *buf) |
|
176 |
+static void render_line(int x0, uint8_t y0, int x1, int y1, float *buf) |
|
177 | 177 |
{ |
178 | 178 |
int dy = y1 - y0; |
179 | 179 |
int adx = x1 - x0; |
... | ... |
@@ -183,10 +183,10 @@ static void render_line(int x0, int y0, int x1, int y1, float *buf) |
183 | 183 |
if (ady*2 <= adx) { // optimized common case |
184 | 184 |
render_line_unrolled(x0, y0, x1, sy, ady, adx, buf); |
185 | 185 |
} else { |
186 |
- int base = dy / adx; |
|
187 |
- int x = x0; |
|
188 |
- int y = y0; |
|
189 |
- int err = -adx; |
|
186 |
+ int base = dy / adx; |
|
187 |
+ int x = x0; |
|
188 |
+ uint8_t y = y0; |
|
189 |
+ int err = -adx; |
|
190 | 190 |
ady -= FFABS(base) * adx; |
191 | 191 |
while (++x < x1) { |
192 | 192 |
y += base; |
... | ... |
@@ -204,7 +204,8 @@ void ff_vorbis_floor1_render_list(vorbis_floor1_entry * list, int values, |
204 | 204 |
uint16_t *y_list, int *flag, |
205 | 205 |
int multiplier, float *out, int samples) |
206 | 206 |
{ |
207 |
- int lx, ly, i; |
|
207 |
+ int lx, i; |
|
208 |
+ uint8_t ly; |
|
208 | 209 |
lx = 0; |
209 | 210 |
ly = y_list[0] * multiplier; |
210 | 211 |
for (i = 1; i < values; i++) { |
... | ... |
@@ -1323,6 +1323,8 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag, |
1323 | 1323 |
return i; |
1324 | 1324 |
} |
1325 | 1325 |
} while (i < 64); |
1326 |
+ // return value is expected to be a valid level |
|
1327 |
+ i--; |
|
1326 | 1328 |
end: |
1327 | 1329 |
// the actual DC+prediction is in the fragment structure |
1328 | 1330 |
block[0] = frag->dc * s->qmat[0][inter][plane][0]; |
... | ... |
@@ -1169,7 +1169,6 @@ static void matroska_convert_tags(AVFormatContext *s) |
1169 | 1169 |
static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) |
1170 | 1170 |
{ |
1171 | 1171 |
EbmlList *seekhead_list = &matroska->seekhead; |
1172 |
- MatroskaSeekhead *seekhead = seekhead_list->elem; |
|
1173 | 1172 |
uint32_t level_up = matroska->level_up; |
1174 | 1173 |
int64_t before_pos = avio_tell(matroska->ctx->pb); |
1175 | 1174 |
uint32_t saved_id = matroska->current_id; |
... | ... |
@@ -1182,6 +1181,7 @@ static void matroska_execute_seekhead(MatroskaDemuxContext *matroska) |
1182 | 1182 |
return; |
1183 | 1183 |
|
1184 | 1184 |
for (i=0; i<seekhead_list->nb_elem; i++) { |
1185 |
+ MatroskaSeekhead *seekhead = seekhead_list->elem; |
|
1185 | 1186 |
int64_t offset = seekhead[i].pos + matroska->segment_start; |
1186 | 1187 |
|
1187 | 1188 |
if (seekhead[i].pos <= before_pos |