From 8d0631c8fa890a1a01c7289c0bf8b2ff44fe5b9c Mon Sep 17 00:00:00 2001 From: Xi Wang Date: Sat, 19 Jan 2013 13:21:35 -0500 Subject: [PATCH 1/4] mpegvideo: fix loop condition in draw_line() The loop condition `x = ex' is incorrect. It should be `x <= ex'. This bug was introduced in commit c65dfac4 "mpegvideo.c: K&R formatting and cosmetics." CC:libav-stable@libav.org (cherry picked from commit 992b03183819553a73b4f870a710ef500b4eb6d0) Signed-off-by: Luca Barbato --- libavcodec/mpegvideo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c index 0b6ddb956c..10b13b552e 100644 --- a/libavcodec/mpegvideo.c +++ b/libavcodec/mpegvideo.c @@ -1658,7 +1658,7 @@ static void draw_line(uint8_t *buf, int sx, int sy, int ex, int ey, buf += sx + sy * stride; ex -= sx; f = ((ey - sy) << 16) / ex; - for (x = 0; x = ex; x++) { + for (x = 0; x <= ex; x++) { y = (x * f) >> 16; fr = (x * f) & 0xFFFF; buf[y * stride + x] += (color * (0x10000 - fr)) >> 16; From 01050448cfbc0ba5a3dc83138c44848692be7f9c Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Sun, 20 Jan 2013 05:10:32 +0100 Subject: [PATCH 2/4] get_bits: change the failure condition in init_get_bits Too much code relies in having init_get_bits fed with a valid buffer and set its dimension to 0. Check for NULL buffer instead. (cherry picked from commit 4603ec85ed620e585fc6e2e072c99858ed421855) Signed-off-by: Luca Barbato --- libavcodec/get_bits.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/get_bits.h b/libavcodec/get_bits.h index 12770a29a0..ffa065600b 100644 --- a/libavcodec/get_bits.h +++ b/libavcodec/get_bits.h @@ -375,7 +375,7 @@ static inline int init_get_bits(GetBitContext *s, const uint8_t *buffer, int buffer_size; int ret = 0; - if (bit_size > INT_MAX - 7 || bit_size <= 0) { + if (bit_size > INT_MAX - 7 || bit_size < 0 || !buffer) { buffer_size = bit_size = 0; buffer = NULL; ret = AVERROR_INVALIDDATA; From 1a28948eb3e5aaab1ed5dba7a9bc93b486995954 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Sun, 20 Jan 2013 14:48:35 +0100 Subject: [PATCH 3/4] videodsp_armv5te: remove #if HAVE_ARMV5TE_EXTERNAL libavutil/arm/asm.S sets '.arch' depending on HAVE_ARMV5TE so that assembling armv5te code will always succeed even if the default -march flag does not support it. HAVE_ARMV5TE_EXTERNAL tests assembling code with the default arch. Fixes the missing symbol ff_prefetch_arm with --cpu= not including armv5te. CC: libav-stable@libav.org --- libavcodec/arm/videodsp_armv5te.S | 2 -- 1 file changed, 2 deletions(-) diff --git a/libavcodec/arm/videodsp_armv5te.S b/libavcodec/arm/videodsp_armv5te.S index 96e92d5a73..120069db03 100644 --- a/libavcodec/arm/videodsp_armv5te.S +++ b/libavcodec/arm/videodsp_armv5te.S @@ -22,7 +22,6 @@ #include "config.h" #include "libavutil/arm/asm.S" -#if HAVE_ARMV5TE_EXTERNAL function ff_prefetch_arm, export=1 subs r2, r2, #1 pld [r0] @@ -30,4 +29,3 @@ function ff_prefetch_arm, export=1 bne ff_prefetch_arm bx lr endfunc -#endif From 62de693a17f9b107be7867d822d5accacd4be544 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Storsj=C3=B6?= Date: Wed, 23 Jan 2013 21:38:41 +0200 Subject: [PATCH 4/4] rtp: Make sure priv_data is set before reading it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes crashes with muxing H263 into RTSP. CC: libav-stable@libav.org Signed-off-by: Martin Storsjö (cherry picked from commit e90820d4f815c15796e642467cdddbad755212a2) Signed-off-by: Martin Storsjö --- libavformat/rtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/rtp.c b/libavformat/rtp.c index 38b2348d45..9a7d44b0b4 100644 --- a/libavformat/rtp.c +++ b/libavformat/rtp.c @@ -108,7 +108,7 @@ int ff_rtp_get_payload_type(AVFormatContext *fmt, for (i = 0; AVRtpPayloadTypes[i].pt >= 0; ++i) if (AVRtpPayloadTypes[i].codec_id == codec->codec_id) { if (codec->codec_id == AV_CODEC_ID_H263 && (!fmt || - !fmt->oformat->priv_class || + !fmt->oformat->priv_class || !fmt->priv_data || !av_opt_flag_is_set(fmt->priv_data, "rtpflags", "rfc2190"))) continue; /* G722 has 8000 as nominal rate even if the sample rate is 16000,