-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathChangelog
2636 lines (2523 loc) · 113 KB
/
Changelog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Entries are sorted chronologically from oldest to youngest within each release,
releases are sorted from youngest to oldest.
version 3.4.8:
avcodec/hevc_mp4toannexb_bsf: Check NAL size against available input
lavf/webm_chunk: Fix NULL dereference
avcodec/ttaenc: Fix undefined shift
fftools/ffmpeg: Free swresample dictionary during cleanup
avfilter/vf_xbr: Fix left shift of negative number
avfilter/vf_hqx: Fix undefined left shifts of negative numbers
avcodec/jpeg2000dwt: Fix undefined shifts of negative numbers
avcodec/ituh263dec: Fix undefined left shift of negative number
avcodec/dnxhdenc: Fix undefined left shifts of negative numbers
swscale/utils: Fix invalid left shifts of negative numbers
swscale/x86/swscale: Fix undefined left shifts of negative numbers
avcodec/exr: Fix undefined left shifts of negative numbers
avformat/movenc: Fix undefined shift
avcodec/pcm: Fix undefined shifts
avcodec/wavpackenc: Fix undefined shifts
avcodec/ac3enc: Fix invalid shift
avcodec/tdsc: Fix undefined shifts
fftools/ffmpeg_opt: Fix signed integer overflow
avformat/mov: Fix reel_name size check
avformat/mov: Fix memleak upon encountering repeating tags
avformat/matroskaenc: Don't use NULL for %s format string
avformat/webvttdec: Fix memleak upon read header failure
avformat/vplayerdec: Fix memleak upon read header failure
avformat/tedcaptionsdec: Fix memleak upon read header failure
avformat/subviewerdec: Fix memleak upon read header failure
avformat/subviewer1dec: Fix memleak upon read header failure
avformat/stldec: Fix memleak upon read header failure
avformat/srtdec: Fix memleak upon read header failure
avformat/sccdec: Fix memleak upon read header failure
avformat/samidec: Fix memleak upon read header failure
avformat/pjsdec: Fix memleak upon read header failure
avformat/mpsubdec: Fix memleak upon read header failure
avformat/mpl2dec: Fix memleak upon read header failure
avformat/microdvddec: Fix memleak upon read header failure
avformat/lrcdec: Fix memleak upon read header failure
avformat/jacosubdec: Fix memleak upon read header failure
avformat/assdec: Fix memleak upon read header failure
avformat/aqtitledec: Fix memleak upon read header failure
avformat/mov: Fix memleaks upon read_header failure
avformat/omadec: Fix memleaks upon read_header failure
avformat/matroskadec: Fix memleaks in WebM DASH manifest demuxer
avformat/matroskadec: Use right number of tracks
avformat/matroskadec: Fix handling gigantic durations
avformat/aviobuf: Don't check for overflow after it happened
avformat/matroskaenc: Fix memleak upon encountering bogus chapter
fftools/ffmpeg_opt: Check attachment filesize
avformat/webmdashenc: Check codec types
avformat/avidec: Fix memleak with embedded GAB2 subtitles
avformat/webmdashenc: Fix memleak upon realloc failure
avformat/matroskadec: Don't discard the upper 32bits of TrackNumber
avformat/hnm: Check for extradata allocation failure
avformat/subtitles: Don't increment packet counter prematurely
avformat/bethsoftvid: Fix potential memleak upon reallocation failure
avformat/smoothstreaming: Fix memleaks on errors
avformat/matroskaenc: Check BlockAdditional size before use
avformat/utils: Fix memleaks in avformat_open_input()
avcodec/cavsdsp: Fix undefined left shifts of negative numbers
avformat/hevc: Fix potential leak in case of ff_hevc_annexb2mp4_buf failure
avformat/matroskaenc: Check for reformatting errors
avcodec/ra144enc: Fix invalid left shift of negative number
avcodec/adxenc: Avoid undefined left shift of negative numbers
avcodec/adpcm: Fix undefined left shifts of negative numbers
avcodec/proresenc_anatoliy: Fix invalid left shift of negative number
avformat/wtvdec: Fix memleak when reading header fails
avformat/fitsdec: Fix potential leak of string in AVBPrint
avformat/mov: fix memleaks
libavformat/mov: Fix memleaks when demuxing DV audio
avcodec/bitstream: Don't check for undefined behaviour after it happened
avcodec/dstdec: Replace AC overread check by sample rate check
avformat/utils: reorder duration computation to avoid overflow
avcodec/pngdec: Check for fctl after idat
avformat/hls: Pass a copy of the URL for probing
avformat/hls: check segment duration value of EXTINF
avutil/common: Fix integer overflow in av_ceil_log2_c()
avcodec/wmalosslessdec: fix overflow with pred in revert_cdlms
avformat/mvdec: Fix integer overflow with billions of channels
avformat/microdvddec: skip malformed lines without frame number.
avformat/mxfdec: free duplicated utf16 strings
avformat/4xm: Check that a video stream was created before returning packets for it
avcodec/ffwavesynth: Avoid undefined operation on ts overflow
avcodec/mpeg4videodec: Fix 2 integer overflows in get_amv()
avcodec/lossless_audiodsp: Fix undefined overflows in scalarproduct_and_madd_int16_c()
avcodec/sonic: Fix several integer overflows
avcodec/pixlet: Fix log(0) check
avcodec/iff: Fix off by x error
avcodec/wmalosslessdec: Check block_align maximum
avcodec/loco: Fix signed integer overflow in loco_get_rice()
avformat/thp: Check fps
avformat/mpl2dec: Fix integer overflow with duration
avcodec/mpeg12dec: remove outdated comments
avcodec/snowdec: Avoid integer overflow with huge qlog
avformat/mov: Check if DTS is AV_NOPTS_VALUE in mov_find_next_sample().
avcodec/mpeg12dec: Fix got_output
avformat/4xm: Cleanup on GET_LIST_HEADER() failure
avcodec/lzf: Consider the needed size in reallocation
avformat/mlvdec: fail reading a packet with 0 streams
avformat/thp: Check compcount
avcodec/adpcm: XA: Check shift similar to filter
avcodec/huffyuvdec: Test vertical coordinate more often
avcodec/hq_hqa: Check info size
avcodec/wmalosslessdec: Fix integer overflow in mclms_predict()
avcodec/vp9dsp_template: Fix integer overflow(s) in iadst16_1d()
avcodec/h264dec: Disable forced small_padding on flag2 fast
avformat/oggparsevorbis: Error out on double init of vp
avcodec/pnmdec: Use unsigned for maxval rescaling
avcodec/ivi: Clear got_p_frame before decoding a new frame using it
avcodec/dsddec: Check channels
avcodec/xvididct: Fix integer overflow in idct_row()
avcodec/wmalosslessdec: Fix integer overflows in revert_inter_ch_decorr()
avformat/mpegenc: Fix integer overflow with AV_NOPTS_VALUE
avformat/swfenc: Fix integer overflow in frame rate handling
avformat/aadec: Check toc_size to contain the minimum to demuxer uses
avformat/mov: Don't allow negative sample sizes.
mpeg4videoenc: Don't crash with -fsanitize=bounds
avformat/mpegts: Shuffle avio_seek
avcodec/binkaudio: Fix 2Ghz sample_rate
avcodec/adpcm: Fix integer overflow in ADPCM THP
avcodec/ralf: Check num_blocks before use
avcodec/iff: Test video_size being non zero
avcodec/utvideodec: Fix integer overflow in decode_plane()
avcodec/ttadsp: Fix several integer overflows in tta_filter_process_c()
avcodec/ralf: Fix integer overflow in decode_block()
avcodec/nuv: widen buf_size type
avcodec/iff: Fix several integer overflows
avcodec/g729postfilter: Clip gain before scaling with AGC_FAC1
avcodec/alac: Fix integer overflow with 24/20bps samples
avcodec/dstdec: Check sample rate
avformat/thp: Require a video stream
avformat/mpeg: Decrease score by 1 for files with very little valid data
avcodec/pngdec: Check length in fdAT
avcodec/g2meet: Check tile_width in epic_jb_decode_tile()
avcodec/vp9dsp_template: Fix integer overflows in idct32_1d()
avcodec/alacdsp: Fix invalid shift in append_extra_bits()
libavcodec/wmalosslessdec: prevent sum of positive numbers from becoming negative
avcodec/dstdec: Fix integer overflow in read_table()
avcodec/txd: Check for input size against the header size.
avcodec/svq1dec: Check that there is data left after the header
avcodec/intrax8: Check for end of bitstream in ff_intrax8_decode_picture()
avcodec/hevc_mp4toannexb_bsf: Check nalu_size
avcodec/iff: Check length before memcpy() in decode_deep_rle32()
avcodec/iff: Fix invalid pointer intermediates in decode_deep_rle32()
avcodec/pngdec: Pass ret from decode_iccp_chunk()
avcodec/rv40dsp: Fix integer overflows in rv40_weight_func_*()
avcodec/ac3dec_fixed: Fix several invalid left shifts in scale_coefs()
avcodec/flac_parser: Do not lose header count in find_headers_search()
avcodec/audiodsp: Fix integer overflow in scalarproduct_int16_c()
avformat/oggdec: Check for EOF after page header
swscale/yuv2rgb: Fix vertical dither offset with slices
avcodec/dpcm: clip exponent into supported range in XAN DPCM
avcodec/flacdsp_template: Fix invalid shifts in decorrelate
avcodec/xvididct: Fix integer overflow in MULT()
avcodec/ffwavesynth: Correct undefined overflow of PINK_UNIT
swscale/output: Fix integer overflow in yuv2rgb_write_full() with out of range input
swscale/output: Fix integer overflow in alpha computation in yuv2gbrp16_full_X_c()
libavformat/amr.c: Check return value from avio_read()
libavformat/mov.c: Free aes_decrypt to avoid leaking memory
libavformat/oggdec.c: Check return value from avio_read()
avformat/asfdec_f: Fix overflow check in get_tag()
avformat/nsvdec: Fix memleaks on errors while reading the header
avcodec/ffwavesynth: Fix integer overflow in computation of ddphi
avcodec/adpcm: Fix invalid shift in AV_CODEC_ID_ADPCM_PSX
avcodec/mpeg12dec: Fix invalid shift in mpeg2_fast_decode_block_intra()
avcodec/mpegaudioenc_template: fix invalid shift of sample
avcodec/motion_est_template: Fix invalid shifts in no_sub_motion_search()
libavformat/avienc: Check bits per sample for PAL8
avformat/mpegts: Improve the position determination for avpriv_mpegts_parse_packet()
avcodec/magicyuv: Check that there are enough lines for interlacing to be possible
avformat/mvdec: Check stream numbers
avcodec/pcm: Fix invalid shift in AV_CODEC_ID_PCM_LXF
avcodec/qdm2: Check fft_coefs_index
avformat/utils: Fix integer overflow with complex time bases in avformat_find_stream_info()
avformat/avidec: Avoid integer overflow in NI switch check
fftools/ffmpeg: Fix integer overflow in duration computation in seek_to_start()
avfilter/vf_aspect: Fix integer overflow in compute_dar()
avcodec/apedec: Fix invalid shift with 24 bps
avformat/utils: Fix undefined behavior in ff_configure_buffers_for_index()
avcodec/dpcm: Fix integer overflow in AV_CODEC_ID_GREMLIN_DPCM
avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits
avcodec/wmalosslessdec: Fix loop in revert_acfilter()
avcodec/lagarith: Sanity check scale
avcodec/apedec: Fix integer overflows in predictor_decode_mono_3950()
avcodec/ralf: Fix integer overflow in apply_lpc()
avcodec/dca_lbr: Fix some error codes and error passing
avcodec/wmavoice: Fix rounding and integer anomalies in calc_input_response()
avcodec/wmavoice: sanity check block_align
avcodec/pcm: Fix invalid shift in pcm_decode_frame for LXF
avcodec/snappy: Sanity check bytestream2_get_levarint()
avcodec/mlpdsp: Fix a invalid shift in ff_mlp_rematrix_channel()
avcodec/avdct: Clear IDCTDSPContext context
avcodec/x86/diracdsp: Fix high bits on Windows x86_64
avformat/mov: Check STCO location
avcodec/wmalosslessdec: Fix multiple integer overflows
avcodec/apedec: Fix undefined integer overflow in decode_array_0000()
avcodec/smacker: Check space before decoding type
avcodec/rawdec: Use linesize in b64a
avcodec/iff: Over-allocate ham_palbuf for HAM6 IFF-PBM
avcodec/x86/diracdsp: Fix incorrect src addressing in dequant_subband_32()
avfilter/vf_find_rect: Remove assert
avfilter/vf_find_rect: Increase worst case score
swscale/input: Fix several invalid shifts related to rgb2yuv constants
swscale/output: Fix several invalid shifts in yuv2rgb_full_1_c_template()
swscale/swscale: Fix several invalid shifts related to vChrDrop
avcodec/hevc_mp4toannexb_bsf: check that nalu size doesnt overflow
avcodec/hevc_mp4toannexb_bsf: Avoid NULL memcpy()
avcodec/wmalosslessdec: move channel check up
avcodec/adpcm: Fix overflow in FFABS() IMA_EA_EACS
avcodec/alac: Fix integer overflow in LPC coefficient adaption
avcodec/g729postfilter: Optimize out overflowing multiplication from apply_tilt_comp()
avcodec/vc1dec: Check field_mode for sprites
avcodec/vc1dec: Limit bits by the actual bitstream size
avcodec/vmdaudio: Check block_align more
configure: bump year
avcodec/pgssubdec: Free subtitle on error
avcodec/ffwavesynth: Fix undefined overflow in wavesynth_synth_sample()
avcodec/cook: Use 3 stage VLC decoding for channel_coupling
avcodec/wmalosslessdec: Fixes undefined overflow in dequantization in decode_subframe()
avcodec/sonic: Check e in get_symbol()
avcodec/twinvqdec: Correct overflow in block align check
avcodec/vc1dec: Fix "return -1" cases
avcodec/vc1dec: Free sprite_output_frame on error
avcodec/wmadec: Keep track of exponent initialization per channel
avcodec/iff: Check that video_size is large enough for the read parameters
avcodec/adpcm: Clip predictor for APC
avcodec/targa: Check colors vs. available space
avcodec/dstdec: Use get_ur_golomb_jpegls()
avcodec/wmavoice: Check remaining input in parse_packet_header()
avcodec/wmalosslessdec: Fix 2 overflows in mclms
avcodec/wmaprodec: Fixes integer overflow with 32bit samples
avcodec/adpcm: Fix invalid shift in xa_decode()
avcodec/wmalosslessdec: Fix several integer issues
avcodec/wmalosslessdec: Check that padding bits is not more than sample bits
avcodec/iff: Skip overflowing runs in decode_delta_d()
avcodec/pnm: Check that the header is not truncated
avcodec/mp3_header_decompress_bsf: Check sample_rate_index
avformat/rmdec: Initialize and sanity check offset in ivr_read_header()
avcodec/apedec: Fix 2 integer overflows
avcodec/wmaprodec: Set packet_loss when we error out on a sanity check
avcodec/wmaprodec: Check offset
avcodec/truemotion2: Fix 2 integer overflows in tm2_low_res_block()
avcodec/wmaprodec: Check if the channel sum of all internal contexts match the external
libavcodec/libvpxenc: Don't free user-provided AVPacket
libavcodec/libmp3lame: Don't free user-provided AVPacket
avcodec/libopusenc: Don't free user-provided AVPacket
avformat/matroskadec: Fix default value of BlockAddID
version 3.4.7:
- avcodec/g729dec: require buf_size to be non 0
- avcodec/alac: Fix integer overflow in lpc_prediction() with sign
- avcodec/wmaprodec: Fix buflen computation in save_bits()
- avcodec/vc1_block: Fix integer overflow in AC rescaling in vc1_decode_i_block_adv()
- avcodec/vmdaudio: Check chunk counts to avoid integer overflow
- avformat/mxfdec: Clear metadata_sets_count in mxf_read_close()
- avcodec/nuv: Use ff_set_dimensions()
- avcodec/ffwavesynth: Fix integer overflow with pink_ts_cur/next
- avcodec/ralf: Fix integer overflows with the filter coefficient in decode_channel()
- avcodec/g729dec: Use 64bit and clip in scalar product
- avcodec/mxpegdec: Check for multiple SOF
- avcodec/nuv: Move comptype check up
- avcodec/wmavoice: Fix integer overflow in synth_frame()
- avcodec/rawdec: Check bits_per_coded_sample more pedantically for 16bit cases
- avutil/lfg: Correct index increment type to avoid undefined behavior
- avcodec/cngdec: Remove AV_CODEC_CAP_DELAY
- avcodec/iff: Move index use after check in decodeplane8()
- avcodec/atrac3: Check for huge block aligns
- avcodec/ralf: use multiply instead of shift to avoid undefined behavior in decode_block()
- avcodec/wmadec: Require previous exponents for reuse
- avcodec/vc1_block: Fix undefined behavior in ac prediction rescaling
- avcodec/qdm2: The smallest header seems to have 2 bytes so treat 1 as invalid
- avcodec/apedec: Fixes integer overflow of res+*data in do_apply_filter()
- avcodec/sonic: Fix integer overflow in predictor_calc_error()
- avformat/mp3dec: Check that the frame fits within the probe buffe
- lavc/tableprint_vlc: Remove avpriv_request_sample() from included files.
- avcodec/wmaprodec: get frame during frame decode
- avcodec/interplayacm: Fix overflow of last unused value
- avcodec/adpcm: Fix undefined behavior with negative predictions in IMA OKI
- avcodec/cook: Move up and extend block_align check
- avcodec/twinvq: Check block_align
- avcodec/cook: Enlarge gain table
- avcodec/cook: Check samples_per_channel earlier
- avcodec/atrac3plus: Check split point in fill mode 3
- avcodec/wmavoice: Check sample_rate
- avcodec/xsubdec: fix overflow in alpha handling
- avcodec/iff: Check available space before entering loop in decode_long_vertical_delta2() / decode_long_vertical_delta()
- avcodec/apedec: Fix integer overflow in filter_3800()
- avutil/lfg: Document the AVLFG struct
- avcodec/ffv1dec: Use a different error message for the slice level CRC
- avcodec/apedec: Fix undefined integer overflow in long_filter_ehigh_3830()
- avcodec/dstdec: Check that AC probabilities are within range
- avcodec/dstdec: Check read_table() for failure
- avcodec/snowenc: Set mb_num to avoid ratecontrol floating point divisions by 0.0
- avcodec/snowenc: Fix 2 undefined shifts
- avformat/nutenc: Do not pass NULL to memcmp() in get_needed_flags()
- avcodec/aacdec_template: Check samplerate
- avcodec/truemotion2: Fix several integer overflows in tm2_low_res_block()
- avcodec/utils: Check block_align
- avcodec/wmalosslessdec: Fix some integer anomalies
- avcodec/adpcm: Fix invalid shifts in ADPCM DTK
- avcodec/apedec: Only clear the needed buffer space, instead of all
- avcodec/libvorbisdec: Fix insufficient input checks leading to out of array reads
- avcodec/g723_1dec: fix invalid shift with negative sid_gain
- avcodec/vp5: Check render_x/y
- avcodec/qdrw: Check input for header/skiped space before get_buffer()
- avcodec/ralf: Skip initializing unused filter variables
- avcodec/takdec: Fix overflow with large sample rates
- avcodec/alsdec: Check that input space for header exists in read_diff_float_data()
- avformat/pjsdec: Check duration for overflow
- avcodec/ptx: Check that the input contains at least one line
- avcodec/alac: Fix integer overflow in LPC
- avcodec/smacker: Fix integer overflows in pred[] in smka_decode_frame()
- avcodec/aliaspixdec: Check input size against minimal picture size
- avcodec/ffwavesynth: Fix integer overflows in pink noise addition
- avcodec/vc1_block: Fixes integer overflow in vc1_decode_i_block_adv()
- avcodec/wmalosslessdec: Check block_align
- avcodec/g729postfilter: Fix left shift of negative value
- avcodec/binkaudio: Check sample rate
- avcodec/adpcm: Check initial predictor for ADPCM_IMA_EA_EACS
- avcodec/g723_1dec: Fix overflow in shift
- avcodec/apedec: Fix integer overflow in predictor_update_3930()
- avcodec/g729postfilter: Fix undefined intermediate pointers
- avcodec/g729postfilter: Fix undefined shifts
- avcodec/lsp: Fix undefined shifts in lsp2poly()
- avcodec/adpcm: Fix left shifts in AV_CODEC_ID_ADPCM_EA
- avformat/shortendec: Check k in probe
- avfilter/vf_geq: Use av_clipd() instead of av_clipf()
- avcodec/wmaprodec: Check that the streams channels do not exceed the overall channels
- avcodec/qdmc: Check input space in qdmc_get_vlc()
- avcodec/pcm: Check bits_per_coded_sample
- avcodec/exr: Allow duplicate use of channel indexes
- avcodec/fitsdec: Fail on 0 naxisn
- avcodec/ituh263dec: Check input for minimal frame size
- avcodec/truemotion1: Check that the input has enough space for a minimal index_stream
- avformat/mpsubdec: Clear queue on error
- avcodec/sunrast: Check that the input is large enough for the maximally compressed image
- avcodec/sunrast: Check for availability of maplength before allocating image
- avformat/subtitles: Check nb_subs in ff_subtitles_queue_finalize()
- avcodec/wmaprodec: Check if there is a stream
- avcodec/g2meet: Check for end of input in jpg_decode_block()
- avcodec/g2meet: Check if adjusted pixel was on the stack
- avformat/electronicarts: If no packet has been read at the end do not treat it as if theres a packet
- avcodec/utils: Check sample_rate before opening the decoder
- avcodec/fitsdec: fix use of uninitialised values
- avcodec/motionpixels: Mark 2 functions as always_inline
- avcodec/ralf: Fix integer overflow in decode_channel()
- vcodec/vc1: compute rangex/y only for P/B frames
- avcodec/vc1_pred: Fix invalid shifts in scaleforopp()
- avcodec/vc1_block: Fix invalid shift with rangeredfrm
- avcodec/vc1: Check for excessive resolution
- avcodec/vc1: check REFDIST
- avcodec/apedec: Fix several integer overflows in predictor_update_filter() and do_apply_filter()
- avcodec/hevc_cabac: Tighten the limit on k in ff_hevc_cu_qp_delta_abs()
- avcodec/4xm: Check index in decode_i_block() also in the path where its not used.
- avcodec/atrac3: Check block_align
- avcodec/alsdec: Avoid dereferencing context pointer in inner interleave loop
- avcodec/fitsdec: Prevent division by 0 with huge data_max
- avcodec/dstdec: Fix integer overflow in samples_per_frame computation
- avcodec/g729_parser: Check block_size
- avcodec/utils: Optimize ff_color_frame() using memcpy()
- avcodec/aacdec: Check if we run out of input in read_stream_mux_config()
- avcodec/utils: Use av_memcpy_backptr() in ff_color_frame()
- avcodec/smacker: Fix integer overflow in signed int multiply in SMK_BLK_FILL
- avcodec/alac: Fix invalid shifts in 20/24 bps
- avcodec/alac: fix undefined behavior with INT_MIN in lpc_prediction()
- avcodec/ffwavesynth: Fix integer overflow in timestamps
- avcodec/adpcm: Check number of channels for MTAF
- avcodec/sunrast: Fix indention
- avcodec/sunrast: Fix return type for "unsupported (compression) type"
- avformat/mov: Check for EOF in mov_read_meta()
- avcodec/hevcdec: Fix memleak of a53_caption
- avformat/cdxl: Fix integer overflow in intermediate
- avcodec/hevcdec: repeat character in skiped
- avcodec/gdv: Replace assert() checking bitstream by if()
- libavcodec/utils: Free threads on init failure
- avcodec/htmlsubtitles: Avoid locale dependant isdigit()
- avcodec/alsdec: Check k from being outside what our implementation can handle
- avcodec/takdec: Fix integer overflow in decorrelate()
- avcodec/aacps: Fix integer overflows in hybrid_synthesis()
- avcodec/vp56rac: delay signaling an error on truncated input
- avcodec/vp5/6/8: use vpX_rac_is_end()
- avcodec/vp56: Add vpX_rac_is_end() to check for the end of input
- avcodec/qdm2: Check frame size
- avcodec/vc1_pred: Fix refdist in scaleforopp()
- avcodec/vorbisdec: fix FASTDIV usage for vr_type == 2
- avcodec/iff: Check for overlap in cmap_read_palette()
- avcodec/apedec: Fix 32bit int overflow in do_apply_filter()
- avcodec/ralf: fix undefined shift in extend_code()
- avcodec/ralf: fix undefined shift
- avcodec/bgmc: Check input space in ff_bgmc_decode_init()
- avcodec/truemotion2: Fix multiple integer overflows in tm2_null_res_block()
- avcodec/vc1dec: Require res_sprite for wmv3images
- avcodec/vc1_block: Check for double escapes
- avcodec/vorbisdec: Check get_vlc2() failure
- avcodec/tta: Fix integer overflow in prediction
- avcodec/vb: Check input packet size to be large enough to contain flags
- avcodec/cavsdec: Limit the number of access units per packet to 2
- avcodec/alac: Check for bps of 0
- avcodec/alac: Fix multiple integer overflows in lpc_prediction()
- avcodec/rl2: set dimensions
- avcodec/aacdec: Add FF_CODEC_CAP_INIT_CLEANUP
- avcodec/idcinvideo: Add 320x240 default maximum resolution
- avformat/realtextdec: free queue on error
- avcodec/alsdec: Fix integer overflow in decode_var_block_data()
- avcodec/alsdec: Limit maximum channels to 512
- avcodec/anm: Check input size for a frame with just a stop code
- avcodec/flicvideo: Optimize and Simplify FLI_COPY in flic_decode_frame_24BPP() by using bytestream2_get_buffer()
- avcodec/loco: Check left column value
- avcodec/ffwavesynth: Fixes invalid shift with pink noise seeking
- avcodec/ffwavesynth: Fix integer overflow for some corner case values
- avcodec/indeo2: Check remaining input more often
- avcodec/diracdec: Check that slices are fewer than pixels
- avcodec/vp56: Consider the alpha start as end of the prior header
- avcodec/4xm: Check for end of input in decode_p_block()
- avcodec/hevcdec: Check delta_luma_weight_l0/1
- avcodec/hnm4video: Optimize postprocess_current_frame()
- avcodec/hevc_refs: Optimize 16bit generate_missing_ref()
- avcodec/scpr: Use av_memcpy_backptr() in type 17 and 33
- avcodec/dds: Use ff_set_dimensions()
- avcodec/mpc8: Fix 32bit mask/enum
- avcodec/alsdec: Fix integer overflows of raw_samples in decode_var_block_data()
- avcodec/alsdec: Fix integer overflow of raw_samples in decode_blocks()
- avcodec/alsdec: fix mantisse shift
- avcodec/aacdec_template: fix integer overflow in imdct_and_windowing()
- libavcodec/iff: Use unsigned to avoid undefined behaviour
- avcodec/alsdec: Check for block_length <= 0 in read_var_block_data()
- avcodec/vqavideo: Set video size
- avcodec/sanm: Check extradata_size before allocations
- avcodec/mss1: check for overread and forward errors
- avcodec/dirac_parser: Fix overflow in dts
- avcodec/ralf: Fix undefined pointer in decode_channel()
- avcodec/ralf: Fix integer overflow in apply_lpc()
- avcodec/vorbisdec: Implement vr->classifications = 1
- avcodec/vorbisdec: Check parameters in vorbis_floor0_decode() before divide
- avformat/realtextdec: Check for duplicate extradata in realtext_read_header()
- avcodec/apedec: Fix 2 signed overflows
- avcodec/mss3: Check for the rac stream being invalid in rac_normalize()
- avcodec/vc1_block: Check get_vlc2() return before use
- avcodec/apedec: Do not partially clear data array
- avcodec/hnm4video: Forward errors of decode_interframe_v4()
- avcodec/vp3: Check that theora is theora
- avcodec/vc1_pred: Fix invalid shift in scaleforsame()
- avcodec/vc1_block: Fix integer overflow in ff_vc1_pred_dc()
- avcodec/truemotion2: Fix several integer overflows in tm2_motion_block()
- avcodec/apedec: make left/right unsigned to avoid undefined behavior
- avcodec/apedec: Fix multiple integer overflows and undefined behaviorin filter_3800()
- avformat/mpc: deallocate frames array on errors
- avcodec/eatqi: Check for minimum frame size
- avcodec/eatgv: Check remaining size after the keyframe header
- avcodec/assdec: undefined use of memcpy()
- avcodec/brenderpix: Check input size before allocating image
- lafv/wavdec: Fail bext parsing on incomplete reads
- avcodec/utils: fix leak of subtitle_header on error path
- avcodec/utils: Check close before calling it
- avcodec/vorbisdec: Check vlc for floor0 dec vector offset
- avcodec/vorbisdec: amplitude bits can be more than 25 bits
- avutil/softfloat_ieee754: Fix odd bit position for exponent and sign in av_bits2sf_ieee754()
- avcodec/apedec: Fix various integer overflows
- avcodec/apedec: Fix multiple integer overflows in predictor_update_filter()
- avcodec/alsdec: fix undefined shift in multiply()
- avcodec/alsdec: Fix 2 integer overflows
- avcodec/flicvideo: Make line_packets int
- avcodec/dvbsubdec: Use ff_set_dimensions()
- avcodec/ffwavesynth: Check if there is enough extradata before allocation
- avcodec/ffwavesynth: More correct cast in wavesynth_seek()
- avcodec/ffwavesynth: Check sample rate before use
- avcodec/dnxhd_parser: Fix parser when input does not have nicely sized packets
- avcodec/dnxhd_parser: remove unneeded code
- avformat/utils: Check rfps_duration_sum for overflow
- avcodec/h264_refs: Also check reference in ff_h264_build_ref_list()
- avcodec/parser: Check next index validity in ff_combine_frame()
- avcodec/ivi: Ask for samples with odd tiles
- avformat/xmv: Make bitrate 64bit
- avcodec/pngdec: Check that previous_picture has same w/h/format
- avcodec/huffyuv: remove gray8a (the format is listed but not supported by the implementation)
- avcodec/mpc8: Fixes invalid shift in mpc8_decode_frame()
- avcodec/utils, avcodec_open2: close codec on failure
- avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
- avformat/utils: Check timebase before use in estimate_timings()
- avcodec/hq_hqa: Use ff_set_dimensions()
- avcodec/rv10: Fix integer overflow in aspect ratio compare
- avcodec/4xm: Fix signed integer overflows in idct()
- avcodec/qdm2: Check checksum_size for 0
- avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
- avcodec/qdm2: Do not read out of array in fix_coding_method_array()
- avcodec/svq3: Use ff_set_dimension()
- avcodec/iff: Check ham vs bpp
- avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
- avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
- avcodec/ffwavesynth: Fix backward lcg_seek()
- avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
- avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
- avcodec/alac: Check lpc_quant
- avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
- avcodec/alsdec: Fix integer overflow with buffer number
- avcodec/alsdec: Fixes signed integer overflow in LSB addition
- avcodec/alsdec: Check opt_order / sb_length in ra_block handling
- avcodec/alsdec: Fix integer overflow with shifting samples
- avcodec/alsdec: Fix undefined behavior in decode_rice()
- avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
- avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight
- avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns
- avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
- avformat/aviobuf: Delay buffer downsizing until asserts are met
- avcodec/fitsdec: Check data_min/max
- avcodec/m101: Fix off be 2 error
- avcodec/qdm2: Move fft_order check up
- avcodec/libvorbisdec: Check extradata size
- avformat/vqf: Check header_size
- avcodec/utils: Check bits_per_coded_sample
- avcodec/videodsp_template: Fix overflow of addition
- avcodec/alsdec: Fix invalid shift in multiply()
- avcodec/ffwavesynth: Check ts_end - ts_start for overflow
- avcodec/vc1dsp: Avoid undefined shifts in vc1_v_s_overlap_c / vc1_h_s_overlap_c
- avcodec/tta: Fix undefined shift
- avcodec/qdmc: Fix integer overflows in PRNG
- avcodec/bintext: Check font height
- avcodec/binkdsp: Fix integer overflows in idct
- avcodec/motionpixels: Check for vlc error in mp_get_vlc()
- avcodec/loco: Limit lossy parameter so it is sane and does not overflow
- avformat/mov: Set fragment.found_tfhd only after TFHD has been parsed
- avcodec/xpmdec: Do not use context dimensions as temporary variables
- avcodec/fitsdec: Fix division by 0 in size check
- avcodec/aacpsdsp_template: Fix integer overflow in ps_hybrid_analysis_c()
- avcodec/truemotion2: Fix integer overflow in last loop in tm2_update_block()
- avcodec/iff: finetune the palette size check in the mask case
- avcodec/iff: Fix mask_buf / mask_palbuf leak
- avformat/icodec: Free ico->images on error paths
- avformat/wsddec: Fix undefined shift
- avcodec/fmvc: Check if header fields are available before allocating the image
- avcodec/bink: Reorder operations in init to avoid memleak on error
- avformat/wtvdec: Avoid (32bit signed) sectors
- avcodec/bitstream: Check for more conflicting codes in build_table()
- avcodec/bitstream: Check for integer code truncation in build_table()
- avformat/sbgdec: Fixes integer overflow in str_to_time() with hours
- avformat/vpk: Check offset for validity
- avformat/vpk: Fix integer overflow in samples_per_block computation
- avcodec/mjpegdec: Check for non ls PAL8
- avcodec/interplayvideo: check decoding_map_size with video_data_size
- avcodec/h264_parse: Use 64bit for expectedpoc and expected_delta_per_poc_cycle
- avcodec/mss4: Check input size against skip bits
- avcodec/diracdec: Fix integer overflow in global_mv()
- avcodec/vmnc: Check available space against chunks before reget_buffer()
- avcodec/aacdec_template: skip apply_tns() if max_sfb is 0 (from previous header decode failure)
- avcodec/aacdec_fixed: Handle more extreem cases in noise_scale()
- avcodec/aacdec_template: Merge 3 #ifs related to noise handling
- avcodec/aacdec_fixed: ssign seems always -1 in noise_scale(), simplify
- avformat/mp3enc: Avoid SEEK_END as it is unsupported
- avcodec/truemotion2: Fix several integer overflows in tm2_update_block()
- avformat/webm_chunk: Specify expected argument length of get_chunk_filename()
- avformat/webm_chunk: Check header filename length
- avcodec/cpia: Check input size also against linesizes and EOL
- swscale/tests/swscale: Lengthen pixfmt name buffer to 21 bytes
- libswcale: Fix possible string overflow in test.
- avcodec/hq_hqa: Check available space before reading slice offsets
- lavf/webm_chunk: Respect buffer size
- avcodec/fits: Check bitpix
- avcodec/jvdec: Use ff_get_buffer() when the content is not reused
- avcodec/truemotion2: Fix 2 integer overflows in tm2_update_block()
- avcodec/jpeg2000: Check stepsize before using it
- avcodec/aacdec_fixed: Fix undefined shift in noise_scale()
- avutil/avstring: Fix bug and undefined behavior in av_strncasecmp()
- avformat/mov: Skip stsd adjustment without chunks
- avformat/aadec: Check for scanf() failure
- avcodec/ccaption_dec: Add a blank like at the end to avoid rollup reading from outside
- avcodec/ivi: Move buffer/block end check to caller of ivi_dc_transform()
- avcodec/diracdec: Use 64bit in intermediate of global motion vector field generation
- avcodec/truemotion2: Fix integer overflow in tm2_decode_blocks()
- avcodec/rscc: Check that the to be uncompressed input is large enough
- avcodec/bsf: check that AVBSFInternal was allocated before dereferencing it
- lavf/rawenc: Only accept the appropriate stream type for raw muxers.
- avcodec/h263dec: fix hwaccel decoding
- avutil/mem: Fix invalid use of av_alloc_size
- avformat/aacdec: resync to the next adts frame on invalid data instead of aborting
- avformat/aacdec: factorize the adts frame resync code
version 3.4.6:
- avcodec/hevcdec: Avoid only partly skiping duplicate first slices
- lavc/bmp: Avoid a heap buffer overwrite for 1bpp input.
- avcodec/truemotion2: Fix integer overflow in tm2_null_res_block()
- avcodec/dfa: Check the chunk header is not truncated
- avcodec/dvbsubdec: Check object position
- avcodec/cdgraphics: Use ff_set_dimensions()
- avformat/gdv: Check fps
- avcodec/scpr: Fix use of uninitialized variable
- avcodec/qpeg: Limit copy in qpeg_decode_intra() to the available bytes
- avcodec/aic: Check remaining bits in aic_decode_coeffs()
- avcodec/gdv: Check for truncated tags in decompress_5()
- avcodec/bethsoftvideo: Check block_type
- avcodec/jpeg2000dwt: Fix integer overflow in dwt_decode97_int()
- avcodec/error_resilience: Use a symmetric check for skipping MV estimation
- avcodec/mlpdec: Insuffient typo
- avcodec/zmbv: obtain frame later
- avcodec/jvdec: Check available input space before decode8x8()
- avcodec/h264_direct: Fix overflow in POC comparission
- avformat/webmdashenc: Check id in adaption_sets
- avformat/http: Fix Out-of-Bounds access in process_line()
- avformat/ftp: Fix Out-of-Bounds Access and Information Leak in ftp.c:393
- avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for handling braces
- avcodec/htmlsubtitles: Fixes denial of service due to use of sscanf in inner loop for tag scaning
- avformat/matroskadec: Do not leak queued packets on sync errors
- avformat/mov: Do not use reference stream in mov_read_sidx() if there is no reference stream
- avcodec/sbrdsp_fixed.c: remove input value limit for sbr_sum_square_c()
- avformat/mov: validate chunk_count vs stsc_data
- avformat/mov.c: require tfhd to begin parsing trun
- avcodec/pgssubdec: Check for duplicate display segments
- avformat/rtsp: Check number of streams in sdp_parse_line()
- avformat/rtsp: Clear reply in every iteration in ff_rtsp_connect()
- avcodec/fic: Check that there is input left in fic_decode_block()
- avcodec/tiff: Check for 12bit gray fax
- avutil/imgutils: Optimize memset_bytes() by using av_memcpy_backptr()
- avutil/mem: Optimize fill32() by unrolling and using 64bit
- configure: bump year
- avcodec/diracdec: Check component quant
- avcodec/tests/rangecoder: initialize array to avoid valgrind warning
- avcodec/h264_slice: Fix integer overflow in implicit_weight_table()
- avcodec/exr: set layer_match in all branches
- avcodec/exr: Check for duplicate channel index
- avcodec/4xm: Fix returned error codes
- avcodec/v4l2_m2m: fix cant typo
- avcodec/mjpegbdec: Fix some misplaced {} and spaces
- avformat/wvdec: detect and error out on WavPack DSD files
- avcodec/mips: Fix failed case: hevc-conformance-AMP_A_Samsung_* when enable msa
- avcodec/fic: Fail on invalid slice size/off
- postproc/postprocess_template: remove FF_REG_sp from clobber list
- postproc/postprocess_template: Avoid using %4 for the threshold compare
- avcodec/rpza: Check that there is enough data for all the blocks
- avcodec/rpza: Move frame allocation to a later point
- avcodec/avcodec: Document the data type for AV_PKT_DATA_MPEGTS_STREAM_ID
- avformat/mpegts: Fix side data type for stream id
- tests/fate/filter-video: increase fuzz for fate-filter-refcmp-psnr-rgb
- avcodec/mjpegdec: Fix indention of ljpeg_decode_yuv_scan()
- lavf/id3v2: fail read_apic on EOF reading mimetype
- avformat/nutenc: Document trailer index assert better
- lavf/mov: ensure only one tkhd per trak
- avcodec/ppc/hevcdsp: Fix build failures with powerpc-linux-gnu-gcc-4.8 with --disable-optimizations
- avcodec/msvideo1: Check for too small dimensions
- avcodec/wmv2dec: Skip I frame if its smaller than 1/8 of the minimal size
- avcodec/msmpeg4dec: Skip frame if its smaller than 1/8 of the minimal size
- avcodec/truemotion2rt: Fix rounding in input size check
- avcodec/truemotion2: fix integer overflows in tm2_low_chroma()
- avcodec/pngdec: Check compression method
- fftools/ffmpeg: Repair reinit_filter feature
- avcodec/shorten: Fix integer overflow with offset
- avcodec/cavsdec: Propagate error codes inside decode_mb_i()
- avcodec/mpegaudio_parser: Consume more than 0 bytes in case of the unsupported mp3adu case
- avcodec/hevcdec: decode at most one slice reporting being the first in the picture
- avfilter/af_silenceremove: fix possible crash if supplied duration is negative
version 3.4.5:
- avutil/integer: Fix integer overflow in av_mul_i()
- avcodec/msrle: Check that the input is large enough to contain a end of picture code
- avcodec/jpeg2000dec: Fix off by 1 error in JPEG2000_PGOD_CPRL handling
- avcodec/mpeg4videodec: Fix typo in sprite delta check
- avcodec/h264_cavlc: Check mb_skip_run
- avcodec/ra144: Fix integer overflow in add_wav()
- avformat/utils: Never store negative values in last_IP_duration
- avformat/utils: Fix integer overflow in discontinuity check
- avcodec/unary: Improve get_unary() docs
- avcodec/gdv: Replace divisions by shifts in rescale()
- avcodec/dvdsubdec: Sanity check len in decode_rle()
- avcodec/mpeg4videodec: Fix undefined shift in get_amv()
- avcodec/zmbv: Check that the decompressed data size is correct
- avcodec/zmbv: Update decomp_len in raw frames
- avcodec/shorten: Fix bitstream end check in read_header()
- avcodec/dvdsubdec: Avoid branch in decode_run_8bit()
- avcodec/h264_refs: Document last if() in ff_h264_execute_ref_pic_marking()
- avcodec/ra144: Fix undefined integer overflow in add_wav()
- avcodec/indeo4: Check dimensions in decode_pic_hdr()
- avformat/mov: Error on too large stsd entry counts.
- examples: Fix use of AV_CODEC_FLAG_GLOBAL_HEADER
- avcodec/hq_hqa: Check remaining input bits in hqa_decode_mb()
- avcodec/vb: Check for end of bytestream before reading blocktype
- avcodec/snowdec: Fix integer overflow with motion vector residual
- avformat/nsvdec: Do not parse multiple NSVf
- avformat/mlvdec: read_string() received unsigned size, make the argument unsigned
- avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()
- avcodec/scpr: Check for min > max in decompress_p()
- avcodec/shorten: Fix signed 32bit overflow in shift in shorten_decode_frame()
- avcodec/shorten: Fix integer overflow in residual/LPC combination
- avcodec/shorten: Check verbatim length
- avcodec/mpegaudio_parser: Initialize poutbuf*
- avcodec/aacpsdsp_template: Fix integer overflow in ps_stereo_interpolate_c()
- avformat/flvenc: Check audio packet size
- lavc/svq3: Fix regression decoding some files.
- avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()
- avcodec/diracdec: Check bytes count in else branch in decode_lowdelay() too
- avcodec/diracdec: Check slice numbers for overflows in relation to picture dimensions
- avcodec/diracdec: Change frame_number to 64bit as its a 32bit from the bitstream and we also have a -1 special case
- avcodec/dirac_dwt_template: Fix several integer overflows in horizontal_compose_daub97i()
- avcodec/diracdec: Prevent integer overflow in intermediate in global_mv()
- swresample/swresample: Fix input channel count in resample_first computation
- avutil/pixfmt: Document chroma plane size for odd resolutions
- avcodec/cuviddec: properly take deinterlacing and display delay into account for buffer_full check
- configure: add LIBDRM to extralibs_avutil
- avcodec/bitstream_filters: check the input argument of av_bsf_get_by_name() for NUL
version 3.4.4:
- avcodec/dvdsub_parser: Allocate input padding
- avcodec/dvdsub_parser: Init output buf/size
- avcodec/dirac_dwt_template: Fix signedness regression in interleave()
- avformat/movenc: Write version 2 of audio atom if channels is not known
- swresample/arm: rename labels to fix xcode build error
- avcodec/imgconvert: fix possible null pointer dereference
version 3.4.3:
- avformat/movenc: Check input sample count
- avcodec/mjpegdec: Check for odd progressive RGB
- avformat/movenc: Check that frame_types other than EAC3_FRAME_TYPE_INDEPENDENT have a supported substream id
- avcodec/vp8_parser: Do not leave data/size uninitialized
- avformat/mms: Add missing chunksize check
- avformat/pva: Check for EOF before retrying in read_part_of_packet()
- avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()
- avformat/asfdec_o: Check size_bmp more fully
- avcodec/indeo4: Check for end of bitstream in decode_mb_info()
- avcodec/shorten: Fix undefined addition in shorten_decode_frame()
- avcodec/shorten: Fix undefined integer overflow
- avcodec/jpeg2000dec: Fixes invalid shifts in jpeg2000_decode_packets_po_iteration()
- avcodec/jpeg2000dec: Check that there are enough bytes for all tiles
- avformat/movenc: Do not pass AVCodecParameters in avpriv_request_sample
- avcodec/escape124: Fix spelling errors in comment
- avcodec/ra144: Fix integer overflow in ff_eval_refl()
- avcodec/cscd: Check output buffer size for lzo.
- avcodec/escape124: Check buf_size against num_superblocks
- avcodec/h264_parser: Reduce needed history for parsing mb index
- avcodec/magicyuv: Check bits left in flags&1 branch
- avcodec/mjpegdec: Check for end of bitstream in ljpeg_decode_rgb_scan()
- avcodec/aacdec_fixed: Fix undefined integer overflow in apply_independent_coupling_fixed()
- avcodec/dirac_dwt_template: Fix undefined behavior in interleave()
- avutil/common: Fix undefined behavior in av_clip_uintp2_c()
- fftools/ffmpeg: Fallback to duration if sample rate is unavailable
- avformat/mov: Only set pkt->duration to non negative values
- avcodec/h264_slice: Fix overflow in recovery_frame computation
- avcodec/h264_ps: Move MAX_LOG2_MAX_FRAME_NUM to header so it can be used in h264_sei
- avcodec/h264_mc_template: Only prefetch motion if the list is used.
- avcodec/xwddec: Use ff_set_dimensions()
- avcodec/wavpack: Fix overflow in adding tail
- avcodec/shorten: Fix multiple integer overflows
- avcodec/shorten: Fix undefined shift in fix_bitshift()
- avcodec/shorten: Fix a negative left shift in shorten_decode_frame()
- avcodec/shorten: Sanity check nmeans
- avcodec/shorten: Check non COMM chunk len before skip in decode_aiff_header()
- avcodec/mjpegdec: Fix integer overflow in ljpeg_decode_rgb_scan()
- avcodec/truemotion2: Fix overflow in tm2_apply_deltas()
- avcodec/opus_silk: Change silk_lsf2lpc() slightly toward silk/NLSF2A.c
- avcodec/amrwbdec: Fix division by 0 in find_hb_gain()
- avformat/mov: replace a value error by clipping into valid range in mov_read_stsc()
- avformat/mov: Break out early if chunk_count is 0 in mov_build_index()
- avcodec/fic: Avoid some magic numbers related to cursors
- avcodec/g2meet: ask for sample with overflowing RGB
- avcodec/aacdec_fixed: use 64bit to avoid overflow in rounding in apply_dependent_coupling_fixed()
- oavcodec/aacpsdsp_template: Use unsigned for hs0X to prevent undefined behavior
- avcodec/g723_1dec: Clip bits2 in both directions
- avcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header()
- avcodec/mlpdec: Only change noise_type if the related fields are valid
- indeo4: Decode all or nothing of a band header.
- avformat/mov: Only fail for STCO/STSC contradictions if both exist
- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0 / COMPOSE_DD137iL0
- avcodec/fic: Check available input space for cursor
- avcodec/g2meet: Check RGB upper limit
- avcodec/jpeg2000dec: Fix undefined shift in the jpeg2000_decode_packets_po_iteration() CPRL case
- avcodec/jpeg2000dec: Skip init for component in CPRL if nothing is to be done
- avcodec/g2meet: Change order of operations to avoid undefined behavior
- avcodec/flac_parser: Fix infinite loop
- avcodec/wavpack: Fix integer overflow in DEC_MED() / INC_MED()
- avcodec/wavpack: Fix integer overflow in wv_unpack_stereo()
- avcodec/error_resilience: Fix integer overflow in filter181()
- avcodec/h263dec: Check slice_ret in mspeg4 slice loop
- avcodec/elsdec: Fix memleaks
- avcodec/vc1_block: simplify ac_val computation
- avcodec/ffv1enc: Check that the crc + version combination is supported
- lavf/http.c: Free allocated client URLContext in case of error.
- avcodec/dsicinvideo: Fail if there is only a small fraction of the data available that comprises a full frame
- avcodec/dsicinvideo: Propagate errors from cin_decode_rle()
- avcodec/dfa: Check dimension against maximum
- avcodec/cinepak: Skip empty frames
- avcodec/cinepak: move some checks prior to frame allocation
- swresample/arm: remove unintentional relocation.
- doc/APIchanges: Fix typos in hashes
- avformat/utils: Check cur_dts in update_initial_timestamps() more
- avcodec/utils: Enforce minimum width also for VP5/6
- avcodec/truemotion2: Propagate out of bounds error from GET_TOK()
- avformat/utils: Fix integer overflow in end time calculation in update_stream_timings()
- avcodec/mjpegdec: Check input buffer size.
- avcodec/h264_slice: Fix integer overflow with last_poc
- avformat/mov: Fix extradata memleak
- lavc/libopusdec: Allow avcodec_open2 to call .close
- avcodec/movtextdec: Check style_start/end
- avcodec/aacsbr_fixed: Fix integer overflow in sbr_hf_assemble()
- libavcodec/rv34: error out earlier on missing references
- swresample/swresample: Fix for seg fault in swr_convert_internal() -> sum2_float during dithering.
- avcodec/aacdec_fixed: Fix integer overflow in apply_independent_coupling_fixed()
- avcodec/cscd: Error out when LZ* decompression fails
- avcodec/imgconvert: Fix loss mask bug in avcodec_find_best_pix_fmt_of_list()
- avfilter/vf_signature: use av_strlcpy()
- avcodec/utvideodec: Set pro flag based on fourcc
- avcodec/wmalosslessdec: Fix null pointer dereference in decode_frame()
- avcodec/tableprint_vlc: Fix build failure with --enable-hardcoded-tables
- avformat/mov: Move +1 in check to avoid hypothetical overflow in add_ctts_entry()
- avcodec/get_bits: Make sure the input bitstream with padding can be addressed
- avformat/mov: Check STSC and remove invalid entries
- avcodec/nuv: rtjpeg with dimensions less than 16 would result in no decoded pixels thus reject it
- avcodec/nuv: Check for minimum input size for uncomprssed and rtjpeg
- avcodec/wmalosslessdec: Reset num_saved_bits on error path
- avformat/mov: Fix integer overflows related to sample_duration
- avformat/img2dec: fix infinite loop
- avformat/oggparsedaala: Do not adjust AV_NOPTS_VALUE
- avformat/oggparseogm: Check lb against psize
- avformat/oggparseogm: Fix undefined shift in ogm_packet()
- avformat/avidec: Fix integer overflow in cum_len check
- avformat/oggparsetheora: Do not adjust AV_NOPTS_VALUE
- avformat/utils: Fix integer overflow of fps_first/last_dts
- avformat/oggdec: Fix metadata memleak on multiple headers
- libavformat/oggparsevorbis: Fix memleak on multiple headers
- avformat/mov: Fix integer overflow in mov_get_stsc_samples()
- avcodec/truemotion2rt: Check input buffer size
- avcodec/g2meet: Check tile dimensions with av_image_check_size2()
- avcodec/exr: fix invalid shift in unpack_14()
- avcodec/bintext: sanity check dimensions
- avcodec/utvideodec: Check subsample factors
- avcodec/smc: Check input packet size
- avcodec/cavsdec: Check alpha/beta offset
- avcodec/diracdec: Fix integer overflow in mv computation
- avcodec/h264_parse: Clear invalid chroma weights in ff_h264_pred_weight_table()
- avcodec/aacdec_templat: Fix integer overflow in apply_ltp()
- avcodec/jpeg2000dwt: Fix integer overflows in sr_1d53()
- avcodec/diracdec: Use int64 in global mv to prevent overflow
- avcodec/dxtory: Remove code that corrupts dimensions
- avcodec/dirac_dwt_template: Fix Integer overflow in horizontal_compose_dd137i()
- avcodec/hevcdec: Check luma/chroma_log2_weight_denom
- avcodec/jpeg2000dec: Use av_image_check_size2()
- avcodec/vp8: Check for bitstream end before vp7_fade_frame()
- avcodec/exr: Check remaining bits in last get code loop
- avutil/common: Fix integer overflow in av_clip_uint8_c() and av_clip_uint16_c()
- avdevice/decklink_dec: Fix ;;
- avcodec/h264_cabac: Tighten allowed coeff_abs range
- avcodec/h264_cavlc: Set valid qscale value in ff_h264_decode_mb_cavlc()
- avdevice/iec61883: free the private context at the end
- avdevice/iec61883: return reference counted packets
- configure: add nvcc to CMDLINE_SET
- avcodec/mpeg4_unpack_bframes: make sure the packet is writable when data needs to be changed
- avcodec/mp3_header_decompress: don't free the user provided packet on error
- avcodec/extract_extradata: zero initalize the padding bytes in all allocated buffers
- avformat/hvcc: zero initialize the nal buffers past the last written byte
- swresample/rematrix: fix update of channel matrix if input or output layout is undefined
- avformat/matroskadec: ignore CodecPrivate if the stream is VP9
version 3.4.2:
- avcodec/vp3: Error out on invalid num_coeffs in unpack_vlcs()
- avcodec/mpeg4videodec: Ignore multiple VOL headers
- avcodec/vp3: Check eob_run
- avcodec/pafvideo: Check allocated frame size
- avcodec/scpr: Fix reading a pixel before the first
- avcodec/mpeg2dec: Fix field selection for skipped macroblocks
- avcodec/huffyuvdec: Check input buffer size
- avcodec/utvideodec: Fix bytes left check in decode_frame()
- avcodec/wavpack: Fix integer overflow in FFABS
- avcodec/aacsbr_fixed: Fix overflows in rounding in sbr_hf_assemble()
- avcodec/exr: Fix memleaks in decode_header()
- avcodec/mediacodecdec: use ff_hevc_ps_uninit()
- avcodec/hevc_parser: use ff_hevc_uninit_parameter_sets()
- avcodec/hevcdec: use ff_hevc_uninit_parameter_sets()
- avcodec/hevc_ps: add a function to uninitialize parameter set buffers
- avcodec/dirac_dwt: Fix several integer overflows
- avcodec/indeo5: Do not leave frame_type set to an invalid value
- avcodec/hevc_ps: Check log2_sao_offset_scale_*
- avcodec/mpeg4videodec: Avoid possibly aliasing violating casts
- avcodec/get_bits: Document the return code of get_vlc2()
- avcodec/mpeg4videodec: Check mb_num also against 0
- avfilter/vf_transpose: Fix used plane count.
- avcodec/hevc_cabac: Check prefix so as to avoid invalid shifts in coeff_abs_level_remaining_decode()
- avcodec/mjpegdec: Fix integer overflow in DC dequantization
- avcodec/dxtory: Fix bits left checks
- avcodec/hevc_cabac: Move prefix check in coeff_abs_level_remaining_decode() down
- avcodec/truemotion2: Fix integer overflow in TM2_RECALC_BLOCK()
- avcodec/snowdec: Fix integer overflow before htaps check
- avcodec/ulti: Check number of blocks at init
- avcodec/wavpack: Fix integer overflows in wv_unpack_stereo / mono
- avcodec/jpeg2000: Check sum of sizes of band->prec before allocating
- avcodec/ac3dec_fixed: Fix integer overflow in scale_coefs()
- avformat/lrcdec: Fix memory leak in lrc_read_header()
- avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
- lavfi/deinterlace_vaapi: fix can't show full option information.
- configure:version 3.4.1: bump year
- avcodec/utils: Avoid hardcoding duplicated types in sizeof()
- avcodec/arm/sbrdsp_neon: Use a free register instead of putting 2 things in one
- avcodec/h264addpx_template: Fixes integer overflows
- avcodec/dirac_dwt: Fix overflows in COMPOSE_HAARiH0/COMPOSE_HAARiL0
- avcodec/diracdec: Fix integer overflow with quant
- avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
- avcodec/jpeg2000dsp: Fix integer overflows in ict_int()
- avcodec/h264_slice: Do not attempt to render into frames already output
- avcodec/dnxhddec: Check dc vlc
- avcodec/exr: Check buf_size more completely
- avcodec/flacdec: Fix overflow in multiplication in decode_subframe_fixed()
- avcodec/hevcdsp_template: Fix Invalid shifts in put_hevc_qpel_bi_w_h() and put_hevc_qpel_bi_w_w()
- avcodec/flacdec: avoid undefined shift
- avcodec/hevcdsp_template.c: Fix undefined shift in FUNC(dequant)
- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD97iH0() and COMPOSE_DD137iL0()
- avcodec/hevc_cabac: Fix integer overflow in ff_hevc_cu_qp_delta_abs()
- tests/audiomatch: Add missing return code at the end of main()
- avcodec/hevc_sei: Fix integer overflows in decode_nal_sei_message()
- avcodec/hevcdsp_template: Fix undefined shift in put_hevc_qpel_bi_w_hv()
- avcodec/h264_parse: Treat escaped and unescaped decoding error equal in decode_extradata_ps_mp4()
- avcodec/vp9: mark frame as finished on decode_tiles() failure
- libavfilter/af_dcshift.c: Fixed repeated spelling error
- avfilter/formats: fix wrong function name in error message
version 3.4.1:
- avcodec/vp9_superframe_split_bsf: Fix integer overflow in frame_size/total_size checks
- avcodec/amrwbdec: Fix division by 0 in voice_factor()
- avformat/utils: Fix warning: ISO C90 forbids mixed declarations and code
- avcodec/decode: reset codec on receiving packet after EOF in compat_decode
- avcodec/diracdsp: Fix integer overflow in PUT_SIGNED_RECT_CLAMPED()
- avcodec/dirac_dwt: Fix integer overflows in COMPOSE_DAUB97*
- avcodec/extract_extradata_bsf: Fix leak discovered via fuzzing
- avcodec/vorbis: Fix another 1 << 31 > int32_t::max() with 1u.
- avcodec/vorbis: 1 << 31 > int32_t::max(), so use 1u << 31 instead.
- avformat/utils: Prevent undefined shift with wrap_bits > 64.
- avcodec/j2kenc: Fix out of array access in encode_cblk()
- avcodec/hevcdsp_template: Fix undefined shift in put_hevc_epel_bi_w_h()
- lavf/mov: fix huge alloc in mov_read_ctts
- avcodec/mlpdsp: Fix signed integer overflow, 2nd try
- avcodec/h264idct_template: Fix integer overflow in ff_h264_idct8_add
- avcodec/kgv1dec: Check that there is enough input for maximum RLE compression
- avformat/aacdec: Fix leak in adts_aac_read_packet()
- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_FIDELITYi*
- avcodec/sbrdsp_fixed: Fix integer overflow
- avcodec/mpeg4videodec: Check also for negative versions in the validity check
- Close ogg stream upon error when using AV_EF_EXPLODE.
- Fix undefined shift on assumed 8-bit input.
- Use ff_thread_once for fixed, float table init.
- Fix leak of frame_duration_buffer in mov_fix_index().
- avformat/mov: Propagate errors in mov_switch_root.
- avcodec/hevcdsp_template: Fix invalid shift in put_hevc_epel_bi_w_v()
- avcodec/mlpdsp: Fix undefined shift ff_mlp_pack_output()
- avcodec/zmbv: Check that the buffer is large enough for mvec
- avcodec/dirac_dwt: Fix integer overflow in COMPOSE_DD137iL0()
- avcodec/wmv2dec: Check end of bitstream in parse_mb_skip() and ff_wmv2_decode_mb()
- avcodec/snowdec: Check for remaining bitstream in decode_blocks()
- avcodec/snowdec: Check intra block dc differences.
- avformat/mov: Check size of STSC allocation
- avcodec/vc2enc: Clear coef_buf on allocation
- avcodec/h264dec: Fix potential array overread
- avcodec/x86/mpegvideodsp: Fix signedness bug in need_emu
- avcodec/aacpsdsp_template: Fix integer overflows in ps_decorrelate_c()
- avcodec/aacdec_fixed: Fix undefined shift
- avcodec/mdct_*: Fix integer overflow in addition in RESCALE()
- avcodec/snowdec: Fix integer overflow in header parsing
- avcodec/cngdec: Fix integer clipping
- avcodec/sbrdsp_fixed: Fix integer overflow in shift in sbr_hf_g_filt_c()
- avcodec/aacsbr_fixed: Fix division by zero in sbr_gain_calc()
- avutil/softfloat: Add FLOAT_MIN
- avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
- avcodec/xan: Check for bitstream end in xan_huffman_decode()
- avcodec/exr: fix undefined shift in pxr24_uncompress()
- avformat: Free the internal codec context at the end
- avcodec/h264idct_template: Fix integer overflows in ff_h264_idct8_add()
- avcodec/xan: Improve overlapping check
- avcodec/aacdec_fixed: Fix integer overflow in apply_dependent_coupling_fixed()
- avcodec/aacdec_fixed: Fix integer overflow in predict()
- avcodec/jpeglsdec: Check for end of bitstream in ls_decode_line()
- avcodec/jpeglsdec: Check ilv for being a supported value
- tests/ffserver.regression.ref: update checksums to what ffserver currently produces
- ffserver: Fix off by 1 error in path
- avcodec/proresdec: align dequantization matrix buffers
- avformat/matroskaenc: add missing allocation failure checks for stream durations
- avformat/matroskaenc: actually enforce the stream limit
- configure: Fix dependencies of aac_at decoder.
- Don't manipulate duration when it's AV_NOPTS_VALUE.
- lavfi/af_pan: fix sign handling in channel coefficient parser
- avformat/hlsenc: write fmp4 init header after first AV frame
- avformat/hlsenc: allocate space for terminating null
- avformat/hlsenc: reindent hlsenc code
- avformat/hlsenc: check hls segment mode for ignore the init filename
- avformat/hlsenc: reindent hlsenc code
- avformat/hlsenc: fix missing first segment bug in fmp4 mode
- avformat/hlsenc: fix base_output_dirname is null when basename_size is 0 bug
- ffplay: use SDL2 audio API
- ffplay: only use hardware accelerated SDL texture formats
- ffplay: create the window and the renderer before starting playback
- ffmpeg: always init output stream before reaping filters
- vc2enc_dwt: pad the temporary buffer by the slice size
- lavu/arm: Check for have_vfp_vm instead of !have_vfpv3 for float_dsp_vfp
version 3.4:
- deflicker video filter
- doubleweave video filter
- lumakey video filter
- pixscope video filter
- oscilloscope video filter
- config.log and other configuration files moved into ffbuild/ directory
- update cuvid/nvenc headers to Video Codec SDK 8.0.14
- afir audio filter
- scale_cuda CUDA based video scale filter
- librsvg support for svg rasterization
- crossfeed audio filter
- spec compliant VP9 muxing support in MP4
- remove the libnut muxer/demuxer wrappers