Commit Graph

26554 Commits

Author SHA1 Message Date
Lidong Yan
e68599f551 avformat/rtpdec_asf: fix leak in ff_wms_parse_sdp_a_line()
In ff_wms_parse_sdp_a_line(), it allocates memory in buf, but doesn't
free buf when avformat_alloc_context() failed. Add av_free(buf) before
return to prevent from leak.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-07-03 23:05:27 +02:00
Lidong Yan
7ed5a7094f avformat/rtpdec_latm: fix leak in parse_fmtp_config()
av_mallocz() allocates memory in config, but we forget to free it
if init_get_bits() failed. Replace return ret with goto end.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-07-03 23:04:57 +02:00
Timo Rothenpieler
ba984355fe avformat/whip: fix format string for printing size_t 2025-07-03 22:51:15 +02:00
Timo Rothenpieler
3f7e0fddee avformat/tls: clean up new whip options 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
4a4a566d6e avformat/tls: remove unused fingerprint option 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
043d3fef8a avformat/tls_openssl: use existing context handle 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
2e72924ad1 avformat/tls: fix udp init 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
23c70e3740 avformat/udp: don't override 0 localport 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
492aef2d94 avformat/tls: don't use http_proxy for udp sockets 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
311742eb5a avformat/tls: use non protocol specific error message 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
058b226313 avformat/whip: remove redundant WHIP: prefix from all logging 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
b92130293e avformat/whip: don't leak options dict 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
8f3ecc9db0 avformat/whip: use av_dict_set_int for int 2025-07-03 22:18:10 +02:00
Timo Rothenpieler
cdc03240fe avformat/Makefile: don't hardcode openssl for whip muxer 2025-07-03 22:18:10 +02:00
James Almer
2122f04496 avformat/dump: add support for 3D Reference Displays Information side data
Signed-off-by: James Almer <jamrial@gmail.com>
2025-07-01 22:46:22 +02:00
Dawid Kozinski
6e8bd5dd25 avformat/apvdec: add framerate option
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-27 22:32:51 -03:00
Pavel Koshevoy
59a6660625 avformat/demux: Fix segfault due to avcodec_open2 failure
Fixes 'ffprobe 1_poc.mp4' segfault introduced with
commit 0021484d05

codec_close should not assume that the codec_id did not change.
2025-06-27 19:31:26 -06:00
Steven Liu
f8a9d9473b avformat/whip: check the exchange sdp url is start with http
Make sure the WHIP protocol performs the SDP offer/answer
exchange with the WebRTC peer over HTTP.

Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
Reviewed-by: Jack Lau <jacklau1222@qq.com>
2025-06-26 22:20:07 +02:00
Steven Liu
87808e38a8 avformat/whip: Remove unnecessary pkt checks
h264_annexb_insert_sps_pps (called after write_packet)
reorganizes PPS, SPS, and IDR packets in H.264 streams.
Since write_packet already validates pkt,
redundant null checks in h264_annexb_insert_sps_pps can be removed.

Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
Reviewed-by: Marvin Scholz <epirat07@gmail.com>
2025-06-26 21:46:18 +02:00
James Almer
1abc25cd23 avformat/iamf_parser: remove unreachable code
expanded_loudspeaker_layout is only present and read on the first layer.

Fixes Coverity issue #1655173.

Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-26 16:33:04 -03:00
Marvin Scholz
f744584f71 avformat/tee: fix multiple bsfs in tee
Since 155508c6e9 specifying multiple
bsfs for different streams was broken:

"[bsfs/a=h264_metadata:bsfs/v=h264_metadata]out.mp4|..."

This incorrectly only parsed the first bsfs specification. The reason
for this is that the dictionary is modified in the iterator, hence
invalidating the iterator. The simplest fix for this is to simply
iterate from the beginning in each loop given that the previous entry
is removed.
2025-06-26 17:35:46 +02:00
Michael Niedermayer
0ffe97d9b9 avformat/mov: Check that sample_count is allocated in mov_parse_heif_items()
Fixes: NULL pointer dereference
Fixes: 416811958/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5425269114732544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-26 00:40:49 +02:00
James Almer
36c8eef42c avformat/iamfdec: remove unused variables after recent changes
Fixes -Wunused-but-set-variable warnings

Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 20:15:20 -03:00
James Almer
61773e761e avformat/iamf_writer: fix layout checks when demixing_info is not present
Fixes -Wtautological-overlap-compare warnings

Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 19:49:18 -03:00
James Almer
cbb72e6ab6 avformat/iamf_writer: use named constants in more places
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:41:43 -03:00
James Almer
38f9fbe30d avformat/iamf_writer: reindent after previous commit
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:41:43 -03:00
James Almer
75c514e468 avformat/iamf_writer: add extra constrains for Parameter Sets in Audio Elements
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:41:43 -03:00
James Almer
a3a7b8edc9 avformat/iamf_writer: factor out getting loudspeaker_layout values
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:41:43 -03:00
James Almer
cd2461e627 avformat/iamf: fix setting channel layout for Scalable layers
The way streams are coded in an IAMF struct follows a scalable model where the
channel layouts for each layer may not match the channel order our API can
represent in a Native order layout.

For example, an audio element may have six coded streams in the form of two
stereo streams, followed by two mono streams, and then by another two stereo
streams, for a total of 10 channels, and define for them four scalable layers
with loudspeaker_layout values "Stereo", "5.1ch", "5.1.2ch", and "5.1.4ch".
The first layer references the first stream, and each following layer will
reference all previous streams plus extra ones.
In this case, the "5.1ch" layer will reference four streams (the first two
stereo and the two mono) to encompass six channels, which does not match out
native layout 5.1(side) given that FC and LFE come after FL+FR but before
SL+SR, and here, they are at the end.

For this reason, we need to build Custom order layouts that properly represent
what we're exporting.

----
Before:

  Stream group #0:0[0x12c]: IAMF Audio Element:
    Layer 0: stereo
      Stream #0:0[0x0]: Audio: opus, 48000 Hz, stereo, fltp (default)
    Layer 1: 5.1(side)
      Stream #0:0[0x0]: Audio: opus, 48000 Hz, stereo, fltp (default)
      Stream #0:1[0x1]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
      Stream #0:2[0x2]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:3[0x3]: Audio: opus, 48000 Hz, mono, fltp (dependent)
    Layer 2: 5.1.2
      Stream #0:0[0x0]: Audio: opus, 48000 Hz, stereo, fltp (default)
      Stream #0:1[0x1]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
      Stream #0:2[0x2]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:3[0x3]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:4[0x4]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
    Layer 3: 5.1.4
      Stream #0:0[0x0]: Audio: opus, 48000 Hz, stereo, fltp (default)
      Stream #0:1[0x1]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
      Stream #0:2[0x2]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:3[0x3]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:4[0x4]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
      Stream #0:5[0x5]: Audio: opus, 48000 Hz, stereo, fltp (dependent)

----
AFter:

  Stream group #0:0[0x12c]: IAMF Audio Element:
    Layer 0: stereo
      Stream #0:0[0x0]: Audio: opus, 48000 Hz, stereo, fltp (default)
    Layer 1: 6 channels (FL+FR+SL+SR+FC+LFE)
      Stream #0:0[0x0]: Audio: opus, 48000 Hz, stereo, fltp (default)
      Stream #0:1[0x1]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
      Stream #0:2[0x2]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:3[0x3]: Audio: opus, 48000 Hz, mono, fltp (dependent)
    Layer 2: 8 channels (FL+FR+SL+SR+FC+LFE+TFL+TFR)
      Stream #0:0[0x0]: Audio: opus, 48000 Hz, stereo, fltp (default)
      Stream #0:1[0x1]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
      Stream #0:2[0x2]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:3[0x3]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:4[0x4]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
    Layer 3: 10 channels (FL+FR+SL+SR+FC+LFE+TFL+TFR+TBL+TBR)
      Stream #0:0[0x0]: Audio: opus, 48000 Hz, stereo, fltp (default)
      Stream #0:1[0x1]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
      Stream #0:2[0x2]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:3[0x3]: Audio: opus, 48000 Hz, mono, fltp (dependent)
      Stream #0:4[0x4]: Audio: opus, 48000 Hz, stereo, fltp (dependent)
      Stream #0:5[0x5]: Audio: opus, 48000 Hz, stereo, fltp (dependent)

Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:41:43 -03:00
James Almer
13e81dbd27 avformat/iamf_parse: try to retype the channel layout for ambisonics_mode == 0
In most cases, the channel ids will match the standard Ambisonic Order, saving us the
need to use a custom order layout.

Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:41:43 -03:00
James Almer
9b5abbf387 avformat/iamf_writer: ensure each layer's channel layout contains all channels from the previous one
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:41:43 -03:00
James Almer
a7beac704b avformat/iamf_parse: prevent overreads in update_extradata
Fixes: libavcodec/put_bits.h:232:32: runtime error: shift exponent -19 is negative
Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406
Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:41:43 -03:00
Michael Niedermayer
5b1301004b avformat/iff: Check nb_channels == 0 in CHNL
Fixes: division by 0
Fixes: 418396712/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6104388018176000
Fixes: 418478219/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4569544410857472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-23 16:31:58 +02:00
Peter Ross
e6298e0759 avformat/rtp: G.728 muxing and demuxing 2025-06-23 17:19:18 +10:00
Peter Ross
5a8c2b2b50 avformat/aiff: G.728 muxing and demuxing 2025-06-23 17:19:18 +10:00
Peter Ross
dee4edfa63 avformat/riff: G.728 muxing and demuxing 2025-06-23 17:19:18 +10:00
Peter Ross
52f62468aa avformat/g728dec: raw G.728 demuxer 2025-06-23 17:19:18 +10:00
James Almer
f789d60e11 avformat/mov: add more sanity checks when reading clap boxes
If the apperture window is bigger than the canvas, then the clap box is invalid
and there's no point calculating cropping values.

Fixes: libavformat/mov.c:1295:14: runtime error: -256 is outside the range of representable values of type 'unsigned long'

Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-22 10:30:03 -03:00
Jack Lau
8aa6df663e avformat/whip: replace AV_OPT_FLAG_DECODING_PARAM to ENCODING
Signed-off-by: Jack Lau <jacklau1222@qq.com>
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
2025-06-21 12:57:19 +08:00
Jack Lau
214248e2d6 avformat/whip: mark as experimental
This patch doesn't effect WHIP usage via command, as WHIP always
needs to be explicitly specified

Signed-off-by: Jack Lau <jacklau1222@qq.com>
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
2025-06-21 12:05:13 +08:00
Jack Lau
177b92df2b avformat/tls_openssl: fix warnings when openssl is lower version
api doc: https://docs.openssl.org/1.0.2/man3/BIO_s_mem

In higher versions (openssl 1.0.2 and higher),
the function signature is BIO *BIO_new_mem_buf(const void *buf, int len),
so passing a const string doesn't cause an warnings.
However, in lower versions of OpenSSL,
the function signature becomes BIO *BIO_new_mem_buf(void *buf, int len),
which leads to warnings.

OpenSSL guarantees that it will not modify the string,
so it's safe to cast the pem_str to (void *) to avoid this warning.

Signed-off-by: Jack Lau <jacklau1222@qq.com>
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
2025-06-21 12:01:14 +08:00
James Almer
64e6f5d5fa avformat/mov: set array entry count after the array is allocated in heif_add_stream()
Ensures no bogus values being preserved after returning.

Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-20 13:25:15 -03:00
Lidong Yan
ee1f79b0fa avformat/sbgdec: fix leak in sbg_read_header()
In sbg_read_header(), if avformat_new_stream() failed, it returns
without cleanup, which may cause memory leaks. Replace return statement
with goto so that we would first clean up then return.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-17 11:27:28 -03:00
Andreas Rheinhardt
0ae55affa3 avformat/dhav: Check reading data
Prevents potential use of uninitialized data.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-06-17 00:30:30 +02:00
Andreas Rheinhardt
e3ba364c5e avformat/dhav: Fix check for seekability
AVIOContext.seekable is a bitfield. Also check for seekability
earlier.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
2025-06-17 00:30:30 +02:00
Zhao Zhili
920071355d avformat/movenc: Fix editlist with hybrid_fragmented
The segment_duration must not be set to zero when writing the moov
atom for the second time. This is related to edit lists in standard
MP4 files.

Reviewed-by: Martin Storsjö <martin@martin.st>
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
2025-06-16 10:55:04 +08:00
Lidong Yan
b65fece0aa avformat/rtmpproto: fix rmtp packet leak in gen_connect()
In libavformat/rtmpproto.c:gen_connect(), if check on string length
or check on codec fourcc failed, ff_rtmp_packet_create() allocated
data in pkt would leak. Add ff_rtmp_packet_destory before return error
code.

Signed-off-by: Lidong Yan <502024330056@smail.nju.edu.cn>
Reviewed-by: Zhao Zhili <quinkblack@foxmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-16 01:31:45 +02:00
Jack Lau
8fc91ea936 avformat/hls: fix typo in Range header comment (chore)
Signed-off-by: Marth64 <marth64@proxyid.net>
2025-06-15 12:23:37 -05:00
Marth64
f8c8e1f39d avformat/dvdvideodec: fix seeking on multi-angle discs
When seeking on multi-angle titles, libdvdnav does not lock on
to the correct sectors initially as it seeks to find the right NAV packet.

This manifests itself as two bugs:
(1) When seeking on the first angle in a multi-angle segment,
frames from another angle will appear (for example in intro
or credits scenes). This issue is present in VLC also.

(2) When seeking during a segment on angle n+1, the demuxer
cannot deduce the right position from dvdnav and does not allow
seeking within the segment (due to it maintaining a strict state).

Correct the issue by switching to angle 1 before doing the seek
operation, and skipping 3 VOBUs (NAV packet led segments) ahead
where dvdnav will have positioned itself correctly.

Reported-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Marth64 <marth64@proxyid.net>
2025-06-15 12:22:23 -05:00
Marth64
693703bcdb avformat/dvdvideodec: remove unused has_cc field
Signed-off-by: Marth64 <marth64@proxyid.net>
2025-06-15 12:22:17 -05:00