Commit Graph

17134 Commits

Author SHA1 Message Date
Chris Watkins
77f5302465 oggparsedirac: check return value of init_get_bits
If init_get_bits fails the GetBitContext is invalid and must not be
used. Check the return value in dirac_header and propogate the error.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4f5c2e651a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:41 +02:00
Andreas Cadhalpun
5019f8d10c matroskadec: check audio sample rate
And default to 8000 if it is invalid.

An invalid sample rate can trigger av_assert2 in av_rescale_rnd.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 5b76c82fd7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:40 +02:00
Andreas Cadhalpun
476cf3eb7e matroskadec: validate audio channels and bitdepth
In the TTA extradata re-construction the values are written with
avio_wl16 and if they don't fit into uint16_t, this triggers an
av_assert2 in avio_w8.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 92e79a2f7b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:40 +02:00
wm4
c049e979b6 avio: fix potential crashes when combining ffio_ensure_seekback + crc
Calling ffio_ensure_seekback() if ffio_init_checksum() has been called
on the same context can lead to out of bounds memory accesses and
crashes. The reason is that ffio_ensure_seekback() does not update
checksum_ptr after reallocating the buffer, resulting in a dangling
pointer.

This effectively fixes potential crashes when opening mp3 files.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dc87758775)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:40 +02:00
Andreas Cadhalpun
274121179f mov: abort on EOF in ff_mov_read_chan
Otherwise the loop can take a lot of time if num_descr is very large.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit a5718863da)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:40 +02:00
Deliang Fu
35e46e74bc avformat: Fix bug in parse_rps for HEVC.
Make the logic in libavformat/hevc.c parse_rps align with libavcodec/hevc_ps.c ff_hevc_decode_short_term_rps

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6e1f8780c8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:40 +02:00
Michael Niedermayer
e21db6e339 avformat/ffmdec: Check ffio_set_buf_size() return value
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dc55477a64)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:39 +02:00
Michael Niedermayer
7050d07562 Revert "avformat/rtpenc: check av_packet_get_side_data() return, fix null ptr dereference"
This was simply wrong

Found-by: Martin Storsjö
This reverts commit 5d8e4f6da0.
(cherry picked from commit 3e34b7498f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:39 +02:00
Michael Niedermayer
19cef664fe avformat/mxfenc: Accept MXF D-10 with 49.999840 Mbit/sec
This is the maximum rate possible based on the frame size limit of MXF D-10

Previous version reviewed by tim nicholson <nichot20@yahoo.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d7a762553c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:39 +02:00
Rodger Combs
308bcf53f9 avformat/wavdec: Increase dts packet threshold to fix more misdetections
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a3e1e9c5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:39 +02:00
Michael Niedermayer
4db46cf520 avformat/wavdec: Increase probe_packets limit
Fixes DTS detection of b2429e5ba9.dts

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9f5769437a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:39 +02:00
Andreas Cadhalpun
cb921dd47f nutdec: abort if EOF is reached in decode_info_header/read_sm_data
These loops can take a lot of time if count is very large.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit bb23a15df5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:39 +02:00
Andreas Cadhalpun
9c3d306ba4 nutdec: stop skipping bytes at EOF
This can unnecessarily waste a lot of time.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit fa7dec8cb0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:39 +02:00
Andreas Cadhalpun
d4d8c3553d nutdec: fix infinite resync loops
nut->last_syncpoint_pos doesn't necessarily change between resync
attempts, so find_any_startcode can return the same startcode again.

Thus remember where the last resync happened and don't try to resync
before that.

This can't be done locally in nut_read_packet, because this wouldn't
prevent infinite resync loops, where after the resync a packet is
returned and while reading a following packet the resync happens again.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 37e679881d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:39 +02:00
Michael Niedermayer
bd9313d9f8 avformat/nutdec: Check X in 2nd branch of index reading
Prevents read of uninitialized variable

Based on patch by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ebb0ca3d70)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:39 +02:00
Michael Niedermayer
6270401561 avformat/nutdec: Fix recovery when immedeately after seeking a failure happens
Found-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b3496b4a33)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:38 +02:00
Michael Niedermayer
862ba8b4b4 avformat/nutdec: Return error on EOF from get_str()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6bbb2f8f4d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:38 +02:00
Martin Storsjö
94a3d2e49c rtsp: Make sure we don't write too many transport entries into a fixed-size array
(cherry picked from commit b90adb0aba)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:38 +02:00
Andrey Utkin
4c2a1e673b rtpenc_jpeg: handle case of picture dimensions not dividing by 8
This fixes the calculation of the number of needed blocks to make
sure that ALL pixels are represented by the result.

Reviewed-by: Thomas Volkert <silvo@gmx.net>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7f64a7503b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-07-20 04:43:38 +02:00
Michael Niedermayer
a5e18e900f avformat/swfdec: Do not error out on pixel format changes
Instead print an error and continue

Fixes Ticket4702

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6a1204a1a4)
2015-07-08 12:42:36 +02:00
Michael Niedermayer
8c5d196f50 avformat/mov: Mark avio context of decompressed atoms as seekable
Fixes Ticket4329

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8ce564ea28)
2015-06-19 10:57:07 +02:00
Michael Niedermayer
af5917698b avformat/avidec: add mp2 to the list of exceptions instead of generally treating dshow_block_align==1 special
Fixes Ticket4552

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 488383afd1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-17 02:16:39 +02:00
Michael Niedermayer
b58cbb07bc avformat/mov: Fix parsing short loci
Fixes Ticket4557

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 50393bce31)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-16 21:36:48 +02:00
Michael Niedermayer
dd9789ab6d avformat/mov: Print reason of loci parsing failure
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9e4f0cfc8f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-16 21:36:36 +02:00
Carl Eugen Hoyos
b5a942685f lavf/matroskaenc: List subtitle codecs with fake codec_tags to allow remuxing.
Fixes remuxing of DVBSUB to mkv.
2015-05-15 10:04:52 +02:00
Michael Niedermayer
0fc6a95116 avformat/hevc: Check num_negative_pics and num_positive_pics
Fixes CID1238994

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b62b3292d8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
f93412406f avformat/hevc: Check cpb_cnt_minus1
Fixes CID1239014

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2cddc0b19a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
05eddbbc05 avformat/matroskadec: Cleanup error handling for bz2 & zlib
Fixes CID703652

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 171af59d58)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
75b21eb8f8 avformat/nutdec: Fix use of uinitialized value
Fixes CID1041175

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56abf35151)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
1933fa5daa avformat/rtpenc_jpeg: Check remaining buffer size for SOS
Fixes CID1238818

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 81198a6837)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
bd05ac1df8 avformat/rtpdec_xiph: Check upper bound on len in xiph_handle_packet()
Larger packets are not supported and would cause problems later

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit aa5169935e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
889a4779eb avformat/matroskaenc: Check ff_vorbiscomment_length in put_flac_codecpriv()
Its currently guaranteed to be smaller but its safer to check anyway

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f26b3e8e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
a9d3baff03 avformat/oggenc: Check ff_vorbiscomment_length in ogg_write_vorbiscomment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0db5b2b9f8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
f4ce752f22 avformat/flacenc: Check length in flac_write_block_comment()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 40a7700b82)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
02532e1162 avformat/subtitles: Use size_t for len
string length could theoretically be larger than int

Reviewed-by: Clément Bœsch <u@pkh.me>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a633928d47)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
b1652fbb9e avformat/url: Use size_t for len from strlen()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95efc65129)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
38e628fd6d avformat/vorbiscomment: Check entry length in ff_vorbiscomment_write()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eca38864a6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:51 +02:00
Michael Niedermayer
48e53620e0 avformat/mov: Do not read ACLR into extradata for H.264
Fixes regression decoding AVCI
Fixes Ticket4493

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2025e803cd)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:50 +02:00
Vittorio Giovara
536093824d lavf: Reset global flag on deinit
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32da94fa7f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:50 +02:00
Vittorio Giovara
485f53548b network: Do not leave context locked on error
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 45340f9fc7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:50 +02:00
Michael Niedermayer
b942813a41 avformat/utils: Ensure that AVFMT_FLAG_CUSTOM_IO is set before use
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ba631b7914)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:50 +02:00
Michael Niedermayer
a75f293264 avformat/img2dec: do not rewind custom io buffers
Fixes double free with some applications

Fixes vlc ticket14121
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e6e8cc8ce9)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-15 10:04:50 +02:00
James Almer
9fc45b313c dashenc: replace attribute id with contentType for the AdaptationSet element
id should be an integer, not a string. It is also optional, so use
contentType instead which is the proper attribute for these values.

This addresses ticket #4545, fixing an MPD validation error.

Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32a4177a62)
2015-05-14 20:57:24 -03:00
Michael Niedermayer
d9390b9d64 avformat/matroskaenc: Use avoid_negative_ts_use_pts if no stream writes dts
This reduces the number of cases where timestamps need to be shifted

Fixes Ticket4487

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9d4fdfe24c)
2015-05-14 19:52:02 -03:00
Michael Niedermayer
5a8b43285b avformat/mux: Add avoid_negative_ts_use_pts
This allows using pts instead of dts for negative TS avoidance

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ac5c38ec5)
2015-05-14 19:51:55 -03:00
Andreas Cadhalpun
73cf5d9a28 cafdec: free extradata before allocating it
This fixes a memleak if read_kuki_chunk is executed more than once.

Reviewed-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit cb7c4f73e5)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-05-14 19:14:32 +02:00
Andreas Cadhalpun
ac83399281 cafdec: check avio_read return value
If avio_read fails, the buffer can contain uninitialized values.

Reviewed-by: Carl Eugen Hoyos <cehoyos@ag.or.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit a3ede6b742)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-05-14 19:14:19 +02:00
Andreas Cadhalpun
66b95ee4df id3v2: catch avio_read errors in check_tag
Since len is an unsigned int, the comparison is currently treated as
unsigned and thus ignores all errors from avio_read.

Thus cast len to int, which is unproblematic, because at that point len
is between 0 and 4.

This fixes 'Conditional jump or move depends on uninitialised value'
valgrind warnings in is_tag.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0382c94f13)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-05-14 19:13:49 +02:00
Andreas Cadhalpun
0f7e67be3a avi: Validate sample_size
And either error out or set it to 0 if it is negative.

CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 4d0ee4962b)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

Conflicts:
	libavformat/avidec.c
2015-05-14 19:13:13 +02:00
Andreas Cadhalpun
0cb8d786f2 avidec: check for valid bit_rate range
If bit_rate is negative, it can trigger an av_assert2 in av_rescale_rnd.

Since av_rescale returns int64_t, but st->codec_bit_rate is int, it can
also overflow into a negative value.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0eec40b713)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2015-05-14 19:09:47 +02:00