Andreas Cadhalpun 8016800a64 nutdec: fix illegal count check in decode_main_header ...

The existing check has two problems:
 1) i + count can overflow, so that the check '< 256' returns true.
 2) In the (i == 'N') case occurs a j-- so that the loop runs once more.

This can trigger the assertion 'nut->header_len[0] == 0' or cause
segmentation faults or infinite hangs.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7c24ca1bda)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

2015-05-21 20:43:37 +02:00

..

4xm.c

…

a64.c

…

aacdec.c

…

ac3dec.c

…

act.c

…

adp.c

…

adtsenc.c

…

adxdec.c

avformat/adxdec: check avctx->channels for invalid values

2015-03-21 01:52:51 +01:00

aea.c

…

afc.c

…

aiff.h

…

aiffdec.c

…

aiffenc.c

…

allformats.c

avformat/apngdec: add APNG demuxer.

2014-11-21 17:13:56 +01:00

amr.c

…

anm.c

…

apc.c

…

ape.c

…

apetag.c

…

apetag.h

…

apngdec.c

avformat/apngdec: Use 64bit for ret to avoid overflow

2015-03-21 01:52:50 +01:00

aqtitledec.c

…

asf.c

…

asf.h

…

asfcrypt.c

…

asfcrypt.h

…

asfdec.c

avformat/asfdec: Use 64bit ret to avoid overflow

2015-03-21 01:52:50 +01:00

asfenc.c

asfenc: fix leaking asf->index_ptr on error

2015-03-21 01:52:52 +01:00

assdec.c

assdec: check av_new_packet return value

2014-10-29 16:54:43 +00:00

assenc.c

avformat/assenc: Add ignore_gaps option

2014-11-01 19:38:48 +01:00

ast.c

…

ast.h

…

astdec.c

…

astenc.c

…

au.c

…

audiointerleave.c

Merge commit '1967cd4e4c1cd96dfa195ce14e4b212ddb70586d'

2014-10-25 03:27:13 +02:00

audiointerleave.h

…

avc.c

…

avc.h

…

avformat.h

doc: fix spelling errors

2014-12-01 00:31:06 +01:00

avformatres.rc

…

avi.h

…

avidec.c

lavf: Do not list mov-only codecs in riff.c.

2015-03-13 09:15:18 +01:00

avienc.c

avformat/avienc: write last frame duration

2014-11-19 20:23:04 +01:00

avio_internal.h

…

avio.c

…

avio.h

lavf/avio: clarify the buffer parameter of avio_alloc_context

2014-11-25 18:19:00 +01:00

aviobuf.c

avformat/aviobuf: Check that avio_seek() target is non negative

2014-12-14 17:42:16 +01:00

avisynth.c

…

avlanguage.c

…

avlanguage.h

…

avr.c

…

avs.c

…

bethsoftvid.c

Merge commit '84bf64d3598c98a748e609195358ea04b0cfd140'

2014-10-29 22:47:11 +01:00

bfi.c

…

bink.c

bink: check vst->index_entries before using it

2015-05-21 20:43:36 +02:00

bintext.c

…

bit.c

avformat/bit: only accept the g729 codec and 1 channel

2015-03-21 01:52:51 +01:00

bluray.c

…

bmv.c

…

boadec.c

…

brstm.c

…

c93.c

…

cache.c

…

caf.c

…

caf.h

…

cafdec.c

…

cafenc.c

…

cavsvideodec.c

…

cdg.c

…

cdxl.c

avformat/cdxl: Fix integer overflow of image_size

2015-01-09 17:19:09 +01:00

cinedec.c

cinedec: report white balance gain coefficients using metadata

2014-11-13 15:31:19 +01:00

concat.c

…

concatdec.c

lavf/concatdec: add timestamp log

2014-11-19 11:17:43 +01:00

crcenc.c

…

crypto.c

avformat/crypto: fix key vs iv typo

2014-12-09 20:08:03 +01:00

cutils.c

Merge commit 'ed6dad3737bf7bb2d5e9fa9511dfdb44806010e8'

2014-10-26 03:22:52 +01:00

dashenc.c

Merge commit 'fcae9f212a6001d966c52dc22cd4b22e9851b428'

2014-11-28 12:52:13 +01:00

data_uri.c

…

dauddec.c

…

daudenc.c

…

dfa.c

…

diracdec.c

…

dnxhddec.c

…

dsfdec.c

…

dsicin.c

…

dtsdec.c

avformat/dtsdec: dts_probe: check reserved bit, check lfe, check sr_code similarity

2014-11-20 00:21:09 +01:00

dtshddec.c

…

dump.c

…

dv.c

…

dv.h

…

dvenc.c

…

dxa.c

…

eacdata.c

…

electronicarts.c

…

epafdec.c

…

ffm.h

…

ffmdec.c

ffmdec: limit the backward seek to the last resync position

2015-03-21 01:52:52 +01:00

ffmenc.c

lavf/ffmenc: store recommended encoder configuration

2014-11-27 23:19:41 +01:00

ffmeta.h

…

ffmetadec.c

…

ffmetaenc.c

…

file_open.c

…

file.c

…

filmstripdec.c

avformat/filmstripdec: Fix several integer overflows

2014-10-27 22:57:17 +01:00

filmstripenc.c

…

flac_picture.c

Merge commit '0b66fb4505e0bb43de3797f63f3290f0188d67cc'

2014-10-25 04:03:41 +02:00

flac_picture.h

…

flacdec.c

Merge commit '7784f47762d59e859b4d0f74b3e021ad9368ee2c'

2014-11-06 13:42:41 +01:00

flacenc_header.c

…

flacenc.c

…

flacenc.h

…

flic.c

…

flv.h

…

flvdec.c

avformat/flvdec: Increase string array size

2015-01-09 17:19:10 +01:00

flvenc.c

avformat/flvenc: check that the codec_tag fits in the available bits

2015-03-21 01:52:51 +01:00

format.c

…

framecrcenc.c

…

framehash.c

…

frmdec.c

…

ftp.c

…

g722.c

…

g723_1.c

…

g729dec.c

…

gif.c

…

gifdec.c

…

golomb_tab.c

…

gopher.c

…

gsmdec.c

…

gxf.c

avformat/gxf: Use 64bit for res to avoid overflow

2015-03-21 01:52:50 +01:00

gxf.h

…

gxfenc.c

…

h261dec.c

…

h263dec.c

…

h264dec.c

…

hdsenc.c

avformat/hdsenc: Use av_freep() avoid leaving stale pointers in memory

2014-12-22 03:17:55 +01:00

hevc.c

…

hevc.h

…

hevcdec.c

…

hls.c

avformat: Add and use ff_copy_whitelists()

2014-10-24 19:23:23 +02:00

hlsenc.c

avformat/hlsenc: Free context after hls_append_segment

2014-11-16 04:32:54 +01:00

hlsproto.c

…

hnm.c

…

http.c

avformat/http: simplify chained_options copying

2014-11-15 14:30:32 +01:00

http.h

…

httpauth.c

…

httpauth.h

…

icecast.c

Merge commit '3a6bb9735053c453f806ceab1d91124648d90aca'

2014-11-15 11:30:42 +01:00

icodec.c

…

icoenc.c

…

id3v1.c

…

id3v1.h

…

id3v2.c

id3v2: prefer TDRC for date over TDRL.

2014-11-04 14:11:53 +01:00

id3v2.h

…

id3v2enc.c

…

idcin.c

avformat/idcin: Use 64bit for ret to avoid overflow

2015-03-21 01:52:50 +01:00

idroqdec.c

…

idroqenc.c

…

iff.c

…

ilbc.c

…

img2_alias_pix.c

…

img2_brender_pix.c

…

img2.c

…

img2.h

…

img2dec.c

avformat/img2dec: do not rewind custom io buffers

2015-04-21 00:12:17 +02:00

img2enc.c

avformat/img2enc: Use localtime_r() for thread saftey

2014-11-02 20:09:16 +01:00

ingenientdec.c

…

internal.h

Merge commit '675ac56b7ee0f204963fde55295197c5df80aa91'

2014-11-27 11:52:33 +01:00

ipmovie.c

…

ircam.c

…

ircam.h

…

ircamdec.c

…

ircamenc.c

…

isom.c

…

isom.h

avformat/mov: check atom nesting depth

2014-12-22 03:17:55 +01:00

iss.c

…

iv8.c

…

ivfdec.c

…

ivfenc.c

…

jacosubdec.c

avformat/jacosubdec: Cleanup when avpriv_bprint_to_extradata() fails

2014-11-25 15:20:54 +01:00

jacosubenc.c

…

jvdec.c

…

latmenc.c

…

libavformat.v

…

libgme.c

…

libmodplug.c

…

libnut.c

…

libquvi.c

avformat: Add and use ff_copy_whitelists()

2014-10-24 19:23:23 +02:00

librtmp.c

librtmp: append the correct field to the string

2014-11-18 00:38:26 +01:00

libsmbclient.c

avformat: Read errno before av_log() as the callback from av_log() might affect errno

2014-10-25 13:48:56 +02:00

libssh.c

…

lmlm4.c

…

loasdec.c

…

log2_tab.c

…

lrc.c

…

lrc.h

…

lrcdec.c

…

lrcenc.c

…

lvfdec.c

…

lxfdec.c

Rename sync() functions in libavformat.

2014-11-25 23:49:58 +01:00

m4vdec.c

…

Makefile

libavformat: Build hevc.o when building the RTP muxer

2015-01-09 00:50:31 -03:00

matroska.c

…

matroska.h

…

matroskadec.c

avformat/matroskadec: Fix number suffixes

2015-02-12 17:10:35 +01:00

matroskaenc.c

Merge commit '090c67d586e3916f9acc49e010b6389d07f97153'

2014-10-27 22:18:03 +01:00

md5enc.c

…

md5proto.c

…

metadata.c

…

metadata.h

…

mgsts.c

…

microdvddec.c

…

microdvdenc.c

…

mkvtimestamp_v2.c

…

mlvdec.c

avformat/mlvdec: Check the return code from strftime()

2014-10-26 17:07:29 +01:00

mm.c

…

mmf.c

avformat/mmf: Use AVFormatContext strict_std_compliance instead of AVCodecContext

2014-11-06 14:48:41 +01:00

mms.c

…

mms.h

…

mmsh.c

…

mmst.c

…

mov_chan.c

…

mov_chan.h

…

mov.c

avformat/mov: Disallow ".." in dref unless use_absolute_path is set

2015-03-21 01:52:53 +01:00

movenc.c

avformat/movenc: workaround bug in "PathScale EKOPath(tm) Compiler Suite Version 4.0.12.1"

2015-01-10 05:01:20 +01:00

movenc.h

Merge commit 'ee37620b6ae4783cda637408422044b2d14a688c'

2014-11-26 11:27:17 +01:00

movenchint.c

…

mp3dec.c

avformat/mp3dec: avoid seeking to negative positions

2014-11-18 04:04:37 +01:00

mp3enc.c

id3v2: prefer TDRC for date over TDRL.

2014-11-04 14:11:53 +01:00

mpc8.c

avformat/mpc8: Use uint64_t in *_get_v() to avoid undefined behavior

2015-02-12 17:10:36 +01:00

mpc.c

…

mpeg.c

avformat/mpeg: do not count PES packets inside PES packets during probing

2015-02-12 17:10:35 +01:00

mpeg.h

…

mpegenc.c

avformat/mpegenc: assert that premux_packet is non null

2014-11-24 16:54:06 +01:00

mpegts.c

avformat/mpegts: improve first valid PMT heuristic

2014-11-08 21:35:20 +01:00

mpegts.h

…

mpegtsenc.c

Merge commit '8f8caca2242e1fe05f37493cfabcd3f4de198550'

2014-12-02 22:42:35 +01:00

mpegvideodec.c

…

mpjpeg.c

avformat/mpjpeg: make boundary tag user customizable

2014-10-29 18:31:32 +01:00

mpl2dec.c

…

mpsubdec.c

…

msnwc_tcp.c

…

mtv.c

Merge commit 'f64d7e919eabd427f3e6dd4a1219e448c78deb42'

2014-10-29 21:27:33 +01:00

mux.c

lavf/mux: Always call write_trailer() from av_write_trailer() to avoid a leak.

2014-11-20 10:14:51 +01:00

mvdec.c

avformat/mvdec: Use 64bit for ret to avoid overflow

2015-03-21 01:52:51 +01:00

mvi.c

…

mxf.c

libavformat/mxfdec.c: initial support for EssenceGroups

2014-11-30 23:14:06 +01:00

mxf.h

libavformat/mxfdec.c: initial support for EssenceGroups

2014-11-30 23:14:06 +01:00

mxfdec.c

mxfdec: Fix the error handling for when strftime fails

2015-03-21 01:52:52 +01:00

mxfenc.c

mxfenc: fix indentation after last commit

2014-10-29 23:49:13 +01:00

mxg.c

…

ncdec.c

…

network.c

…

network.h

…

nistspheredec.c

…

noproxy-test.c

…

nsvdec.c

…

nullenc.c

…

nut.c

xface: Fix encoder crashes due to too small on-stack array.

2014-11-23 06:51:18 +01:00

nut.h

…

nutdec.c

nutdec: fix illegal count check in decode_main_header

2015-05-21 20:43:37 +02:00

nutenc.c

…

nuv.c

…

oggdec.c

…

oggdec.h

…

oggenc.c

lavf/oggenc: use meaningful error codes

2014-12-03 22:20:22 +01:00

oggparsecelt.c

…

oggparsedirac.c

…

oggparseflac.c

Merge commit '7784f47762d59e859b4d0f74b3e021ad9368ee2c'

2014-11-06 13:42:41 +01:00

oggparseogm.c

…

oggparseopus.c

…

oggparseskeleton.c

…

oggparsespeex.c

…

oggparsetheora.c

…

oggparsevorbis.c

avformat/oggparsevorbis: Check that initialization succeeded before declaring the end of headers

2014-11-06 13:02:08 +01:00

oggparsevp8.c

…

oma.c

…

oma.h

…

omadec.c

avformat/omadec: Use 64bit for ret to avoid overflow

2015-03-21 01:52:51 +01:00

omaenc.c

…

options_table.h

Merge commit '1384df641994bf3d6cb51084290aa94752737bae'

2014-11-07 23:09:30 +01:00

options.c

Merge commit '9257692ac15eff7b07540c1f61cebde0d8823fbd'

2014-11-18 02:46:07 +01:00

os_support.c

avformat/os_support: Use av_freep() to avoid leaving stale pointers in memory

2015-02-12 17:11:54 +01:00

os_support.h

Merge commit '79fd186a5035cf16fc0ab288d8f59da8b1ba2c0e'

2014-11-27 11:35:54 +01:00

paf.c

…

pcm.c

…

pcm.h

…

pcmdec.c

…

pcmenc.c

…

pjsdec.c

…

pmpdec.c

…

psxstr.c

…

pva.c

…

pvfdec.c

…

qcp.c

lavf/qcp: Print unknown GUID on error.

2014-12-02 11:40:01 +01:00

qtpalette.h

…

r3d.c

…

rawdec.c

avformat/rawdec: raw formats have no timestamps

2014-11-24 19:58:26 +01:00

rawdec.h

…

rawenc.c

…

rawenc.h

…

rawvideodec.c

…

rdt.c

avformat/rdt: Forward whitelists to rdt demuxer

2014-10-25 21:17:27 +02:00

rdt.h

…

realtextdec.c

Print a warning if a subtitle demuxer changes utf16 to utf8.

2014-10-29 01:32:44 +01:00

redspark.c

…

replaygain.c

…

replaygain.h

…

riff.c

lavf: Do not list mov-only codecs in riff.c.

2015-03-13 09:15:18 +01:00

riff.h

Also print GUIDs as shown in the Windows registry to ease debugging.

2014-12-02 11:39:06 +01:00

riffdec.c

avformat/riffdec: Use av_freep() to avoid leaving stale pointers in memory

2015-02-12 17:11:54 +01:00

riffenc.c

avformat/riffenc: move MP3 LSF threshold to the midway point between the 2

2014-11-06 14:53:21 +01:00

rl2.c

…

rm.c

…

rm.h

…

rmdec.c

avformat/rmdec: Check for overflow in ff_rm_read_mdpr_codecdata()

2015-02-12 17:10:35 +01:00

rmenc.c

avformat/rm: limit packet size

2015-03-21 01:52:52 +01:00

rmsipr.c

…

rmsipr.h

…

rpl.c

…

rsd.c

avformat/rsd: make tag_buf string larger

2014-12-19 18:01:31 -03:00

rso.c

…

rso.h

…

rsodec.c

…

rsoenc.c

…

rtmp.h

…

rtmpcrypt.c

…

rtmpcrypt.h

…

rtmpdh.c

…

rtmpdh.h

…

rtmphttp.c

…

rtmppkt.c

Merge commit '44127b157e9f8acb837d4bb3a094f56b40da3ef5'

2014-11-28 12:14:26 +01:00

rtmppkt.h

…

rtmpproto.c

avformat/rtmpproto: Use av_freep() to avoid leaving stale pointers in memory

2015-02-12 17:11:55 +01:00

rtp.c

…

rtp.h

…

rtpdec_amr.c

…

rtpdec_asf.c

avformat/rtpdec_asf: Use av_find_input_format() instead of directly linking to the demuxer

2014-10-25 16:28:03 +02:00

rtpdec_formats.h

…

rtpdec_g726.c

…

rtpdec_h261.c

avformat/rtpdec_h261: code aligned to the HEVC code

2014-11-01 16:33:52 +01:00

rtpdec_h263_rfc2190.c

rtpdec_h263_rfc2190: Clear the stored bits if discarding buffered data

2015-02-12 17:10:35 +01:00

rtpdec_h263.c

…

rtpdec_h264.c

…

rtpdec_hevc.c

…

rtpdec_ilbc.c

…

rtpdec_jpeg.c

…

rtpdec_latm.c

…

rtpdec_mpeg4.c

…

rtpdec_mpeg12.c

…

rtpdec_mpegts.c

…

rtpdec_qcelp.c

…

rtpdec_qdm2.c

…

rtpdec_qt.c

…

rtpdec_svq3.c

…

rtpdec_vp8.c

…

rtpdec_xiph.c

…

rtpdec.c

…

rtpdec.h

…

rtpenc_aac.c

…

rtpenc_amr.c

…

rtpenc_chain.c

…

rtpenc_chain.h

…

rtpenc_h261.c

…

rtpenc_h263_rfc2190.c

…

rtpenc_h263.c

…

rtpenc_h264.c

…

rtpenc_hevc.c

…

rtpenc_jpeg.c

…

rtpenc_latm.c

…

rtpenc_mpv.c

…

rtpenc_vp8.c

…

rtpenc_xiph.c

…

rtpenc.c

…

rtpenc.h

…

rtpproto.c

avformat/rtpproto: Allow to specify DSCP class

2014-11-27 19:53:09 +01:00

rtpproto.h

…

rtsp.c

Merge commit '604c9b1196c70d79bbbc1f23e75f6a8253a74da3'

2014-12-02 21:39:05 +01:00

rtsp.h

…

rtspcodes.h

…

rtspdec.c

…

rtspenc.c

…

samidec.c

Print a warning if a subtitle demuxer changes utf16 to utf8.

2014-10-29 01:32:44 +01:00

sapdec.c

avformat: Add and use ff_copy_whitelists()

2014-10-24 19:23:23 +02:00

sapenc.c

…

sauce.c

…

sauce.h

…

sbgdec.c

avformat/sbgdec: Use localtime_r() for thread saftey

2014-11-02 20:08:59 +01:00

sctp.c

…

sdp.c

…

sdr2.c

…

seek-test.c

…

seek.c

…

seek.h

…

segafilm.c

…

segment.c

avformat/segment: Use av_freep() avoid leaving stale pointers in memory

2015-01-09 17:19:09 +01:00

sierravmd.c

…

siff.c

…

smacker.c

avformat/smacker: Fix number suffix

2015-02-12 17:10:35 +01:00

smjpeg.c

…

smjpeg.h

…

smjpegdec.c

…

smjpegenc.c

…

smoothstreamingenc.c

Merge commit '675ac56b7ee0f204963fde55295197c5df80aa91'

2014-11-27 11:52:33 +01:00

smush.c

…

sol.c

Merge commit '30b8eb0f87b0eaefdc115ef38f8ad87dd3a6e50b'

2014-11-24 13:10:16 +01:00

sox.h

…

soxdec.c

…

soxenc.c

…

spdif.c

…

spdif.h

…

spdifdec.c

…

spdifenc.c

…

srtdec.c

Print a warning if a subtitle demuxer changes utf16 to utf8.

2014-10-29 01:32:44 +01:00

srtenc.c

…

srtp.c

…

srtp.h

…

srtpproto.c

…

stldec.c

…

subfile.c

…

subtitles.c

avformat/subtitles: reduce log level of UTF-16 warning

2014-10-29 18:29:43 +01:00

subtitles.h

Print a warning if a subtitle demuxer changes utf16 to utf8.

2014-10-29 01:32:44 +01:00

subviewer1dec.c

…

subviewerdec.c

…

supdec.c

…

swf.c

…

swf.h

…

swfdec.c

…

swfenc.c

…

takdec.c

…

tcp.c

lavf/tcp: Clarify that the -timeout option takes microseconds.

2014-11-12 13:52:56 +01:00

tedcaptionsdec.c

…

tee.c

…

thp.c

avformat/thp: Check av_get_packet() for failure not only for partial output

2015-02-12 17:10:36 +01:00

tiertexseq.c

…

tls.c

…

tmv.c

…

tta.c

avformat/tta: fix crash with corrupted files

2015-02-12 17:10:36 +01:00

tty.c

…

txd.c

…

udp.c

avformat/udp: Allow to specify DSCP class

2014-11-27 19:53:09 +01:00

uncodedframecrcenc.c

…

unix.c

…

url-test.c

…

url.c

…

url.h

…

urldecode.c

…

urldecode.h

…

utils.c

lavf: Reset global flag on deinit

2015-05-21 20:43:37 +02:00

vc1test.c

…

vc1testenc.c

…

version.h

Merge commit 'e352b293712ff7cbde67eba3ce3f8510b037de09'

2014-12-02 22:13:20 +01:00

vivo.c

…

voc.c

…

voc.h

…

vocdec.c

…

vocenc.c

…

vorbiscomment.c

…

vorbiscomment.h

…

vplayerdec.c

…

vqf.c

avformat/vqf: Use 64bit for ret to avoid overflow

2015-03-21 01:52:51 +01:00

w64.c

…

w64.h

…

wavdec.c

…

wavenc.c

avformat/wavenc: Use localtime_r() for thread saftey

2014-11-02 20:08:12 +01:00

wc3movie.c

…

webmdashenc.c

lavf/webmdashenc: Representation IDs should be unique.

2014-11-12 00:21:37 +01:00

webpenc.c

avformat/webpenc: preserve single image VP8X flags

2014-11-07 04:15:01 +01:00

webvttdec.c

…

webvttenc.c

…

westwood_aud.c

…

westwood_vqa.c

…

wtv_common.c

…

wtv.h

…

wtvdec.c

avformat/wtvdec: Use 64bit for ret to avoid overflow

2015-03-21 01:52:51 +01:00

wtvenc.c

…

wv.c

…

wv.h

…

wvdec.c

…

wvenc.c

…

xa.c

…

xmv.c

…

xwma.c

Merge commit 'fd9badd3cb3b60f5c54dcea35523e1ecca2f67a6'

2014-11-21 21:30:47 +01:00

yop.c

…

yuv4mpeg.h

…

yuv4mpegdec.c

…

yuv4mpegenc.c

avformat/yuv4mpegenc: Use AVFormatContext strict_std_compliance instead of AVCodecContext

2014-11-06 14:48:50 +01:00