Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/FFmpeg/FFmpeg.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/libavformat
AgeCommit message (Collapse)Author
2015-03-14avformat/mov: Check for string truncation in mov_open_dref()n2.2.14Michael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 8003816e1619e77d8de051883264aa090e0d78cc) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/mov: Use sizeof(filename) instead of a literal numberMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 21a53dd08dce7cc5b3fdf9c4826b4b74d8300ea0) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14ffmdec: fix infinite loop at EOFAndreas Cadhalpun
If EOF is reached, while skipping bytes, avio_tell(pb) won't change anymore, resulting in an infinite loop. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 6fa98822eba501a4898fdec5b75acd3026201005) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/flvenc: check that the codec_tag fits in the available bitsAndreas Cadhalpun
flags is later written with avio_w8 and if it doesn't fit in one byte it triggers an av_assert2. Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit e8565d21c276ab9ac5ce785549420321fbd0b093) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/bit: only accept the g729 codec and 1 channelAndreas Cadhalpun
Other codecs/channel numbers are not supported by this muxer. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit d0b8640f75ff7569c98d6fdb03d83451104e088c) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/bit: check that pkt->size is 10 in write_packetAndreas Cadhalpun
Ohter packet sizes are not supported by this muxer. This avoids a null pointer dereference of pkt->data. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit eeda2c3de8a8484d9e7d1e47ac836bec850b31fc) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/adxdec: check avctx->channels for invalid valuesAndreas Cadhalpun
This avoids a null pointer dereference of pkt->data. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 7faa40af982960608b117e20fec999b48011e5e0) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/omadec: Use 64bit for ret to avoid overflowMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 0f55bc29d41585d110b126cb4ed4b395fd46d7ac) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/vqf: Use 64bit for ret to avoid overflowMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit cb08687180683a755d0fe9d425280d0e4d1e6db2) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/mvdec: Use 64bit for ret to avoid overflowMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 26c0cc154e06cb0064b3a3da49447ac44d82444f) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/gxf: Use 64bit for res to avoid overflowMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 12987f89007ee82b9d3a6090085dfaef8461ab8b) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/idcin: Use 64bit for ret to avoid overflowMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit d1923d15a3544cbb94563a59e7169291db76b312) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14avformat/asfdec: Use 64bit ret to avoid overflowMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit d4936d28a11fac6c9c4b4df9625185f93b086986) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-11ffmdec: make sure the time base is validAndreas Cadhalpun
A negative time base can trigger assertions. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 4c91d81be23ffacfa3897b2bcfa77445bb0c2f89) Conflicts: libavformat/ffmdec.c (cherry picked from commit 9678ceb6976ca8194848b24535785a298521211f) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-11ffmdec: limit the backward seek to the last resync positionAndreas Cadhalpun
If resyncing leads to the same position as previously, it will again lead to a resync attempt, resulting in an infinite loop. Thus don't seek back beyond the last syncpoint. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 6b8263b03ab3d16d70525ae1893cb106be7852f1) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09Merge commit '0051174c70810b66378cf8ea093eab01302f6049' into release/2.2Michael Niedermayer
* commit '0051174c70810b66378cf8ea093eab01302f6049': rmenc: limit packet size Conflicts: libavformat/rmenc.c See: 08728f400b8367dc8c983036cb2eff3a2891322b Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09avformat/rm: limit packet sizeAndreas Cadhalpun
The chunk size is limited to 0xFFFF (written by avio_wb16), so make sure that the packet size is not too large. Such large frames need to be split into slices smaller than 64 kB, but that is currently supported neither by the rv10/rv20 encoders nor the rm muxer. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> See Ticket244 Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 08728f400b8367dc8c983036cb2eff3a2891322b) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-08rmenc: limit packet sizeAndreas Cadhalpun
The chunk size is limited to UINT16_MAX (written by avio_wb16), so make sure that the packet size is not too large. Such large frames need to be split into slices smaller than 64 kB, but that is currently supported neither by the rv10/rv20 encoders nor the rm muxer. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-02-23img2dec: correctly use the parsed value from -start_numberVittorio Giovara
Previously the image sequence was always starting from the minimum number rather than the requested one. CC: libav-stable@libav.org
2015-02-17avformat/thp: Check av_get_packet() for failure not only for partial outputMichael Niedermayer
Fixes null pointer dereference Fixes: signal_sigsegv_db2c1f_3108_cov_163322880_pikmin2_opening1_partial.thp Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit f2579dbb4b31e6ae731e7f5555680528ef3020ab) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17avformat/mpc8: Use uint64_t in *_get_v() to avoid undefined behaviorMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 05e161952954acf247e0fd1fdef00559675c4d4d) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17avformat/mpc8: fix broken pointer mathwm4
This could overflow and crash at least on 32 bit systems. Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit b737a2c52857b214be246ff615c6293730033cfa) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17avformat/mpc8: fix hang with fuzzed filewm4
This can lead to an endless loop by seeking back a few bytes after each attempted chunk read. Assuming negative sizes are always invalid, this is easy to fix. Other code in this demuxer treats negative sizes as invalid as well. Fixes ticket #4262. Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 56cc024220886927350cfc26ee695062ca7ecaf4) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17avformat/tta: fix crash with corrupted fileswm4
av_add_index_entry() can fail, for example because the parameters are invalid, or because memory allocation fails. Check this; it can actually happen with corrupted files. The second hunk is just for robustness. Just in case functions like ff_reduce_index() remove entries. (Not sure if this can actually happen.) Fixes ticket #4294. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 6a0cd529a35190d9374b0b26504e71857cd67b83) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17avformat/omadec: fix number suffixMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit f1f7f5903ab49b84789af5341492afbaba808a70) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17avformat/smacker: Fix number suffixMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 465f3705b1ef832fd6904750d018f81f9044f3ab) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17avformat/matroskadec: Fix number suffixesMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit fc3cdb00d084222a107e61e7168903bf3d3d0b47) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17avformat/utils: Fix number suffixes in tb_unreliable()Michael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 4b15bba2aec93776bfdc69a1bca42a4795a7d191) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17Merge commit 'a9602c6cfbe6fa06ff97ad01c0ffa9ad5ccff30f' into release/2.2Michael Niedermayer
* commit 'a9602c6cfbe6fa06ff97ad01c0ffa9ad5ccff30f': matroskadec: Fix read-after-free in matroska_read_seek() Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-27matroskadec: Fix read-after-free in matroska_read_seek()Xiaohan Wang
In matroska_read_seek(), |tracks| is assigned at the begining of the function. However, functions like matroska_parse_cues() could reallocate the tracks and invalidate |tracks|. This assigns |tracks| only before using it, so that it will not get invalidated elsewhere. Bug-Id: chromium/427266
2015-01-20Add FFMPEG_VERSION into the binary libsMichael Niedermayer
This simplifies identifying from which revision a binary of a lib came from Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 649c158e8c94ac0cff7f03e97d6ea8bbf71b7f02) Conflicts: libavdevice/avdevice.c libswresample/swresample.c
2015-01-20avformat/mov: fix integer overflow of sizeMichael Niedermayer
Fixes: case1_call_stack_overflow.mp4 Found-by: Michal Zalewski <lcamtuf@coredump.cx> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-20avformat/mov: check atom nesting depthMichael Niedermayer
Fixes call stack overflow Fixes: case1_call_stack_overflow.mp4 Found-by: Michal Zalewski <lcamtuf@coredump.cx> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit caa7a3914f499f74b3ee346f26d598ebdc0ec210) Conflicts: libavformat/isom.h Conflicts: libavformat/isom.h
2015-01-20avformat/flvdec: Use av_freep() avoid leaving stale pointers in memoryMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 91ea466551c148bd897706a1b6a168e783761a06) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-20avformat/hdsenc: Use av_freep() avoid leaving stale pointers in memoryMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 16d763fa45b95783c6770edc559769d9a83d6a10) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-20avformat/utils: Do not update programs streams from program-less streams in ↵Michael Niedermayer
update_wrap_reference() Fixes Ticket3686 Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit a29524bf2e197dd8d582445de0fe17f03b79f79d) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-20avformat/aviobuf: Check that avio_seek() target is non negativeMichael Niedermayer
Fixes out of array access Suggested-by: Andrew Scherkus <scherkus@google.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit ed86dbd05d61363dc1c0d33f3267e2177c985fdd) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18avformat/rmdec: Check for overflow in ff_rm_read_mdpr_codecdata()Michael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 03abf55f252945c70f4a79eaf4d609cee4d98710) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-10avformat/movenc: workaround bug in "PathScale EKOPath(tm) Compiler Suite ↵Michael Niedermayer
Version 4.0.12.1" Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 7824dc5150c0ea44ffa7cd4d57803f9a9697e7d7) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-06avformat/mov: Fix mixed declaration and statement warningMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit db27f50e0658e91758e8a17fdcf390e6bc93c1d2) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-06avformat/utils: Clear pointer in ff_alloc_extradata() to avoid leaving a ↵Michael Niedermayer
stale pointer in memory Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit bbfca8e84b0e69abba523d665536c0135fc1c00e) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-06avformat/matroskadec: Use av_freep() to avoid leaving stale pointers in memoryMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 6e70e4aca50696040cc9256ec96e5c31d9641432) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-06mov: Fix negative size calculation in mov_read_default().Dale Curtis
The previous code assumed if an atom was marked with a 64-bit size extension, it actually had that data available. The new code verfies there's enough data in the atom for this to be done. Failure to verify causes total_size > atom.size which will result in negative size calculations later on. Found-by: Paul Mehta <paul@paulmehta.com> Signed-off-by: Dale Curtis <dalecurtis@chromium.org> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 3ebd76a9c57558e284e94da367dd23b435e6a6d0) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-06avformat/mov: fix integer overflow in mov_read_udta_string()Michael Niedermayer
Found-by: Paul Mehta <paul@paulmehta.com> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 3859868c75313e318ebc5d0d33baada62d45dd75) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-06mov: Avoid overflow with mov_metadata_raw()Dale Curtis
The code previously added 1 to len without checking its size, resulting in an overflow which can corrupt value[-1] -- which may be used to store unaligned ptr information for certain allocators. Found-by: Paul Mehta <paul@paulmehta.com> Signed-off-by: Dale Curtis <dalecurtis@chromium.org> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-01avformat/flvdec: Increase string array sizeMichael Niedermayer
Fixes parsing httphostheader of Scarlatti\,\ Pieter-Jan\ Belder\ -\ Sonata\ K113\ in\ A\ major\ -\ Alle.flv Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit eb767a276bfdb9a0493bdb0b38203638230b7ccb) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-01avformat/flvdec: do not inject dts=0 metadata packets which failed to be ↵Michael Niedermayer
parsed into a new data stream Such data streams (which then contain no other packets except the faulty one) confuse some user applications, like VLC Works around vlcticket 12389 Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 322f0f5960a743cac47252d90a0f1ea7a025feff) Conflicts: libavformat/flvdec.c
2015-01-01avformat/cdxl: Fix integer overflow of image_sizeMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 3eb5cbe0c50d0a0bbe10bcabbd6b16d73d93c128) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-12-25avformat/segment: Use av_freep() avoid leaving stale pointers in memoryMichael Niedermayer
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 68fa549230af35179df2a2af2bdb84ee6c825bed) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2014-12-20Merge commit '931f5b235112f1c2a09dead36f0a228061d23942' into release/2.2Michael Niedermayer
* commit '931f5b235112f1c2a09dead36f0a228061d23942': mov: avoid a memleak when multiple stss boxes are present Conflicts: libavformat/mov.c See: 5ab882d7283f57560c889919c35f2688253b1d9c Merged-by: Michael Niedermayer <michaelni@gmx.at>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-25 14:53:39 +0300