Commit Graph

14744 Commits

Author SHA1 Message Date
Michael Niedermayer
eaf674ef04 Merge commit 'c34d1099db6f9bc49f30eb3141f87c42b01a3714' into release/2.2
* commit 'c34d1099db6f9bc49f30eb3141f87c42b01a3714':
  nut: Make sure to clean up on read_header failure

Conflicts:
	libavformat/nutdec.c

See: 361702660d
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 13:12:29 +02:00
Andreas Cadhalpun
b216e8b02b nutdec: fix memleaks on error in nut_read_header
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 361702660d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 13:12:10 +02:00
Michael Niedermayer
3bedd0d232 Merge commit '0654518597e6ee2947e4a81c26f03f9aec7ef656' into release/2.2
* commit '0654518597e6ee2947e4a81c26f03f9aec7ef656':
  avi: Validate sample_size

Conflicts:
	libavformat/avidec.c

See: ca234639ac
See: c7369f3a4b
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 13:03:52 +02:00
Michael Niedermayer
7666ecbbcb avformat/avidec: print a warning for negative sample_size
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c7369f3a4b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 13:03:39 +02:00
Andreas Cadhalpun
0658aef53a avidec: avoid infinite loop due to negative ast->sample_size
If max in clean_index is set to a negative ast->sample_size, the
following loop never ends:
        while (max < 1024)
            max += max;

Thus set ast->sample_size to 0 if it would otherwise be negative.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ca234639ac)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 13:03:36 +02:00
Michael Niedermayer
fb2f96d9ef Merge commit '3bebca9634f05ea5da7624e3a3f35ec95341e250' into release/2.2
* commit '3bebca9634f05ea5da7624e3a3f35ec95341e250':
  nut: Check chapter creation in decode_info_header

Conflicts:
	libavformat/nutdec.c

See: 3ff1af2b0d
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 13:00:48 +02:00
Andreas Cadhalpun
6dfb78d6f1 nutdec: check chapter creation in decode_info_header
This fixes a segmentation fault when accessing the metadata.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3ff1af2b0d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 13:00:39 +02:00
Michael Niedermayer
3db9966152 avformat/mux: Dont leave stale side data pointers in ff_interleave_add_packet()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bfb3ed1a9d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 12:48:38 +02:00
Michael Niedermayer
e348564030 Merge commit 'e3c4eb87e4d9650d76f6d8d790a9b749b325e973' into release/2.2
* commit 'e3c4eb87e4d9650d76f6d8d790a9b749b325e973':
  avpacket: Check for and return errors in ff_interleave_add_packet()

Conflicts:
	libavformat/audiointerleave.c
	libavformat/internal.h
	libavformat/mux.c

See: 4d7c71c364
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 12:47:00 +02:00
Michael Niedermayer
c0d6afa3e6 avformat/mpegts: Also parse the FMC descriptor if the codec has not been identified yet
Fixes Detecting AAC with such descriptor if the parts needed for detection
are later in the stream

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 14e9a20083)

Conflicts:

	libavformat/mpegts.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 12:40:30 +02:00
Michael Niedermayer
0ca612a765 avformat/mpegts: reset last_version on seeking
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6397814926)

Conflicts:

	libavformat/mpegts.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 12:38:14 +02:00
Michael Niedermayer
f30a57f5af Merge commit 'feedde4d8702d554a7f46de824a887fe4d75a714' into release/2.2
* commit 'feedde4d8702d554a7f46de824a887fe4d75a714':
  mpegts: Update the PSI/SI table only if the version change

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 12:34:54 +02:00
Michael Niedermayer
194bd16cfa Merge commit '4c4cc9b27b69a86e405fd7612aa0a62f3b62b027' into release/2.2
* commit '4c4cc9b27b69a86e405fd7612aa0a62f3b62b027':
  rtsp: Make sure we don't write too many transport entries into a fixed-size array

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 12:27:33 +02:00
Michael Niedermayer
ae6429e633 Merge commit '1f1686615c20982a68b2d8db3ff109834a260d27' into release/2.2
* commit '1f1686615c20982a68b2d8db3ff109834a260d27':
  rtpenc_jpeg: Handle case of picture dimensions not dividing by 8

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-06-01 12:27:07 +02:00
Luca Barbato
c34d1099db nut: Make sure to clean up on read_header failure
Based on Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> work.

CC: libav-stable@libav.org
(cherry picked from commit 1f64b018cb)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2015-05-31 11:19:45 -04:00
Andreas Cadhalpun
0654518597 avi: Validate sample_size
And either error out or set it to 0 if it is negative.

CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit a55a706448)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2015-05-31 11:19:22 -04:00
Andreas Cadhalpun
3bebca9634 nut: Check chapter creation in decode_info_header
This fixes a segmentation fault when accessing the metadata.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org
(cherry picked from commit 21b21aed79)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2015-05-31 11:19:11 -04:00
Michael Niedermayer
296d70f585 mux: Do not leave stale side data pointers in ff_interleave_add_packet()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
(cherry picked from commit 386e80610d)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2015-05-31 11:18:03 -04:00
Nidhi Makhijani
e3c4eb87e4 avpacket: Check for and return errors in ff_interleave_add_packet()
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 324ff59444)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2015-05-31 11:17:37 -04:00
John Högberg
feedde4d87 mpegts: Update the PSI/SI table only if the version change
If a PAT is finished while a PMT section filter is opened but
not yet finished, the PMT section filter is closed and all
the received data is discarded.

This is usually not an issue but some multiplexers (With very
quick PAT/PMT repetition settings) consistently emit a PMT
section start, then a PAT, and then the rest of the PMT,
causing the aforementioned behavior to result in no PMT being
finished.

In the most pathologic situation the stream information are lost
and the probe fallback miscategorizes subtitles as mp3 audio.

Avoid the issue through eliminating redundant PSI/SI table
updates by checking their version field, which is required by
the standard to be incremented on every change no matter how
minor.

CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 844201e35f)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Conflicts:
	libavformat/mpegts.c
2015-05-31 11:14:03 -04:00
Martin Storsjö
4c4cc9b27b rtsp: Make sure we don't write too many transport entries into a fixed-size array
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f77c9d7161)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2015-05-31 11:11:30 -04:00
Andrey Utkin
1f1686615c rtpenc_jpeg: Handle case of picture dimensions not dividing by 8
This fixes the calculation of the number of needed blocks to make
sure that ALL pixels are represented by the result.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4415d0f3bb)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2015-05-31 11:11:13 -04:00
Vittorio Giovara
8b9d0f5d3a mov: Fix little endian audio detection
Set this field to TRUE if the audio component is to operate on
little-endian data, and FALSE otherwise.

However TRUE and FALSE are not defined. Since this flag is just a boolean,
interpret all values except for 0 as little endian.

Sample-Id: 64bit_FLOAT_Little_Endian.mov
(cherry picked from commit 8ae4d4e117)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2015-05-31 11:10:56 -04:00
Michael Niedermayer
b34afd94ec Merge commit 'bac0850fbf870d4354d0f68840c0b1c9c1425c4a' into release/2.2
* commit 'bac0850fbf870d4354d0f68840c0b1c9c1425c4a':
  matroskadec: fix crash when parsing invalid mkv

Conflicts:
	libavformat/matroskadec.c

See: d9fe6b926c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-05-06 16:46:59 +02:00
Thomas Guillem
bac0850fbf matroskadec: fix crash when parsing invalid mkv
CC: libav-stable@libav.org

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit b8d7f3186e)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 3e1c9da38b)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	libavformat/matroskadec.c
2015-04-18 17:06:07 +02:00
Michael Niedermayer
0bcb669ecc avformat/mov: Disallow ".." in dref unless use_absolute_path is set
as this kind of allows to circumvent it to some extend.
We also could add a separate parameter or value to choose this

Found-by: ramiro
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e4d0498df)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-04-07 12:43:05 +02:00
Michael Niedermayer
bf0d2ee92c avformat/mov: Check for string truncation in mov_open_dref()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8003816e16)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 21:59:49 +01:00
Michael Niedermayer
53239e50ed avformat/mov: Use sizeof(filename) instead of a literal number
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 21a53dd08d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 21:58:28 +01:00
Andreas Cadhalpun
88cc4a405a ffmdec: fix infinite loop at EOF
If EOF is reached, while skipping bytes, avio_tell(pb) won't change
anymore, resulting in an infinite loop.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6fa98822eb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:23 +01:00
Andreas Cadhalpun
97fb0b2109 avformat/flvenc: check that the codec_tag fits in the available bits
flags is later written with avio_w8 and if it doesn't fit in one byte it
triggers an av_assert2.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e8565d21c2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:23 +01:00
Andreas Cadhalpun
4e11780b85 avformat/bit: only accept the g729 codec and 1 channel
Other codecs/channel numbers are not supported by this muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d0b8640f75)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:23 +01:00
Andreas Cadhalpun
3183c20781 avformat/bit: check that pkt->size is 10 in write_packet
Ohter packet sizes are not supported by this muxer.

This avoids a null pointer dereference of pkt->data.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eeda2c3de8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:23 +01:00
Andreas Cadhalpun
3193f4d3f2 avformat/adxdec: check avctx->channels for invalid values
This avoids a null pointer dereference of pkt->data.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7faa40af98)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:23 +01:00
Michael Niedermayer
2bb09b714a avformat/omadec: Use 64bit for ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0f55bc29d4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:22 +01:00
Michael Niedermayer
c5c39132b4 avformat/vqf: Use 64bit for ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cb08687180)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:22 +01:00
Michael Niedermayer
c4b5b3309c avformat/mvdec: Use 64bit for ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 26c0cc154e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:22 +01:00
Michael Niedermayer
2ee4b48c9b avformat/gxf: Use 64bit for res to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 12987f8900)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:22 +01:00
Michael Niedermayer
1077380513 avformat/idcin: Use 64bit for ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d1923d15a3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:22 +01:00
Michael Niedermayer
a15ceebb6f avformat/asfdec: Use 64bit ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d4936d28a1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-14 14:27:22 +01:00
Andreas Cadhalpun
7a3ff7fb81 ffmdec: make sure the time base is valid
A negative time base can trigger assertions.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c91d81be2)

Conflicts:

	libavformat/ffmdec.c
(cherry picked from commit 9678ceb6976ca8194848b24535785a298521211f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-11 00:18:24 +01:00
Andreas Cadhalpun
4f53eaaafa ffmdec: limit the backward seek to the last resync position
If resyncing leads to the same position as previously, it will again
lead to a resync attempt, resulting in an infinite loop.

Thus don't seek back beyond the last syncpoint.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6b8263b03a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-11 00:18:22 +01:00
Michael Niedermayer
19640e99df Merge commit '0051174c70810b66378cf8ea093eab01302f6049' into release/2.2
* commit '0051174c70810b66378cf8ea093eab01302f6049':
  rmenc: limit packet size

Conflicts:
	libavformat/rmenc.c

See: 08728f400b
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 13:26:02 +01:00
Andreas Cadhalpun
25b73ae265 avformat/rm: limit packet size
The chunk size is limited to 0xFFFF (written by avio_wb16), so make
sure that the packet size is not too large.

Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

See Ticket244

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08728f400b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 12:58:53 +01:00
Andreas Cadhalpun
0051174c70 rmenc: limit packet size
The chunk size is limited to UINT16_MAX (written by avio_wb16), so make
sure that the packet size is not too large.

Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-08 19:36:26 +00:00
Vittorio Giovara
c47cdf837c img2dec: correctly use the parsed value from -start_number
Previously the image sequence was always starting from the minimum
number rather than the requested one.

CC: libav-stable@libav.org
2015-02-22 23:56:00 +00:00
Michael Niedermayer
7c3a3d47cf avformat/thp: Check av_get_packet() for failure not only for partial output
Fixes null pointer dereference
Fixes: signal_sigsegv_db2c1f_3108_cov_163322880_pikmin2_opening1_partial.thp

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f2579dbb4b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:18 +01:00
Michael Niedermayer
b902eab45a avformat/mpc8: Use uint64_t in *_get_v() to avoid undefined behavior
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 05e1619529)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:18 +01:00
wm4
79d86b844f avformat/mpc8: fix broken pointer math
This could overflow and crash at least on 32 bit systems.

Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b737a2c528)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:18 +01:00
wm4
3d8c51d699 avformat/mpc8: fix hang with fuzzed file
This can lead to an endless loop by seeking back a few bytes after each
attempted chunk read. Assuming negative sizes are always invalid, this
is easy to fix. Other code in this demuxer treats negative sizes as
invalid as well.

Fixes ticket #4262.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56cc024220)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:18 +01:00
wm4
c7dc73a6c3 avformat/tta: fix crash with corrupted files
av_add_index_entry() can fail, for example because the parameters are
invalid, or because memory allocation fails. Check this; it can actually
happen with corrupted files.

The second hunk is just for robustness. Just in case functions like
ff_reduce_index() remove entries. (Not sure if this can actually
happen.)

Fixes ticket #4294.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6a0cd529a3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-17 19:43:18 +01:00