Commit Graph

20332 Commits

Author SHA1 Message Date
Michael Niedermayer
9b2ce61155 avformat/mov: Move +1 in check to avoid hypothetical overflow in add_ctts_entry()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb60b9d3aa)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
e26ae6e6ce avformat/mov: Check STSC and remove invalid entries
Fixes assertion failure
Fixes: crbug 822547, crbug 822666 and crbug 823009

Affects: aark15sd_9A62E2FA.mp4

Found-by: ClusterFuzz
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9e67447a4f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
8280448784 avformat/mov: Fix integer overflows related to sample_duration
Fixes: runtime error: signed integer overflow: -9166684017437101870 + -2495066639299164439 cannot be represented in type

Fixes: Chromium bug 791349

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2f37082827)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
3fa6e594a0 avformat/img2dec: fix infinite loop
Fixes: kira-poc

Found-by: Kira <kira_cxy@foxmail.com>
Change suggested by Kira
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6cba06205)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
24c627a900 avformat/oggparsedaala: Do not adjust AV_NOPTS_VALUE
Fixes: potential signed integer overflow

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f655ddfb47)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
0cdc3e05cb avformat/oggparseogm: Check lb against psize
No testcase, this was found during code review

Found-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3e7c847aaf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
a376fcaa39 avformat/oggparseogm: Fix undefined shift in ogm_packet()
Fixes: shift exponent 48 is too large for 32-bit type 'int'
Fixes: Chromium bug 786793
Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 010b7b30b7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
79efbd547e avformat/avidec: Fix integer overflow in cum_len check
Fixes: signed integer overflow: 3775922176 * 4278190080 cannot be represented in type 'long'
Fixes: Chromium bug 791237

Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 06e092e781)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
60f6767126 avformat/oggparsetheora: Do not adjust AV_NOPTS_VALUE
Fixes: Chromium bug 795653
Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'long'
Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 02ecda4aba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
fea47f6941 avformat/utils: Fix integer overflow of fps_first/last_dts
Fixes: runtime error: signed integer overflow: 7738135736989908991 - -7898362169240453118 cannot be represented in type 'long'
Fixes: Chromium bug 796778
Reported-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b1362e408)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
cd7a2954ae avformat/oggdec: Fix metadata memleak on multiple headers
Fixes: Chromium bug 800123
Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit da069e9c68)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
a05d577068 libavformat/oggparsevorbis: Fix memleak on multiple headers
Fixes: Chromium bug 800123
Reported-by: Matt Wolenetz <wolenetz@google.com>
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3934aa495d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
Michael Niedermayer
7a713cea22 avformat/mov: Fix integer overflow in mov_get_stsc_samples()
Fixes: runtime error: signed integer overflow: 5 * -2147483647 cannot be represented in type 'int'
Fixes: Chromium bug 817338
Reviewed-by: Matt Wolenetz <wolenetz@google.com>
Reported-by: Matt Wolenetz <wolenetz@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 367929bed9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-06-18 01:16:03 +02:00
James Almer
e4b95f710b avformat/hvcc: zero initialize the nal buffers past the last written byte
Prevents use of uninitialized values.

Fixes ticket #7038.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 9482ec1b20)
2018-02-24 00:38:15 -03:00
James Almer
3fdff40a32 avformat/matroskadec: ignore CodecPrivate if the stream is VP9
Defined in a recent revision of https://www.webmproject.org/docs/container/

This prevents storing the contents of CodecPrivate into extradata for
a codec that doesn't need nor expect any. It will among other things
prevent matroska specific binary data from being dumped onto other
formats during remuxing.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit acdea9e7c5)
2018-02-19 22:16:58 -03:00
Nikolas Bowe
e755482d36 avformat/lrcdec: Fix memory leak in lrc_read_header()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef5994e09d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-28 15:33:09 +01:00
Nikolas Bowe
facd0521e4 avformat/matroskadec: Fix float-cast-overflow undefined behavior in matroska_parse_tracks()
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e07649e618)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2018-01-28 15:33:09 +01:00
Michael Niedermayer
c5fd23879a avformat/utils: Fix warning: ISO C90 forbids mixed declarations and code
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-12-10 20:25:14 +01:00
Dale Curtis
36db62ca98 avformat/utils: Prevent undefined shift with wrap_bits > 64.
2LL << (wrap_bits=64 - 1) does not fit in int64_t; change the
code to use a uint64_t (2ULL) and add an av_assert2() to
ensure wrap_bits <= 64.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 03fbc0daa7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-12-07 23:38:06 +01:00
John Stebbins
f7357facd8 lavf/mov: fix huge alloc in mov_read_ctts
An invalid file may cause huge alloc.  Delay expansion of ctts entries
until the number of samples is known in mov_build_index.

Fixes: 23

Found-by: zhao dongzhuo, AD-lab of Venustech
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d015d3bf9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-12-07 23:38:06 +01:00
Michael Niedermayer
3ae71b648a avformat/aacdec: Fix leak in adts_aac_read_packet()
Fixes: chromium-773637/clusterfuzz-testcase-minimized-6418078673141760

Found-by: ossfuzz/chromium
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2779d33ed9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-12-07 23:38:06 +01:00
Dale Curtis
35c7a1df8a Close ogg stream upon error when using AV_EF_EXPLODE.
Without this there can be multiple memory leaks for unrecognized
ogg streams.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit bce8fc0754)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-12-07 23:38:06 +01:00
Dale Curtis
9a00ce0ff8 Fix leak of frame_duration_buffer in mov_fix_index().
Should be unconditionally freed at the end of mov_fix_index() in
case it hasn't been used during the fix up.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Sasi Inguva <isasi-at-google.com@ffmpeg.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d073be2291)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-12-07 23:38:06 +01:00
Jacob Trimble
8aabc4fdb5 avformat/mov: Propagate errors in mov_switch_root.
Signed-off-by: Jacob Trimble <modmaker@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2d9cf3bf16)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-12-07 23:38:06 +01:00
Fredrik Hubinette
53715eb13e avformat/mov: Check size of STSC allocation
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a6fdd75fe6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-12-07 23:38:06 +01:00
Luca Barbato
78b8aeee58 avformat: Free the internal codec context at the end
Avoid a use after free in avformat_find_stream_info.

(cherry picked from commit 9e4a5eb51b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-12-07 23:38:06 +01:00
James Almer
2940b3e17c avformat/matroskaenc: add missing allocation failure checks for stream durations
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 5f67073b4c)
2017-12-01 01:26:15 -03:00
James Almer
8d51090dcb avformat/matroskaenc: actually enforce the stream limit
Prevents out of array accesses. Adressess ticket #6873

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 9d464dc3fc)
2017-12-01 01:25:45 -03:00
Dale Curtis
ceed79323c Don't manipulate duration when it's AV_NOPTS_VALUE.
This leads to signed integer overflow.

Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit c5fd57f483)
2017-12-01 01:24:17 -03:00
Steven Liu
67c0793835 avformat/hlsenc: write fmp4 init header after first AV frame
fix ticket id: 6825

Signed-off-by: Steven Liu <lq@onvideo.cn>
Tested-by: Aman Gupta <aman@tmm1.net>
2017-11-15 17:53:42 -08:00
Timo Rothenpieler
62e99f026a avformat/hlsenc: allocate space for terminating null
Fixes CID #1420394
2017-11-15 17:53:38 -08:00
Steven Liu
e3c09fb986 avformat/hlsenc: reindent hlsenc code
Signed-off-by: Steven Liu <lq@onvideo.cn>
2017-11-15 17:53:35 -08:00
Steven Liu
fac3cfb6c1 avformat/hlsenc: check hls segment mode for ignore the init filename
ignore the fmp4_init_filename when in normal hls segment mode

Signed-off-by: Steven Liu <lq@onvideo.cn>
2017-11-15 17:53:27 -08:00
Steven Liu
9ccb6de56c avformat/hlsenc: reindent hlsenc code
Signed-off-by: Steven Liu <lq@onvideo.cn>
2017-11-15 17:53:21 -08:00
Steven Liu
6ad4d3c92f avformat/hlsenc: fix missing first segment bug in fmp4 mode
fix ticket id: #6776
fix code logic error, need not check first segment.

Signed-off-by: Steven Liu <lq@chinaffmpeg.org>
2017-11-15 17:53:18 -08:00
Steven Liu
d55794fafc avformat/hlsenc: fix base_output_dirname is null when basename_size is 0 bug
fix ticket id: #6777
when use argument hls_segment_filename, the basename_size will be 0

Signed-off-by: Steven Liu <lq@onvideo.cn>
2017-11-15 17:53:14 -08:00
Michael Niedermayer
e1de9eab3a Bump minor versions for branching 3.4
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2017-10-11 01:23:47 +02:00
bnnm
1954e625b1 avcodec/wmaprodec: support multichannel XMA stream configurations
Signed-off-by: bnnm <bananaman255@gmail.com>

Now accepts any combination of 1/2ch streams, described in the RIFF chunks/extradata
2017-10-09 17:06:19 +02:00
Carl Eugen Hoyos
14b1553939 lavf/adp: Fix the probe function on systems with signed char. 2017-10-09 02:57:48 +02:00
Carl Eugen Hoyos
2386cfc1ae lavf/rtpenc: Add support for little-endian G.726. 2017-10-07 20:47:10 +02:00
Carl Eugen Hoyos
50462e3e5e lavf/sdp: Fix MIME-type for big-endian G.726.
RFC 3551 defines "G726" for little-endian ("right-justified") G.726
and announces "AAL2-G726" for big-endian ("left-justified") G.726.
2017-10-07 20:41:38 +02:00
Carl Eugen Hoyos
a20f64bee2 lavf/img2dec: Auto-detect svg images. 2017-10-07 03:42:00 +02:00
James Almer
cc5b7601f7 avformat/mp3enc: flush buffered packets if referencing fails
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
2017-10-06 21:59:11 -03:00
Luca Barbato
1e27837265 rtsp: Move message parsing to a separate function
Make easier to handle the polling function before we implement
full threading support.

(cherry picked from libav commit ca960161f0)
Signed-off-by: James Almer <jamrial@gmail.com>
2017-10-06 00:22:10 -03:00
Lukas Stabe
1fd80106be avformat: fix id3 chapters
These changes store id3 chapter data in ID3v2ExtraMeta and introduce
ff_id3v2_parse_chapters to parse them into the format context if needed.

Encoders using ff_id3v2_read, which previously parsed chapters into the
format context automatically, were adjusted to call
ff_id3v2_parse_chapters.

Signed-off-by: wm4 <nfxjfg@googlemail.com>
2017-10-05 17:10:23 +02:00
Tobias Rapp
c941e99b7f avformat/wavenc: replace literal numbers with enum constants
Signed-off-by: Tobias Rapp <t.rapp@noa-archive.com>
2017-10-05 09:49:22 +02:00
Jan Ekström
ffc58b2ce2 movenc: take packet dts shifting into mention in check_pkt
This FFmpeg-specific "fuzzer fix" was never perfect, but now it
stopped encoding of actual content with a big enough DTS shift.
This returns the function to its original state of results
before negative CTS offsets were added.

I remember dealing with this function before, but somehow had
forgotten about it during VDD. The test cases not tripping this
over also didn't help.
2017-10-04 13:09:29 +02:00
James Almer
1e7b6e47d2 Merge commit '79331df362fb05a0d04ca9489c87e5b80077a3f4'
* commit '79331df362fb05a0d04ca9489c87e5b80077a3f4':
  rtsp: Lazily set up the pollfd array once

Merged-by: James Almer <jamrial@gmail.com>
2017-10-03 23:08:06 -03:00
James Almer
c2916564d8 Merge commit '5263f464db5f2df74ddf712f6d1221b24475fa8e'
* commit '5263f464db5f2df74ddf712f6d1221b24475fa8e':
  rtsp: Lazily allocate the pollfd array

Merged-by: James Almer <jamrial@gmail.com>
2017-10-03 21:40:22 -03:00
James Almer
7c74efeaf8 Merge commit 'b9b82151a1aaa8bbf389853a6142c4e101d80b86'
* commit 'b9b82151a1aaa8bbf389853a6142c4e101d80b86':
  rtsp: Move the pollfd setup out of the for loop

Merged-by: James Almer <jamrial@gmail.com>
2017-10-03 21:37:37 -03:00