Fixes wrong number of segments output and undefined memory access.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 58e0402e02)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The read_packet callback passes a pointer to a stack-allocated AVPacket.
Attempting to free it with av_free() makes no sense.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b173f5c155)
Conflicts:
libavformat/oggdec.c
(cherry picked from commit a82401b7284e05e2cf6fb89aeed53738af06a7fd)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Timothy Gu <timothygu99@gmail.com>
This file with the incorrect name was added after the name was fixed in all other files.
This is thus fixing a mistake
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 25cb697d0c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Buffers containing copies of the AAC and AC3 header bits were not padded
before parsing, violating init_get_bits() buffer padding requirement,
leading to potential buffer read overflows.
This change adds FF_INPUT_BUFFER_PADDING_SIZE bytes to the bit buffer
for parsing the header in each of aac_parser.c and ac3_parser.c.
Based on patch by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fccd85b9f3)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The allocation didn't account for headers, that can be easily 79 bytes.
As a result, buffers allocated for a few samples (e.g. 5 in the original
bug) could be undersized.
Fixed ticket #2881.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2ba58bec20)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The packet buffer allocation considered as dct-coded, while it is
actually run-coded and thus requires a larger buffer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 117bc8e6ff)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
If the allocated size, despite best efforts, is too small, exit
with the appropriate error.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 52b81ff463)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
0 means no data consumed, so it can trigger an infinite loop in the
caller.
CC:libav-stable@libav.org
(cherry picked from commit c7d9b473e2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
also check pbuffer before use
Found-by: CSA
Reviewed-by: Stefano Sabatini <stefasab@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1d8d21b90a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes part of ticket2236
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 956f4087c6)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes a infinite loop
Fixes Ticket3804
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cfdb30d2f1)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Regression since 39d11d599c
os->pduration would be wrongly assigned a negative value on invalid packets
instead of aborting.
Signed-off-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c619e14c31)
based on code from oggparsevorbis
Fixes Ticket3124
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7f39352a1b)
Fixes ticket #3943.
This caused mpv (and possibly others) to fallback to software decoding after
seeking a VC1 stream.
Bug-Id: 667
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit cdf6eb5a97)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This simplifies the management of current_sps
Fixes Ticket3458
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 880dbe43ca)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 30b6e9377d3b0b1341147d8484fce24301e7b8a0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0fc2045d5f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cf99ce9a7744763ea2950f45e7ffe18af8f4e0f5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes leaving a pointer to unreferenced memory
Fixes Ticket 3115
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ccd6911c18)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ec0ec65ee46d1367938dc46036fe61ad0384cbd5)
Conflicts:
libavcodec/hevc.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8bbadc9b6e)
Conflicts:
ffmpeg.c
(cherry picked from commit 8fae6207e30059611cdc788ad440b6831637f86f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The AVStream.parser field is considered private and its location cannot be
preserved while preserving also ABI compatibility to libav, as libav added fields
before it.
Some tools like ffmpeg.c access this field though
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 62227a70f0)
Conflicts:
RELEASE_NOTES
doc/APIchanges
libavformat/utils.c
libavformat/version.h
(cherry picked from commit a78e6363e9a7ef90bd1ff4aeceee8e5501cbc6d4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes long loop
Fixes Ticket3208
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8202c49b43)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This makes C and MMX match, no change to fate as the differences where
apparently not sufficient to show up in fate
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b8255a4c70)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This should avoid issues on x86_64
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6dffc8f5aa)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
