The time scale is set in mdhd, and later validated in the
enclosing trak atom once all of its children have been parsed.
A loose mdhd atom outside of a trak atom could update the time
scale of the last stream without any validation.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 31931520df)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This was handled properly in the normal return case at the end
of the function, but not in this special case.
Returning a value larger than the input packet size can cause
problems for certain library users.
Returning the actual input buffer size unconditionally, since
it is not guaranteed that frame_size is set to a sensible
value at this point.
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8f24c12be7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* qatar/release/0.8:
adpcm: Unbreak ima-dk4
ac3dec: validate channel output mode against channel count
dca: Respect the current limits in the downmixing capabilities
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'ce3ce08850f1690dff01d9bb4ed6a4274d52771e':
dca: Error out on missing DSYNC
pcm: always use codec->id instead of codec_id
mlpdec: Do not set invalid context in read_restart_header
pcx: Do not overread source buffer in pcx_rle_decode
wmavoice: conceal clearly corrupted blocks
iff: Do not read over the source buffer
qdm2: Conceal broken samples
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'b64bd2e18bac1bd3e3e0ae4aebcad1c33f031c66':
qdm2: refactor joined stereo support
adpcm: Write the correct number of samples for ima-dk4
imc: Catch a division by zero
atrac3: Error on impossible encoding/channel combinations
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Damaged frames can lead to a mismatch, which can cause a segfault
due to using an incorrect channel mapping.
CC:libav-stable@libav.org
(cherry picked from commit d7c450436f)
Conflicts:
libavcodec/ac3dec.c
The faulty values rippled further down the codepath causing a
hard-to-track segfault in the assembly code.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit e9d394f3fa)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/mlpdec.c
qdm2 does support only two channels. Loop over the run once.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit adadc3f244)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* commit 'e06623c48030530b50f00cee26f1a3a33c4b4d4b':
atrac3: set the getbits context the right buffer_end
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '09a098fb8bc7d70a0258b3e8d658833c8d11debe':
atrac3: fix error handling
qdm2: check and reset dithering index per channel
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '26589aa81028f42c763c5581a1486a271799890b':
westwood_vqa: do not free extradata on error in read_header
vqavideo: check the version
rmdec: Use the AVIOContext given as parameter in rm_read_metadata()
avio: Handle AVERROR_EOF in the same way as the return value 0
Conflicts:
libavcodec/vqavideo.c
libavformat/westwood_vqa.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '139f352daf84e005824562e0e0f36e06ac60ee36':
wtv: Mark attachment with a negative stream id
avidec: Let the inner dv demuxer take care of discarding
Conflicts:
libavformat/wtv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Checking per subband would have the index exceed the
dithering noise table size.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 744a11c996)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/qdm2.c
The extradata is already freed by avformat_open_input on
failure.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 76f5dfbfd9)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This fixes crashes when playing back certain RealRTSP streams.
When invoked from the RTP depacketizer, the full realmedia
demuxer isn't invoked, but only certain functions from it, where
a separate AVIOContext is passed in as parameter (for the buffer
containing the data to parse). The functions called from within
those entry points should only be using that parameter, not
s->pb. In the depacketizer case, s is the RTSP context, where ->pb
is null.
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d35b6cd377)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This makes sure the ffurl_read_complete function actually
returns the number of bytes read, as the documentation of the
function says, even if the underlying protocol uses AVERROR_EOF
instead of 0.
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d876be87a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
A sid 0 would be mismatched to the attachment.
Prevent NULL pointer dereference.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f5e646a00a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
* qatar/release/0.8:
swfdec: do better validation of tag length
Changelog for 0.8.8
kmvc: Clip pixel position to valid range
kmvc: use fixed sized arrays in the context
indeo: use a typedef for the mc function pointer
lavc: check for overflow in init_get_bits
indeo: check for reference when inheriting mvs
indeo: use proper error code
indeo: Properly forward the error codes
wmapro: error out on impossible scale factor offsets
wmapro: check the min_samples_per_subframe
wmapro: return early on unsupported condition
wmapro: check num_vec_coeffs against the actual available buffer
Conflicts:
Changelog
libavformat/swfdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '4ff5167ee7fdee6d35c1bb2558172329ae6ec770':
wmapro: make sure there is room to store the current packet
lavc: move put_bits_left in put_bits.h
4xm: do not overread the source buffer in decode_p_block
4xm: check bitstream_size boundary before using it
4xm: reject frames not compatible with the declared version
4xm: use the correct logging context
4xm: check the return value of read_huffman_tables().
4xm: don't rely on get_buffer() initializing the frame.
vmdav: convert to bytestream2
smacker: check frame size validity
smacker: pad the extradata allocation
smacker: check the return value of smacker_decode_tree
smacker: fix an off by one in huff.length computation
Prepare for 0.8.8 Release
tiff: do not overread the source buffer
apetag: use int64_t for filesize
wavpack: return meaningful errors
Conflicts:
RELEASE
libavcodec/4xm.c
libavcodec/vmdav.c
libavformat/smacker.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '42fed7f433e6d2167ffd4aae31905b583a53b988':
wavpack: check packet size early
mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
mjpeg: Validate sampling factors
ljpeg: use the correct number of components in yuv
wavpack: validate samples size parsed in wavpack_decode_block
jpegls: check the scan offset
jpegls: factorize return paths
jpegls: return meaningful errors
mjpegdec: properly report unsupported disabled features
update Changelog
proresdec: support mixed interlaced/non-interlaced content
update Changelog
wav: Always seek to an even offset
id3v2: check for end of file while unescaping tags
indeo3: fix off by one in MV validity check
aac: check the maximum number of channels
update Changelog
oggdec: fix faulty cleanup prototype
Conflicts:
Changelog
libavcodec/jpeglsdec.c
libavcodec/mjpegdec.c
libavformat/id3v2.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
