Commit Graph

9064 Commits

Author SHA1 Message Date
Luca Barbato
e7800543fe westwood_vqa: do not free extradata on error in read_header
The extradata is already freed by avformat_open_input on
failure.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 76f5dfbfd9)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 11:28:10 +02:00
Michael Niedermayer
a747cf8873 rmdec: Use the AVIOContext given as parameter in rm_read_metadata()
This fixes crashes when playing back certain RealRTSP streams.

When invoked from the RTP depacketizer, the full realmedia
demuxer isn't invoked, but only certain functions from it, where
a separate AVIOContext is passed in as parameter (for the buffer
containing the data to parse). The functions called from within
those entry points should only be using that parameter, not
s->pb. In the depacketizer case, s is the RTSP context, where ->pb
is null.

Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d35b6cd377)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 11:07:52 +02:00
Michael Niedermayer
002ca3e099 avio: Handle AVERROR_EOF in the same way as the return value 0
This makes sure the ffurl_read_complete function actually
returns the number of bytes read, as the documentation of the
function says, even if the underlying protocol uses AVERROR_EOF
instead of 0.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d876be87a)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 11:06:55 +02:00
Luca Barbato
fa6eef4210 wtv: Mark attachment with a negative stream id
A sid 0 would be mismatched to the attachment.

Prevent NULL pointer dereference.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit f5e646a00a)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 11:06:33 +02:00
Luca Barbato
c2c9b7297f avidec: Let the inner dv demuxer take care of discarding
(cherry picked from commit c8f0b20b4a)

CC: libav-stable@libav.org
2013-07-27 16:32:32 +02:00
Kostya Shishkov
7e326d52a7 smacker: check frame size validity
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 07423ad7836325e03894f2f87ba46a531a1cc0b3)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-06-16 15:58:29 +02:00
Kostya Shishkov
71b8ef938c smacker: pad the extradata allocation
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 4c22baf65363433f8c20efd1022b4ba2d8cf2288)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-06-16 15:58:27 +02:00
Luca Barbato
3f71c0c1b0 4xm: do not overread while parsing header
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 42d73f7f6b)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-06-16 15:53:18 +02:00
Luca Barbato
ea56f6e5a7 4xm: refactor fourxm_read_header
Split sound and video tag parsing in separate functions.
(cherry picked from commit e7a44f87d0)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/4xm.c
2013-06-16 15:53:04 +02:00
Luca Barbato
9ac3c6c2c6 4xm: K&R formatting cosmetics
(cherry picked from commit e6496ea7e7)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-06-16 15:15:18 +02:00
Anton Khirnov
042b8c2f06 apetag: use int64_t for filesize
CC: libav-stable@libav.org
(cherry picked from commit e816aaacd6)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-06-08 16:31:54 +02:00
Luca Barbato
77a2f4cbcf oma: properly forward errors in oma_read_packet
Prevent spurios EIO on EOF.

CC:libav-stable@libav.org
(cherry picked from commit db9aee6ccf)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-11 12:00:54 +02:00
Luca Barbato
52ab9e8984 wav: Always seek to an even offset
RIFF chunks are aligned to 16bit according to the specification.

Bug-Id:500
CC:libav-stable@libav.org
(cherry picked from commit ac87eaf856)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-07 21:32:09 +02:00
Anton Khirnov
0662967d2b hls, segment: fix splitting for audio-only streams.
CC:libav-stable@libav.org
(cherry picked from commit cf679b9476)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-05-04 10:53:18 +02:00
Luca Barbato
5aac081110 id3v2: check for end of file while unescaping tags
Prevent an out of buffer bound write.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit af4cc2605c)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-05-03 19:22:07 +02:00
Luca Barbato
c046890191 riff: check for eof if chunk size and code are 0
Prevent an infinite loop.

Inspired by a patch from Michael Niedermayer

CC: libav-stable@libav.org

Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit 8e329dba37)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-21 22:46:41 +02:00
Luca Barbato
d70bad04de oggdec: fix faulty cleanup prototype
(cherry picked from commit fba8e5b608)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-21 18:51:25 +02:00
Michael Niedermayer
c8462bd17f mp3dec: fallback to generic seeking when a TOC is not present
Fixes seeking without a Xing/Info header.

CC: libav-stable@libav.org
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 505642f182)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-19 20:26:56 +02:00
Anton Khirnov
5ebdfbe893 id3v2: pad the APIC packets as required by lavc.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
2013-04-08 22:25:27 +02:00
Anton Khirnov
094a35aeef lavf: make sure stream probe data gets freed.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit dbb1425811)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:48:10 +02:00
Anton Khirnov
858864d350 xmv: check audio track parameters validity.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit d1016dccdc)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:47:41 +02:00
Anton Khirnov
7594868296 xmv: do not leak memory in the error paths in xmv_read_header()
CC: libav-stable@libav.org
(cherry picked from commit f8080bd13b)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:40:20 +02:00
Luca Barbato
09e391abd8 matroska: pass the lace size to the matroska_parse_rm_audio
Each lace must be independent according to the specification.

Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.

Stricter check than fc43c19a56

CC: libav-stable@libav.org
(cherry picked from commit 25a80a931a)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:40:05 +02:00
Dale Curtis
b90816d94b matroska: Update the available size after lace parsing
Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.

CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit fc43c19a56)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:39:39 +02:00
Luca Barbato
05015d03da matroska: fix a corner case in ebml-lace parsing
Make sure we notice when the lace_size[n] is a negative value.

CC: libav-stable@libav.org
(cherry picked from commit 8a96df7b70)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-04-06 11:39:28 +02:00
Luca Barbato
c0f7df9662 oma: Validate sample rates
The sample rate index is 3 bits even if currently index 5, 6 and 7 are
not supported.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 0933fd1533)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-31 18:07:31 +02:00
Justin Ruggles
c6dce25967 flvdec: read audio sample size and channels metadata
This is needed in order for the FLV demuxer not to detect a codec change when
using the "flv_metadata" option.
(cherry picked from commit e46a2a7309)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-31 10:38:22 +02:00
Justin Ruggles
aba56c03b9 flvdec: use the correct audio codec id when parsing metadata
(cherry picked from commit c3d0157753)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-31 10:38:20 +02:00
Kostya Shishkov
31a77177ff iff: validate CMAP palette size
Fixes CVE-2013-2495

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

CC: libav-stable@libav.org
(cherry picked from commit 50c449ac24)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-18 20:23:37 +01:00
Xi Wang
9d4355d90a flacdec: simplify bounds checking in flac_probe()
Simplify `p->buf > p->buf + p->buf_size - 4' as `p->buf_size < 4'.
Avoid a possible out-of-bounds pointer, which is undefined behavior
in C.

CC: libav-stable@libav.org

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

(cherry picked from commit 8425d693ee)
2013-03-15 13:21:07 +01:00
Alexander Kojevnikov
d3b40af01f mp3dec: Fix VBR bit rate parsing
When parsing the Xing/Info tag, don't set the bit rate if it's an Info tag.

When parsing the stream, don't override the bit rate if it's already set,
otherwise calculate the mean bit rate from parsed frames. This way, the bit
rate will be set correctly both for CBR and VBR streams.

CC:libav-stable@libav.org

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit eae0879d96)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-09 18:01:09 +01:00
Martin Storsjö
efa8603518 flvdec: Check the return value of a malloc
The callers of this function can't report errors sanely. If this
one malloc fails, don't write the extradata byte, make sure we
try to malloc it the next time we're called instead, and make sure
we still consume the input data byte.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c5a738ca4e)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-02 09:55:33 +01:00
Martin Storsjö
1b0082eabc flvdec: Don't read the VP6 header byte when setting codec type based on metadata
This header byte is only present when actually reading a VP6 frame,
not when reading the codec type field in the metadata. This
potential bug has been present since 5b54a90c.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c91c63b538)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-03-02 09:55:21 +01:00
Anton Khirnov
488ffb8135 mov: use the format context for logging.
CC:libav-stable@libav.org
(cherry picked from commit 56daf10e03)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2013-02-23 14:39:52 +01:00
Martin Storsjö
a856623e87 rtpenc_chain: Use the original AVFormatContext for getting payload type
In ff_rtp_get_payload_type, the AVFormatContext is used for checking
whether the payload_type or rtpflags options are set. In rtpenc_chain,
the rtpctx struct is a newly initialized struct where no options have
been set yet, so no options can be fetched from there.

All muxers that internally chain rtp muxers have the "rtpflags" field
that allows passing such options on (which is how this worked before
8034130e06), so this works just as intended.

This makes it possible to produce H263 in RFC2190 format with chained
RTP muxers.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4a4a7e138c)

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-24 11:58:09 +02:00
Martin Storsjö
348cd84fc8 rtp: Make sure the output format pointer is set
Not sure if this actually happens, but we do the same check when
checking payload_type further above in the function, so it might
be needed.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 932117171f)

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-24 11:57:29 +02:00
Martin Storsjö
62de693a17 rtp: Make sure priv_data is set before reading it
This fixes crashes with muxing H263 into RTSP.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e90820d4f8)

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-24 11:56:43 +02:00
Dale Curtis
ca2e3f1131 matroska: Fix use after free
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit ae3d416369)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-01-11 02:17:19 +01:00
Luca Barbato
c01be297ce oggdec: make sure the private parse data is cleaned up
(cherry picked from commit d894f74762)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-01-07 09:00:09 +01:00
Luca Barbato
42bd6d9cf6 oggdec: free the ogg streams on read_header failure
Plug an annoying memory leak on broken files.
(cherry picked from commit 89b51b570d)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-01-07 09:00:04 +01:00
Xi Wang
3b81bba3bc mxfdec: fix NULL checking in mxf_get_sorted_table_segments()
The following out-of-memory check is broken.

    *sorted_segments  = av_mallocz(...);
    if (!sorted_segments) { ... }

The correct NULL check should use *sorted_segments.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
2013-01-04 20:43:42 -05:00
Martin Storsjö
53c25ee073 aviobuf: Discard old buffered, previously read data in ffio_read_partial
This makes RTP custom IO work properly with pure read-only
AVIOContexts as well.

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-03 15:17:10 +02:00
Martin Storsjö
e96406eda4 rtsp: Add support for depacketizing RTP data via custom IO
To use this, set sdpflags=custom_io to the sdp demuxer. During
the avformat_open_input call, the SDP is read from the AVFormatContext
AVIOContext (ctx->pb) - after the avformat_open_input call,
during the av_read_frame() calls, the same ctx->pb is used for reading
packets (and sending back RTCP RR packets).

Normally, one would use this with a read-only AVIOContext for the
SDP during the avformat_open_input call, then close that one and
replace it with a read-write one for the packets after the
avformat_open_input call has returned.

This allows using the RTP depacketizers as "pure" demuxers, without
having them tied to the libavformat network IO.

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-03 15:15:27 +02:00
Martin Storsjö
3f95f0dda5 rtpdec: Move the URLContext used for RTCP RR out from the context, to a parameter
Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-03 15:14:34 +02:00
Martin Storsjö
a0b7e28907 aviobuf: Partial support for reading in read/write contexts
So far, aviocontexts are used either in pure-read or pure-write
mode - full read/write mode doesn't work well (and implementing it
is a much larger, not totally trivial change).

This patch allows using avio_read and ffio_read_partial on
read/write aviocontexts, where the read operations are passed
through directly unbuffered, while writes are buffered as usual.

This is enough to support the operations needed by packet based
data transfer like in udp/rtp, where aviocontext is the only
public API for hooking up custom IO.

Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-03 15:14:09 +02:00
Clément Bœsch
3048fae63c build: Avoid detecting bogus components named 'x'
The function find_things() in configure is confused by component
registration calls as part of multiline macros defining combined
component registration.  Coalesce those macros into one line to
work around the issue.

Signed-off-by: Diego Biurrun <diego@biurrun.de>
Signed-off-by: Martin Storsjö <martin@martin.st>
2013-01-03 15:11:25 +02:00
Martin Storsjö
c1ea44c54d rtmp: Add support for limelight authentication
Limelight is a not too uncommon CDN. The authentication scheme is
pretty similar to the adobe authentication, but is even closer to
normal http digest authentication (but not close enough to warrant
sharing code) than the adobe version.

Signed-off-by: Martin Storsjö <martin@martin.st>
2012-12-31 13:39:09 +02:00
Martin Storsjö
08225d0126 rtmp: Add support for adobe authentication
This is mostly used to authenticate the client when publishing.
Tested with wowza and akamai.

Some but not all servers support resending a new connect invoke
within the same connection, so always reconnect for sending a new
connection attempt. This matches what other applications do as well.

The authentication scheme is structurally pretty similar to http
digest authentication, but uses base64 instead of hex strings.

Signed-off-by: Martin Storsjö <martin@martin.st>
2012-12-31 13:39:08 +02:00
Martin Storsjö
33f28a3be3 rtmp: Add a function for writing AMF strings based on two substrings
This avoids having to concatenate them into one buffer before writing
them as AMF.

Signed-off-by: Martin Storsjö <martin@martin.st>
2012-12-31 13:39:07 +02:00
Martin Storsjö
c76daa89ab rtmp: Return a proper error code in handle_invoke_error
Signed-off-by: Martin Storsjö <martin@martin.st>
2012-12-31 13:39:06 +02:00