The size variable is (correctly) unsigned, but is passed to several functions
which take signed parameters, such as avio_read, sometimes after having
numbers added to it. So ensure that size remains within the bounds that
these functions can handle.
(cherry picked from commit b45ab61b24)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
* commit '7788297a59656ececd84f602292bfeb79f7eedd7':
mpegts: Do not try to write a PMT larger than SECTION_SIZE
Conflicts:
libavformat/mpegtsenc.c
See: 842b6c14bc
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '23376ae2f0247ff659724b6a5313639db0c991ad':
mpegts: Define the section length with a constant
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Prevent out of array writes.
Similar to what Michael Niedermayer did to address the same issue.
Bug-Id: CVE-2014-2263
CC: libav-stable@libav.org
Signed-off-by: Diego Biurrun <diego@biurrun.de>
(cherry picked from commit e8049af132)
Conflicts:
libavformat/mpegtsenc.c
The specification says the value is expressed in 10 bits including
the 4-byte CRC.
(cherry picked from commit 89616408e3)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Conflicts:
libavformat/mpegtsenc.c
* commit 'f6b3dce952d66f87883a50d90d6e98416ee397df':
librtmp: Don't free the temp url at the end of rtmp_open
Conflicts:
libavformat/librtmp.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
librtmp can keep pointers to this string internally, and may
use them at shutdown as well.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 865461099e)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavformat/librtmp.c
The AVStream.parser field is considered private and its location cannot be
preserved while preserving also ABI compatibility to libav, as libav added fields
before it.
Some tools like ffmpeg.c access this field though
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 62227a70f0)
Conflicts:
RELEASE_NOTES
doc/APIchanges
libavformat/utils.c
libavformat/version.h
Fixes long loop
Fixes Ticket3208
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8202c49b43)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
On big endian machines, the default value set via the faulty
AVOption ended up as 2^32 times too big.
This fixes the fate-lavf-ogg test which currently is broken on
big endian machines, broken since 3831362. Since that commit,
a final zero-sized packet is written to the ogg muxer in that test,
which caused different flushing behaviour on little and big endian
depending on whether the pref_duration option was handled as it
should or not.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 103243ca64)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
As indicated in the function documentation, the header MUST be
checked prior to calling it because no consistency check is done
there.
CC:libav-stable@libav.org
(cherry picked from commit f2f2e7627f)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Fixes missdetection of Misdetection_345.mp3
Fixes missdetection of Misdetection_421.mp3
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cd20b93e2f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This avoids some unneeded computations
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6f6edfe1c0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Google's plugin for the Internet Explorer refuses to play
files with another document version.
Fixes ticket #3583.
(cherry picked from commit ab21acecc7)
The code was missing 1 bit in the src format
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc145e576a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes part of Ticket3466
Found-by: Andrey_Karpov / PVS-Studio
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ff6fa0b4b9)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '79041d92ee7421853ee8c57fc13891cb0c272e0e':
matroska: add the Opus mapping
Conflicts:
libavformat/matroska.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '82cebc0e0544dce507749dd9b1c2983f083de836':
matroskadec: read the CodecDelay element
Conflicts:
libavformat/matroska.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'c4e764aa6980dd9dc7c423921b415ff7261c944a':
rtmpproto: Make sure to pass on the error code if read_connect failed
Merged-by: Michael Niedermayer <michaelni@gmx.at>
The muxer does not support this currently
Fixes ticket #3547.
Fixes ticket #3555.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 369cdf917a)
(cherry picked from commit 514ec9bece86fed440ac829c10e82c4a0569c3a5)
It appears the demuxer works fine without it
Fixes Ticket3534
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5b19fc7aae)
Previously, if read_connect failed, the ret variable was unmodified
and had the value 0, indicating success, which then was returned from
the rtmp_open function, even though it actually failed.
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 6477139721)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
