8032 Commits

Author SHA1 Message Date
Michael Niedermayer
3b0b8c6531 Merge remote-tracking branch 'qatar/release/0.7' into release/0.8
* qatar/release/0.7:
  matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
  vorbis: Avoid some out-of-bounds reads
  vp3: fix oob read for negative tokens and memleaks on error. (cherry picked from commit 8370e426e42f2e4b9d14a1fb8107ecfe5163ce7f)
  avserver: Fix a bug where the socket is IPv4, but IPv6 is autoselected for the loopback address.
  vp3: fix streams with non-zero last coefficient

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2012-01-08 06:53:38 +01:00
Chris Evans
1f625431e2 matroskadec: Fix a bug where a pointer was cached to an array that might later move due to a realloc()
Fixes bug #190
Chromium bug #100492
related to CVE-2011-3893

Signed-off-by: Reinhard Tartler <siretart@tauware.de>

(cherry-picked from commit faaec4676cb4c7a2303d50df66c6290bc96a7657)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
2012-01-07 22:01:19 +01:00
Michael Niedermayer
d38580a7bb mpegtsenc: fix handling of large audio packets
(sorry i have no sample, just a user report)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e31c5ebe1146d98d17a5121312c5444432c81904)

Conflicts:

	libavformat/mpegtsenc.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-12-09 03:45:40 +01:00
Michael Niedermayer
5c6a2d9878 ac3probe: Detect Sonic Foundry Soft Encode AC3 as raw AC3.
Our ac3 code chain can handle it fine.
More ideal would be to write a demuxer that actually extracts what can be from the additional
headers and uses it for whatever it can be used for.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 30ca700ba17b9ba46f4648afa30559ad890f0221)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-21 16:47:53 +01:00
Michael Niedermayer
17c54e9317 mjpeg: support mpo
Fixes stereoscopic_photo.mpo

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1d23e5246c67f765dd5d119c9f3197bdae07330c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-21 16:47:49 +01:00
Michael Niedermayer
14d4eee547 Merge remote-tracking branch 'qatar/release/0.7' into release/0.8
* qatar/release/0.7:
  Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info.
  lavf: fix multiplication overflow in avformat_find_stream_info()
  lavf: fix invalid reads in avformat_find_stream_info()
  lavf: add avformat_find_stream_info()
  lavc: fix parentheses placement in avcodec_open2().
  lavc: introduce avcodec_open2() as a replacement for avcodec_open().

Conflicts:
	doc/APIchanges
	libavcodec/utils.c
	libavcodec/version.h
	libavformat/avformat.h
	libavformat/version.h

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-20 03:27:50 +01:00
Anton Khirnov
07624cfeaa Add a version bump and APIchanges entry for avcodec_open2 and avformat_find_stream_info. 2011-11-19 10:22:27 +01:00
Mans Rullgard
d6f763659c lavf: fix multiplication overflow in avformat_find_stream_info()
Converting to double before the multiplication rather than after
avoids an integer overflow in some cases.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 52767d891c665ab1124fe4ce82d99b59673de7d2)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-11-19 10:22:27 +01:00
Anton Khirnov
e297459eb6 lavf: fix invalid reads in avformat_find_stream_info()
(cherry picked from commit e358f7ee90fec591348ca05dff94ebaf4c1a098b)

Conflicts:

	libavformat/utils.c

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-11-19 10:22:27 +01:00
Anton Khirnov
afe2726089 lavf: add avformat_find_stream_info()
It supports passing options to codecs.
(cherry picked from commit a67c061e0f3b55ffcc96f336fc0998e44b86c8e4)

Conflicts:

	libavformat/utils.c

Signed-off-by: Anton Khirnov <anton@khirnov.net>
2011-11-19 10:22:27 +01:00
Michael Niedermayer
64a854d06b rawdec: use a default sample rate if none is specified.
Fixes "ffmpeg -f s16le -i /dev/zero"

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fca85ce5ecc8acba6a5cf10c5f99e932b26c6367)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-18 23:09:56 +01:00
Stefano Sabatini
91805f06a3 rawdec: add check on sample_rate
Prevent error condition in case sample_rate is unset or set to a negative
value. In particular, fix divide-by-zero error occurring in ffmpeg due to
sample_rate set to 0 in output_packet(), in code:

                ist->next_pts += ((int64_t)AV_TIME_BASE * ist->st->codec->frame_size) /
                    ist->st->codec->sample_rate;

Fix trac ticket #324.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-18 21:33:11 +01:00
Miroslav Slugeň
fd30240e98 libavformat: add support for G726 audio decoder in RTP and RTSP streams
Fixes Ticket611

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit df9c1cfb48c2d8ddb3c11b4d1e8c4c33c6b0d8a2)
2011-11-08 19:04:26 +01:00
Reimar Döffinger
54e4bf3296 Do not call parse_keyframes_index with NULL stream.
Seems to fix trac issue #569.
Sample is unfortunately not available, but it might be caused by
an index existing for non-existing audio stream (?).

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
(cherry picked from commit 6ea6ff053af2aff8a9a898292f9640efa9290c9f)
2011-11-08 19:03:22 +01:00
Tobias Rapp
d8acee792f mp3enc: avoid truncating id3v1 tags by one byte
Avoid writing the trailing null-byte for id3v1 tags if length reaches max length.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0f39fa0279e12c7a174d1da9294bffd95cb15c4c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 13:32:59 +01:00
Michael Niedermayer
0e3dec6b08 asfdec: Check packet_replic_size earlier
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 60fcc19bff49e0b1972eae014afc087afd94a415)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 13:32:50 +01:00
Justin Ruggles
241f15f1c9 tta: check for extradata allocation failure in tta demuxer
(cherry picked from commit f540ca22c5fb4504d959c295f55591a9ec2a8859)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 03:18:52 +01:00
Laurent Aimar
cbfd34246c mpegts: do not return from ff_mpegts_parse_packet() after having seen the first PMT
It prevents leaving the AVPacket uninitialized.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bc38e83793be5f7a184c88be55e556453a25224b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:56 +01:00
Laurent Aimar
feef77ec3a mpegts: fix return value when enough ts packets have been parsed or when the first PMT has been seen.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 49ec0c818dc3c1c293a582b57fb58ba611a10b32)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:52 +01:00
Alex Converse
e86e9f8b7a avio: Check for invalid buffer length.
(cherry picked from commit ab2940691ba76e1a9b0ce608db0dfc45021d741e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:23:33 +01:00
Ronald S. Bultje
d51c7b4cbe matroskadec: fix out of bounds write
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 723229c11f1400e6a09c8a1c9c27193f376eb1d1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:22:38 +01:00
Alex Converse
e58870a587 mov: 10l: Terminate string with 0 not '0'
(cherry picked from commit 7ad06beb2cf31d8a96f475361425d6cc95e8f176)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:21:57 +01:00
Alex Converse
5c18bcfd9c mov: Prevent illegal writes when chapter titles are very short.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:11:18 +01:00
John Brooks
2c0cddf255 rtpdec: Read the packet length for all RTCP packet types
This allows skipping past unsupported RTCP packet types, as
RFC 3550 section 6.1 mandates.

Currently this only has any practical effect if a sender puts
an unrecognized type before RTCP_BYE in a compounded packet, or
(incorrectly) does not put RTCP_SR first.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 07b77fe3871f86b87e35876d38f1969da5ece4b2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:09:05 +01:00
John Brooks
d398d042c1 rtpdec: Fix the minimum packet length for RTCP SR packets
We actually read 20 bytes of these packets.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5d6ecf5345c0913e2b66427ea062e7989201a139)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:08:54 +01:00
Alex Converse
9b6080f685 mxfdec: Fix some buffer overreads caused by the misuse of AVPacket related functions.
(cherry picked from commit 0c46e958d1fd3817b8e9fa048d0450d509c80378)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:02:29 +01:00
Laurent Aimar
b832e539c0 vqa: fix double free on corrupted streams
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e3123856c79c36507772ada1bcda6cfe36a1e297)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:00:58 +01:00
Mans Rullgard
edc942202b lavf: fix signed overflow in avformat_find_stream_info()
On the first iteration through this code, last_dts is always
INT64_MIN (AV_NOPTS_VALUE) and the subtraction overflows in
an invalid manner.  Although the result is only used if the
input values are valid, performing the subtraction is still
not allowed in a strict environment.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit a31e9f68a426f634e002282885c6c2eb1bfbea44)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 01:00:18 +01:00
Compn
d33a1d6507 riff: map 0x0038 to amrnb, works on http://video.mopoto.com/4/40/407/40709.avi
(cherry picked from commit 3ebab62fc67591fd9313fad32892d7d32e805422)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-11-04 00:40:21 +01:00
Loren Osborn
b981c5d4e0 mpegtsenc: Lift limit on PMT PID
Fixes Ticket518
(cherry picked from commit bf5c3bac51e422580aad011fcd927c818542f054)
2011-10-11 21:34:14 +02:00
Carl Eugen Hoyos
60171d8fa6 Do not set codec_tag property for matroska muxers.
Fixes ticket #8, #537.
2011-10-09 20:07:41 +02:00
Michael Niedermayer
a39b603bf6 lavf/utils: fix overestimation of the rational number density.
Fixes Ticket498

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2011-10-09 01:14:21 +02:00
Laurent Aimar
2e342df4a2 Fix use of uninitialized memory in 4X Technologies demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a1876e0072aa0c69f037e0cafaca1a54bf2e189b)
2011-10-02 05:45:01 +02:00
Michael Niedermayer
b0804f3705 Merge remote-tracking branch 'qatar/release/0.7' into release/0.8
* qatar/release/0.7: (73 commits)
  Update Changelog for 0.7.2 release
  Update RELEASE file for 0.7.2
  lavf: do not set codec_tag for rawvideo
  fate: allow testing with libavfilter disabled
  fate: separate lavf-mxf_d10 test from lavf-mxf
  Fix memory (re)allocation in matroskadec.c, related to MSVR-11-0080.
  movenc: fix NULL reference in mov_write_tkhd_tag
  movenc: create an alternate group for each media type
  flvdec: Check for overflow before allocating arrays
  ppc: fix some pointer to integer casts
  ppc: fix 32-bit PIC build
  rv34: Check for invalid slice offsets
  rv34: Fix potential overreads
  rv34: Avoid NULL dereference on corrupted bitstream
  rv10: Reject slices that does not have the same type as the first one
  lavf: Fix context pointer in av_open_input_stream when avformat_open_input fails
  oggdec: fix out of bound write in the ogg demuxer
  Fixed size given to init_get_bits().
  smacker: fix a few off by 1 errors
  Check for invalid VLC value in smacker decoder.
  ...

Conflicts:
	RELEASE
	libavcodec/avs.c
	libavcodec/ppc/asm.S
	libavcodec/rv34.c
	libavcodec/xan.c
	libavdevice/alsa-audio.h
	libavformat/flvdec.c
	libavformat/gxf.c
	libavformat/utils.c
	libswscale/x86/swscale_template.c
	tests/ref/lavf/mov
	tests/ref/lavf/mxf

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2011-10-01 22:42:41 +02:00
Michael Niedermayer
80331265ca avienc: Add a limit on the number of skiped frames muxed in a row.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9cb9e39c41959961bdb5a1fd51cdd25e10c050f3)
2011-10-01 21:04:04 +02:00
Laurent Aimar
67b704982f Fix double free on error in Deluxe Paint Animation demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d39d7122e34d2cf994d6dc474fe0c8bee2f7fcfd)
2011-10-01 20:59:42 +02:00
Laurent Aimar
fa79af6845 Check for out of bound writes in the avs demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5d44c061cf511d97be5fac8d76be2f3915c6e798)
2011-10-01 20:59:28 +02:00
Laurent Aimar
c23d5261f7 Check for corrupted data in avs demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1cce7def0a8eff2e7db294b7d195a0fb1a5043b0)
2011-10-01 20:59:20 +02:00
Martin Storsjö
932b5f3cbb lavf: Avoid using av_malloc(0) in av_dump_format
On OS X, av_malloc(0) returns pointers that cause crashes when
freed.

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e81e5e8ad2bb5746df0c343c396019aca165cf66)
2011-10-01 20:57:04 +02:00
Tomas Härdin
2451228b0c mov: Only touch extradata in mov_read_extradata() if codec_id is what we expect
Extradata should only be parsed from the avss, fiel, jp2h and alac atoms for
AVS, MJPEG, Motion JPEG 2000 and ALAC respectively.
This also fixes the mov demuxer coming up with bogus extradata for some
AVC-Intra samples due to the presence of fiel atoms.
(cherry picked from commit e571305a71494af195891e314b05936f040f89d3)
2011-10-01 20:53:53 +02:00
Nicolas George
17b6abab50 movenc: Replace av_realloc by av_realloc_f when relevant.
Signed-off-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 194c2432eecd97c36914956f3bf7781ac4fc6f3d)
2011-10-01 20:50:19 +02:00
Nicolas George
cfff8db729 gxfenc: Replace av_realloc by av_realloc_f when relevant.
Signed-off-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit af84d9bb9e8a69a715fc7596d6cbaa00ad00dc29)
2011-10-01 20:50:08 +02:00
Nicolas George
431937883f aviobuf: Replace av_realloc by av_realloc_f when relevant.
Signed-off-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 247a1dc84716cb033b538a5bd5ba8b33de0e8260)
2011-10-01 20:50:02 +02:00
Nicolas George
7bc9c32573 avienc: Replace av_realloc by av_realloc_f when relevant.
Signed-off-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e47cfe9e5c10eee3c8d0b6aff81792c0f10e66e1)
2011-10-01 20:49:55 +02:00
Nicolas George
1537f86a93 avidec: Replace av_realloc by av_realloc_f when relevant.
Signed-off-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 71e23d39a396f45bbdf258735b02a4bd5e25fd49)
2011-10-01 20:49:48 +02:00
Nicolas George
2a934e87b1 4xm: Replace av_realloc by av_realloc_f when relevant.
Signed-off-by: Nicolas George <nicolas.george@normalesup.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0cc44facf17153454727c26f2f40ee2f77b90df5)
2011-10-01 20:49:41 +02:00
Laurent Aimar
521dbccc11 Fix return value on EOF in mpc v8 demuxer.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7ec5ea437fc88ca58d7ac3cd12dfa2f0fbd4011f)
2011-10-01 20:30:35 +02:00
Michael Niedermayer
e394f7984c psxstr: improve probe to not misdetect so much.
The score of 50 can probably be raised if needed
Fixes Ticket490

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3f7dc480c1bf6abf4ac0f633a0c7e63d8eb29a55)
2011-10-01 19:31:06 +02:00
Michael Niedermayer
3aad92f3e6 lavf/utils: only complain about aspect missmatch when the difference is "meassureable"
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e8d8517b160bd2dea1279d19ec0efd83e00c8c6c)
2011-10-01 19:30:49 +02:00
Michael Niedermayer
4d36f7cf88 avformat_free_context: favor av_freep()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2a93f28a4b6eef8b93046e0b4e3225f2ff1e7324)
2011-10-01 01:32:37 +02:00