Prevents out of array writes
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 842b6c14bcfc1c5da1a2d288fd65386eb8c158ad)
Conflicts:
libavformat/mpegtsenc.c
(cherry picked from commit e87de3f50b765134588d0b048c32ed4b8acc16fb)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Might fix Ticket1907 (I have no testcase so i cant test)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4758e32a6c48044f77102a49110c79b4f338f648)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes Ticket1605
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 519ebb5ee5b89b8ecc80b4a4540fcbeb65cda172)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
A negative `size' will bypass FFMIN(). In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.
Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e692374f7962ea358c329de38c380103f8991b6)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Sanity checks like `data + size >= data_end || data + size < data' are
broken, because `data + size < data' assumes pointer overflow, which is
undefined behavior in C. Many compilers such as gcc/clang optimize such
checks away.
Use `size < 0 || size >= data_end - data' instead.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 902cfe2f74d777a7dc20ac68f2393b9f84b790c1)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This ensures that theres enough data for mpeg_probe() to recognize mpeg-ps
Fixes Ticket2583
Based on code by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c605adbf562fbf535e83ae427bb681bc45e440c8)
Fixes decoding with picky media players.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b448c0a68d0cc7dfef736267dfdaed0e213c020b)
Conflicts:
libavformat/movenc.c
Many players ignore broken aac frames, so don't abort mov or flv
muxing when encountering one, just print a warning instead.
Fixes ticket #2380.
(cherry picked from commit 1741fece7073f51efdd837a4f307ea2cdf3d1cfb)
Conflicts:
libavformat/flvenc.c
libavformat/movenc.c
If the first "special" character in a filename is a comma,
it can introduce protocol options, but only if there is a
colon at the end. Otherwise, it is just a filename with a
comma.
Fix trac ticket #2303.
(cherry picked from commit d9fad53f4b447db1e436dcf3fc4a57e604616e6c)
This reverts 312645e :
"Do not set codec_tag property for matroska muxers."
Also adds dummy codec_tag lists with codecs
supported in mkv but not in wav / avi.
Fixes ticket #2169.
(cherry picked from commit df39c3ce385c02cbd8046298578ea7454c0a0f81)
Conflicts:
libavformat/matroskaenc.c
Some files simply contain invalid info tags.
Fixes unrelated bug posted into Ticket1821
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 09456d0df13404f004ab3a341d9ac21b7e5e6d6d)
Fixes Ticket1821
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d0c27e88d2bb495d61bd32f41769f767a0c2a802)
This reverts commit 66f71f3b5e2e7b6e5049bd9831c371e16aff8a53.
This causes regressions with RDT.
(cherry picked from commit c4eec85a1fa768025f88261995af08f1dba9685d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
qatar does this too but clobbers the AVPacket.duration by approximate
values.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad8e3304f701820f927527d8f0d11679738636df)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Author: Michael Niedermayer <michaelni@gmx.at>
Date: Thu Nov 3 22:38:10 2011 +0100
lavf: fix null pointer dereference in rdt
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This is no longer needed and causes various problems with RTSP
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1171d938af219aa1217a472391bc392f6e698386)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
a realloc()
BUG=100492
Review URL: http://codereview.chromium.org/8366004
Fixes: 1 of 2 for CVE-2011-3893
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f35e037c93cf7d25e65b4a2ed3674358f05e4bed)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f37174bc1913d534913e8825f1609a637cc4b364)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
y41p is a packed 12-bit 4:1:1 YUV format used by Brooktree.
Fixes issue 1123 / ticket #102.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dfa77dead2c97ec84092066102b14a2524d4d88b)
Conflicts:
Changelog
libavcodec/version.h
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
this should fix the failure of h264-bsf-mp4toannexb on freebsd/openbsd
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 490c97bdf5ed1c6f05abe4446e67e598881fc53f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This works around issues arising from inputs that claim to have a
filesize of 0.
Reported-by: buzz_
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e6362f3a3cfbabf457fc7ebb2205cbfc043501ee)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
value before using its output.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5500e65342a2afc5caa8fe38496aa1a3b1f28cbc)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Jean First <jeanfirst@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 576ada791a5085b7427c9062ba4f65e811914bd0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes seeking in Enigma_Principles_of_Lust.flv
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit df0bff6643cadbd9c07bbe2b0536a7c9d0dfe0c6)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This can easily be NULL as string_size can be 2g in a damaged file.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b9e0e9537a3ec4af1630e9f1b8d0ce68885cac16)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bf5cc805190b5811b786a454f01cccf9a7e366b9)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
audio packet.
This prevents a potentially large memory allocation.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1795fed7bc7a8b8109757cb5f27198c5b05698b5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 27d323577c19af218f8a5ac33364f213b623a023)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0d4404ed65e6ebfdf5e3c09f9e3a2a41dde18e4a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 66f71f3b5e2e7b6e5049bd9831c371e16aff8a53)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 43abef9fde0cf87153cc9031cad61f75b02cfa01)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixes Ticket805
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad9e0ed170234bc6c5660f96752777965081163e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9f50dafe9025555f11e66e3b09cf3db2cd53cfb2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
When no data was available both the buffer thread as well as
the main thread would block in select(), when data becomes
available both should move forward and as data is read in the
buffer thread the main thread would block in select() later
the read data was put in the fifo but the main thread still
would be blocked in select() until either the timeout or
another packet would come in.
This is solved in this commit by using a mutex and a condition
variable
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bc900501e0e2002e40d2d0c87b5a98b913b2d1a2)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3dcbafc777513621e423c2f23b1725559230383d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a4209ad6313b8b40fed2bfc7e3865cf54d4c1022)
Conflicts:
Changelog
doc/general.texi
libavformat/version.h
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Fixed Ticket807
Bug found by: Oana Stratulat
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8d960fbc70d5d7b6cd62db22712a8d5c2c5e26bf)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Without this certain files could get the demuxer stuck in a loop
(cherry picked from commit 46d65fb8a574465499a470d0c34a30902e45176a)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
