In matroska_read_seek(), |tracks| is assigned at the begining of the
function. However, functions like matroska_parse_cues() could reallocate
the tracks and invalidate |tracks|.
This assigns |tracks| only before using it, so that it will not get
invalidated elsewhere.
Bug-Id: chromium/427266
When matroska_execute_seekhead() is called, it goes through the list of
seekhead entries and attempts to read elements not read yet. When doing
this, the parser can find further SeekHead elements, and will extend the
matroska->seekhead list. This can lead to a (practically) infinite loop
with certain broken files. (Maybe it can happen even with valid files.
The demuxer doesn't seem to check correctly whether an element has
already been read.)
Fix this by ignoring elements that were added to the seekhead field
during executing seekhead entries.
This does not fix the possible situation when multiple SeekHead elements
after the file header (i.e. occur after the "before_pos" file position)
point to the same elements. These elements will probably be parsed
multiple times, likely leading to bugs.
Fixes ticket #4162.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6551acab6877addae815decd02aeca33ba4990c8)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
It might be passed to code requiring padding, such as lzo decompression.
Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 30be1ea33e5525266ad871bed60b1893a53caeaf)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
* commit '163196562fe744149ef599d754c30c08a9898381':
oggparseogm: Convert to use bytestream2
rv34: Check the return value from ff_rv34_decode_init
matroskadec: Verify realaudio codec parameters
mace: Make sure that the channel count is set to a valid value
svq3: Check for any negative return value from ff_h264_check_intra_pred_mode
vp3: Check the framerate for validity
cavsdec: Make sure a sequence header has been decoded before decoding pictures
vocdec: Don't update codec parameters mid-stream
sierravmd: Do sanity checking of frame sizes
omadec: Properly check lengths before incrementing the position
mpc8: Make sure the first stream exists before parsing the seek table
Conflicts:
libavcodec/mace.c
libavformat/oggparseogm.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'aade60ab165716523788cd11caf03ae61b40144a':
matroskadec: Check that .lang was allocated and set before reading it
alac: Limit max_samples_per_frame
ape demuxer: check for EOF in potentially long loops
4xm: check that bits per sample is strictly positive
lavf: avoid integer overflow when estimating bitrate
pictordec: pass correct context to avpriv_request_sample
Conflicts:
libavcodec/pictordec.c
libavformat/matroskadec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* jamrial/release/1.1:
avformat/matroskadec: check out_samplerate before using it in av_rescale()
matroskadec: Improve TTA duration calculation
matroskaenc: simplify mkv_check_tag()
lavf/matroskaenc: Check for valid metadata before creating tags
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Might fix Ticket1907 (I have no testcase so i cant test)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4758e32a6c48044f77102a49110c79b4f338f648)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Prevent assertion failure with damaged input
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 338f8b2eaf36f078eb5cc26ac10e651dc4c48243)
Calculate the duration as accurately as possible to improve decoding of samples
where the last frame is smaller than the rest.
Signed-off-by: James Almer <jamrial@gmail.com>
Approved-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit af248fa1174200acb537a6ab1198bb2fed38e884)
Fixes Ticket2508
Thanks-to: Moritz Bunkus
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6158a3bcdf52fafc1d9ae9eb358a56c614b23aa3)
* commit '858864d350320dd807e349bda017026e61a47fe0':
xmv: check audio track parameters validity.
bmv: check for len being valid in bmv_decode_frame().
xmv: do not leak memory in the error paths in xmv_read_header()
matroska: pass the lace size to the matroska_parse_rm_audio
Conflicts:
libavformat/matroskadec.c
libavformat/xmv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'b90816d94b0b5c01f451ff98cfbf1d5ddec9c3c1':
matroska: Update the available size after lace parsing
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '05015d03da1d745bb92915b5cea92dec16af719f':
matroska: fix a corner case in ebml-lace parsing
avfiltergraph: check for sws opts being non-NULL before using them.
configure: Enable hwaccels without external dependencies by default.
oma: Validate sample rates
Conflicts:
libavfilter/avfiltergraph.c
libavfilter/graphparser.c
libavformat/oma.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Each lace must be independent according to the specification.
Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.
Stricter check than fc43c19a567aa945398dccb491d972c11ec2a065
CC: libav-stable@libav.org
(cherry picked from commit 25a80a931a3829f9d730971dbd269aa39cc273f6)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Fix heap-buffer-overflow in matroska_parse_block for
corrupted real media in mkv files.
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit fc43c19a567aa945398dccb491d972c11ec2a065)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Make sure we notice when the lace_size[n] is a negative value.
CC: libav-stable@libav.org
(cherry picked from commit 8a96df7b70be509dae9ceec82d2c10a20361356d)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
* qatar/release/9:
libx264: use the library specific default rc_initial_buffer_occupancy
lavc: set the default rc_initial_buffer_occupancy
lavc: introduce the convenience function init_get_bits8
lavc: check for overflow in init_get_bits
APIchanges: Fill in missing hashes and dates; fix a version number typo.
configure: enable pic for shared libs on AArch64
zmbv: Reset the decoder on keyframe errors
vc1dec: prevent a crash due missing pred_flag parameter
matroska: Fix use after free
vp3: Fix double free in vp3_decode_end()
update Changelog
oggdec: make sure the private parse data is cleaned up
oggdec: free the ogg streams on read_header failure
update Changelog
x86: lavr: use the x86inc.asm automatic stack alignment in mixing functions
Prepare 9.1 Release
Conflicts:
Changelog
RELEASE
doc/APIchanges
libavcodec/utils.c
libavformat/oggdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
doc: add apidoc target for doxygen API documentation
matroskadec: do not use avpacket internals
Conflicts:
doc/Makefile
libavformat/matroskadec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '4c995fafd861f537360b3717901cdbed6a6844e7':
configure: simplify get_version() function
build: support asan and tsan toolchain shortcuts
rmdec: Move SIPR code shared with Matroska demuxer to a separate file
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
libx264: add forgotten ;
matroskadec: fix a sanity check.
matroskadec: only return corrupt packets that actually contain data
lavf: zero data/size of the packet passed to read_packet().
ARM: use 2-operand syntax for ADD Rd, PC in Apple PIC code
ARM: align PIC offset pools to 4 bytes
ARM: swap source operands in some add instructions
configure: update tms470 detection for latest version
lavf probe: prevent codec probe with no data at all seen
motion_est: fix use of inline on extern functions
Conflicts:
libavcodec/motion_est_template.c
libavformat/matroskadec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* qatar/master:
mp3dec: read Xing frame TOC index
mp3dec: use named constants for Xing header flags
libx264: add support for nal-hrd, required for Blu-ray streams.
mov: support random access point grouping
matroskadec: properly support BlockDuration
Conflicts:
libavcodec/libx264.c
libavformat/isom.h
libavformat/matroskadec.c
libavformat/mov.c
libavformat/mp3dec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '117d8c6d1f1c187ffc6098d9618457e00534e013':
matroska: implement support for ProRes
matroska: implement support for ALAC
Conflicts:
libavformat/matroskaenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '581281e242609a222233a2e5538b89dfb88fb18e':
matroskadec: check realloc in lzo encoding
matroska: honor error_recognition on unknown doctypes
tiffdec: Add support for GRAY16LE.
tiffenc: Add support for little endian RGB48 and GRAY16
mpeg4: support frame parameter changes with frame-mt
mpegvideo: check ff_find_unused_picture() return value for errors
mpegvideo: release frame buffers before freeing them
configure: msvc: default to 'lib' as 'ar' tool
build: support some non-standard ar variants
Conflicts:
libavcodec/h263dec.c
libavcodec/mpegvideo.c
libavcodec/tiff.c
libavcodec/tiffenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
