15896 Commits

Author SHA1 Message Date
Michael Niedermayer
17e6d249b7 avformat/mov: Disallow ".." in dref unless use_absolute_path is set
as this kind of allows to circumvent it to some extend.
We also could add a separate parameter or value to choose this

Found-by: ramiro
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e4d0498df6621143da1a550006ddc3526ad51cb)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:23 +02:00
Michael Niedermayer
e0975c31f1 avformat/mov: Check for string truncation in mov_open_dref()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8003816e1619e77d8de051883264aa090e0d78cc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:23 +02:00
Michael Niedermayer
e168db3eae avformat/mov: Use sizeof(filename) instead of a literal number
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 21a53dd08dce7cc5b3fdf9c4826b4b74d8300ea0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:23 +02:00
Andreas Cadhalpun
de2f46c59d asfenc: fix leaking asf->index_ptr on error
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2c8cff2be4a044c66e4904efa156dafd0d332d25)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:22 +02:00
Andreas Cadhalpun
820b84d065 ffmdec: limit the backward seek to the last resync position
If resyncing leads to the same position as previously, it will again
lead to a resync attempt, resulting in an infinite loop.

Thus don't seek back beyond the last syncpoint.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6b8263b03ab3d16d70525ae1893cb106be7852f1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:22 +02:00
Andreas Cadhalpun
443fc85203 ffmdec: make sure the time base is valid
A negative time base can trigger assertions.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4c91d81be23ffacfa3897b2bcfa77445bb0c2f89)

Conflicts:

	libavformat/ffmdec.c
2015-03-29 03:34:22 +02:00
Andreas Cadhalpun
d81150929d ffmdec: fix infinite loop at EOF
If EOF is reached, while skipping bytes, avio_tell(pb) won't change
anymore, resulting in an infinite loop.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6fa98822eba501a4898fdec5b75acd3026201005)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:22 +02:00
Andreas Cadhalpun
a80b38d7d2 avformat/flvenc: check that the codec_tag fits in the available bits
flags is later written with avio_w8 and if it doesn't fit in one byte it
triggers an av_assert2.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e8565d21c276ab9ac5ce785549420321fbd0b093)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:22 +02:00
Andreas Cadhalpun
2ec6a7a1e0 avformat/bit: only accept the g729 codec and 1 channel
Other codecs/channel numbers are not supported by this muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d0b8640f75ff7569c98d6fdb03d83451104e088c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:22 +02:00
Andreas Cadhalpun
6fbd897cab avformat/bit: check that pkt->size is 10 in write_packet
Ohter packet sizes are not supported by this muxer.

This avoids a null pointer dereference of pkt->data.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eeda2c3de8a8484d9e7d1e47ac836bec850b31fc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:22 +02:00
Andreas Cadhalpun
f33a2ea2ee avformat/adxdec: check avctx->channels for invalid values
This avoids a null pointer dereference of pkt->data.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7faa40af982960608b117e20fec999b48011e5e0)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:22 +02:00
Michael Niedermayer
093e3f4d5b avformat/omadec: Use 64bit for ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0f55bc29d41585d110b126cb4ed4b395fd46d7ac)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:21 +02:00
Michael Niedermayer
5169df2122 avformat/vqf: Use 64bit for ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cb08687180683a755d0fe9d425280d0e4d1e6db2)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:21 +02:00
Michael Niedermayer
8f65bedbaf avformat/wtvdec: Use 64bit for ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d44e0d8b930732a4a247b4884d75cf62b4ad3664)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:21 +02:00
Michael Niedermayer
81ee3385ee avformat/mvdec: Use 64bit for ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 26c0cc154e06cb0064b3a3da49447ac44d82444f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:21 +02:00
Michael Niedermayer
2046275aaf avformat/gxf: Use 64bit for res to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 12987f89007ee82b9d3a6090085dfaef8461ab8b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:21 +02:00
Michael Niedermayer
1ee7f2d77e avformat/idcin: Use 64bit for ret to avoid overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d1923d15a3544cbb94563a59e7169291db76b312)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-29 03:34:21 +02:00
Andreas Cadhalpun
72f83ad277 avformat/adxdec: set avctx->channels in adx_read_header
It is used in adx_read_packet, which currently depends on the decoder/parser setting this value between reading the file header and demuxing the first packet.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 64ea4a0598e7ca61b95cf6c93fd409151a448001)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 01:37:48 +01:00
Michael Niedermayer
20655dd2ec Merge commit '2ef2f60b4f0308d1c871091c9c1a9641d14ec585' into release/2.4
* commit '2ef2f60b4f0308d1c871091c9c1a9641d14ec585':
  rmenc: limit packet size

Conflicts:
	libavformat/rmenc.c

See: 73ca672fb6e6661a5e1b5d1ec3ad06bfbe144fd4
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 01:36:01 +01:00
Andreas Cadhalpun
73ca672fb6 avformat/rm: limit packet size
The chunk size is limited to 0xFFFF (written by avio_wb16), so make
sure that the packet size is not too large.

Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

See Ticket244

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08728f400b8367dc8c983036cb2eff3a2891322b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-03-09 01:33:24 +01:00
Andreas Cadhalpun
2ef2f60b4f rmenc: limit packet size
The chunk size is limited to UINT16_MAX (written by avio_wb16), so make
sure that the packet size is not too large.

Such large frames need to be split into slices smaller than 64 kB, but
that is currently supported neither by the rv10/rv20 encoders nor the rm
muxer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
2015-03-08 19:21:55 +00:00
Michael Niedermayer
d04bfdf0f7 Merge commit 'e10028431d5cd90db7b2a4b0d16721bb1a6d75e3' into release/2.4
* commit 'e10028431d5cd90db7b2a4b0d16721bb1a6d75e3':
  icecast: Do not use chunked post

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-28 19:19:52 +01:00
Mark McGough
e10028431d icecast: Do not use chunked post
Icecast uses HTTP 1.0 while Libav uses HTTP 1.1 and enables by
default chunked post.

Icecast actually forwards the HTTP chunk headers to the listener
as part of the media stream (without the chunk encoding HTTP headers)
causing the players to lose sync.

Disabling the option is enough to feed icecast properly.

(cherry picked from commit 76c70e33d2244a688832f03b53862eb5d9ad3b01)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2015-02-28 15:04:30 +01:00
Vittorio Giovara
4cd54b2f97 img2dec: correctly use the parsed value from -start_number
Previously the image sequence was always starting from the minimum
number rather than the requested one.

CC: libav-stable@libav.org
2015-02-22 23:51:15 +00:00
Michael Niedermayer
0c125519ec avformat/thp: Check av_get_packet() for failure not only for partial output
Fixes null pointer dereference
Fixes: signal_sigsegv_db2c1f_3108_cov_163322880_pikmin2_opening1_partial.thp

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f2579dbb4b31e6ae731e7f5555680528ef3020ab)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:48:08 +01:00
Michael Niedermayer
ee8e48d386 avformat/mpc8: Use uint64_t in *_get_v() to avoid undefined behavior
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 05e161952954acf247e0fd1fdef00559675c4d4d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:48:08 +01:00
wm4
600c6ebc7d avformat/mpc8: fix broken pointer math
This could overflow and crash at least on 32 bit systems.

Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b737a2c52857b214be246ff615c6293730033cfa)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:48:08 +01:00
wm4
2515de3b15 avformat/mpc8: fix hang with fuzzed file
This can lead to an endless loop by seeking back a few bytes after each
attempted chunk read. Assuming negative sizes are always invalid, this
is easy to fix. Other code in this demuxer treats negative sizes as
invalid as well.

Fixes ticket #4262.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 56cc024220886927350cfc26ee695062ca7ecaf4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:48:08 +01:00
wm4
e2e835f017 avformat/tta: fix crash with corrupted files
av_add_index_entry() can fail, for example because the parameters are
invalid, or because memory allocation fails. Check this; it can actually
happen with corrupted files.

The second hunk is just for robustness. Just in case functions like
ff_reduce_index() remove entries. (Not sure if this can actually
happen.)

Fixes ticket #4294.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6a0cd529a35190d9374b0b26504e71857cd67b83)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:48:08 +01:00
Michael Niedermayer
b8546aee84 avformat/omadec: fix number suffix
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f1f7f5903ab49b84789af5341492afbaba808a70)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:48:08 +01:00
Michael Niedermayer
84e5b314f3 avformat/smacker: Fix number suffix
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 465f3705b1ef832fd6904750d018f81f9044f3ab)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:48:08 +01:00
Michael Niedermayer
1497f355c7 avformat/matroskadec: Fix number suffixes
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fc3cdb00d084222a107e61e7168903bf3d3d0b47)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:48:08 +01:00
Michael Niedermayer
01b5e61845 avformat/utils: Fix number suffixes in tb_unreliable()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4b15bba2aec93776bfdc69a1bca42a4795a7d191)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:48:08 +01:00
Michael Niedermayer
92595faab9 Merge commit '532c96a2158c04f265d750d54f2f103b8d9fe0ef' into release/2.4
* commit '532c96a2158c04f265d750d54f2f103b8d9fe0ef':
  matroskadec: Fix read-after-free in matroska_read_seek()

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-02-13 20:32:53 +01:00
Xiaohan Wang
532c96a215 matroskadec: Fix read-after-free in matroska_read_seek()
In matroska_read_seek(), |tracks| is assigned at the begining of the
function. However, functions like matroska_parse_cues() could reallocate
the tracks and invalidate |tracks|.

This assigns |tracks| only before using it, so that it will not get
invalidated elsewhere.

Bug-Id: chromium/427266
2015-01-27 14:32:56 +00:00
Michael Niedermayer
e82140b09b avformat/librtmp: fix swfurl
Found-by: JULIAN GARDNER <joolzg@btinternet.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d1970929b5f8b873aac171586343c9d8142897ad)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 02:38:01 +01:00
Michael Niedermayer
dc84cf241c Merge commit '32701252af65014bb68194bb61d67ec1882ae75d' into release/2.4
* commit '32701252af65014bb68194bb61d67ec1882ae75d':
  xwma: Do not leak on failure path

Conflicts:
	libavformat/xwma.c

See: 375a0c03a9a401a328a94b3d9f5338ab1524f7ef
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 02:26:14 +01:00
Michael Niedermayer
c7831e55b5 Merge commit '242fc6394fecb403bcbd0f652920f2647d0b08ae' into release/2.4
* commit '242fc6394fecb403bcbd0f652920f2647d0b08ae':
  mtv: improve header check and avoid division by zero

Conflicts:
	libavformat/mtv.c

See: 8b9b6332dfeb169098c8ab1351d66fc5b474dd55
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:40:01 +01:00
Michael Niedermayer
6f9bb83dbb Merge commit 'bae05e5326703dad3bfe0ed5b31ba73ee9254515' into release/2.4
* commit 'bae05e5326703dad3bfe0ed5b31ba73ee9254515':
  matroskaenc: write correct Display{Width, Height} in stereo encoding

Conflicts:
	libavformat/matroskaenc.c

See: 6103faaa51d2f46d6ccecaad9a089b4b42ff66ee
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:33:33 +01:00
Michael Niedermayer
97a55f00d3 Merge commit '26ba78adacd8469fca97c8c833e2e6364b13b7c8' into release/2.4
* commit '26ba78adacd8469fca97c8c833e2e6364b13b7c8':
  mov: fix assigment check

Conflicts:
	libavformat/mov.c

See: af2e5061bbcabf5eae780929fa25784b6127759e
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:30:15 +01:00
Michael Niedermayer
d3316c3f85 Merge commit '19fc283dbb53a5f7d6658fd4edcfa59b99369b58' into release/2.4
* commit '19fc283dbb53a5f7d6658fd4edcfa59b99369b58':
  lavf: replace rename() with ff_rename()

Conflicts:
	libavformat/hdsenc.c
	libavformat/internal.h

See: 95d2fc6a76f3e0a98329f1ca70f98e7c085f0abf
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:22:14 +01:00
Michael Niedermayer
324797eb83 Merge commit 'b9b689550e7531b1a2cc893d2af623e37f266936' into release/2.4
* commit 'b9b689550e7531b1a2cc893d2af623e37f266936':
  img2dec: check av_new_packet return value

Conflicts:
	libavformat/img2dec.c

See: 3f8148911c6e6e1f2a042bd4ca3ad8516a92130c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:19:51 +01:00
Michael Niedermayer
298f7f1fac Merge commit '7c710c38f6481b892e01d3c1e4781ad160b2935e' into release/2.4
* commit '7c710c38f6481b892e01d3c1e4781ad160b2935e':
  audiointerleave: check av_new_packet return value

Conflicts:
	libavformat/audiointerleave.c

See: 3ca8a2328878ebdb203e49d0a060df1b5337a370
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:19:11 +01:00
Michael Niedermayer
275cd55a0f Merge commit '556a5090f2b0a20fd9998e1a327875f5b0c8d1d5' into release/2.4
* commit '556a5090f2b0a20fd9998e1a327875f5b0c8d1d5':
  mp3dec: fix reading the Xing tag

Conflicts:
	libavformat/mp3dec.c

See: 19ff479f694ddccc1fd1fa00eff94f96ca82671b
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:10:56 +01:00
Michael Niedermayer
749fadaa65 Merge commit '1551602b423755c4ed98c5b7b2c2d6504416726e' into release/2.4
* commit '1551602b423755c4ed98c5b7b2c2d6504416726e':
  nutdec: check av_new_packet return value

Conflicts:
	libavformat/nutdec.c

See: bb502411ddb9fe1928d4a999693a3a49b83f8698
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:10:10 +01:00
Michael Niedermayer
8120061be2 Merge commit '4cd0041d38664adcb6f4b3038e277631b85d5dc8' into release/2.4
* commit '4cd0041d38664adcb6f4b3038e277631b85d5dc8':
  rmdec: check av_new_packet return value

Conflicts:
	libavformat/rmdec.c

See: c01a462cda8d7f298a3ac6d20752d23a11e43a8a
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:04:15 +01:00
Michael Niedermayer
153a012384 Merge commit '6cf27b550d66963b89b5917568b85c4b49fb18ba' into release/2.4
* commit '6cf27b550d66963b89b5917568b85c4b49fb18ba':
  aviobuf: check context before using it

See: 7441d1ec330da810a0ffd44a02b2fc60add5b719
Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 01:02:42 +01:00
Michael Niedermayer
1da83d52bc Merge commit 'b31bb39bdd7b5a53e0d282acc0f0f62b32b17acc' into release/2.4
* commit 'b31bb39bdd7b5a53e0d282acc0f0f62b32b17acc':
  rtsp: Check a memory allocation

Merged-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 00:36:31 +01:00
Michael Niedermayer
564d943b27 avformat/rmdec: Check for overflow in ff_rm_read_mdpr_codecdata()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 03abf55f252945c70f4a79eaf4d609cee4d98710)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 00:26:12 +01:00
Michael Niedermayer
aded1110a3 avformat/rmdec: rm_read_extradata: add error message for oversized extradata
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 50f9de59a08f4bbacda298377339318e3eb87b8e)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
2015-01-18 00:25:55 +01:00