summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* avformat/lrcdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-0/+1
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit d38694cea9f289b3f9dcce1a2f07746d029b35f3) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/jacosubdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-2/+4
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit c13a752733a9af955b032c55f704b748fe37dd19) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/assdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-0/+2
| | | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle or if creating the extradata failed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 5ab39c2d8c1e5e00b48d758eee7d5ae435a99ef7) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/aqtitledec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-2/+5
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit a86a5d06d8967d01964833456df1df9fc186f125) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/mov: Fix memleaks upon read_header failureAndreas Rheinhardt2020-07-021-16/+17
| | | | | | | | | | | | | | | | | By default, a demuxer's read_close function is not called automatically if an error happens when reading the header; instead it is up to the demuxer to clean up after itself in this case. The mov demuxer did this by calling its read_close function when it encountered some errors when reading the header. Yet for other errors (mostly adding side-data to streams) this has been forgotten, so that all the internal structures of the demuxer leak. This commit fixes this by making sure mov_read_close is called when necessary. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit ac378c535be907ee383dafb430be7216a2920982) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/omadec: Fix memleaks upon read_header failureAndreas Rheinhardt2020-07-021-16/+28
| | | | | | | | | Fixes possible leaks of id3v2 metadata as well as an AVDES struct in case the content is encrypted and an error happens lateron. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 3d3ba43bc68ca90fe72d0fc390c9e5f5c7de1513) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Fix memleaks in WebM DASH manifest demuxerAndreas Rheinhardt2020-07-021-4/+10
| | | | | | | | | In certain error scenarios, the underlying Matroska demuxer was not properly closed, causing leaks. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 0841063ce6a2e664fb3986b0a255c57392cd9f02) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Use right number of tracksAndreas Rheinhardt2020-07-021-2/+2
| | | | | | | | | | | | When demuxing a Matroska/WebM file, streams are added for tracks and for attachments, so that the array containing the former can be NULL even when the corresponding AVFormatContext has streams. So check for there to be tracks in the MatroskaDemuxContext instead of just streams in the AVFormatContext before dereferencing the pointer to the tracks. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 1ef30571a0a7150cb20c580bfc52af2a7101c20d) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Fix handling gigantic durationsAndreas Rheinhardt2020-07-021-1/+2
| | | | | | | | | | | | matroska_parse_block currently asserts that the duration is not equal to AV_NOPTS_VALUE, but there is nothing that actually guarantees this. It is easy to create (spec-compliant) files which run into this assert; so replace it and instead cap the duration to INT64_MAX, as the duration field of an AVPacket is an int64_t. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 3714d452b894821591a2fbafdd1b8ef15abe4be6) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/cinepakenc: Fix invalid shiftsAndreas Rheinhardt2020-07-021-5/+6
| | | | | | | | | | | | Fixes: left shift of 1 by 31 places cannot be represented in type 'int'. Affected the FATE-tests vsynth1-cinepak, vsynth2-cinepak and vsynth_lena-cinepak. Also fixes ticket #8220. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e3650dcfc9cde6ceccf7bbc225962da196e2a386) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/cbs_h2645: Fix potential out-of-bounds array accessAndreas Rheinhardt2020-07-021-1/+1
| | | | | | | | | | | | | The maximum allowed index for an array access is FF_ARRAY_ELEMS - 1; yet the current code allowed FF_ARRAY_ELEMS. This wasn't dangerous in practice, as parameter sets with invalid ids were already filtered out during reading. Found via PVS-Studio (see ticket #8156). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit f3333c3c67e8825a4468120bb8aa0943c72c03f3) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* h264_redundant_pps: Fix memleak in case of errorsAndreas Rheinhardt2020-07-021-14/+26
| | | | | | | | | | Now the fragment is uninitialized and the input packet freed in case of errors. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@googlemail.com> Signed-off-by: Mark Thompson <sw@jkqxz.net> (cherry picked from commit 40b74abfca39bf514333c3ebb6d6e946975057c3) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/aviobuf: Don't check for overflow after it happenedAndreas Rheinhardt2020-07-021-1/+1
| | | | | | | | | | If adding two ints overflows, it doesn't matter whether the result will be stored in an unsigned or not; and checking afterwards does not make it retroactively defined. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 28a078eded1c29985ed078b59d48ff59cf00394b) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskaenc: Fix memleak upon encountering bogus chapterAndreas Rheinhardt2020-07-021-0/+1
| | | | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit cb255b616cf1ebc6bc89b3538b6b7465dc2c526b) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* fftools/ffmpeg_opt: Check attachment filesizeAndreas Rheinhardt2020-07-021-2/+4
| | | | | | | | | | | | | | | | | | | The data of an attachment file is put into an AVCodecParameter's extradata. The corresponding size field has type int, yet there was no check for the size to fit into an int. As a consequence, it was possible to create extradata with negative size (by using a big enough max_alloc). Other errors were also possible: If SIZE_MAX < INT64_MAX (e.g. on 32bit systems) then the file size might be truncated before the allocation; and avio_read() takes an int, too, so one would not have read as much as one desired. Furthermore, the extradata is now padded as is required. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 889ad93c8839e5ac1ec28bc8e1fea6df71b9bf80) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/webmdashenc: Check codec typesAndreas Rheinhardt2020-07-021-0/+8
| | | | | | | | | | | | | | | The WebM DASH Manifest muxer only supports VP8, VP9, Vorbis and Opus, but there was no check for this. The codec type is used to get a pointer to a string containing the codec name or NULL if it is not one of those four codecs. Said pointer has then been used without further checks as string for the %s conversion specifier in an avio_printf()) call which is undefined behaviour. This commit adds a check for the supported codec types. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit cbea58b2b35c6409e062c929f0b2ab763b8661eb) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/avidec: Fix memleak with embedded GAB2 subtitlesAndreas Rheinhardt2020-07-021-4/+5
| | | | | | | | | | | | | | | The code for GAB2 subtitles predates refcounting AVPackets. So in order to transfer the ownership of a packet's data pkt->data was simply stored and the packet zeroed; in the end (i.e. in the read_close-function) this data was then simply freed with av_freep(). This of course leads to a leak of an AVBufferRef and an AVBuffer. It has been fixed by keeping and eventually unreferencing the packet's buf instead. Additionally, the packet is now reset via av_packet_unref(). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit da44bbefaabeb2fdb58a03fe533a44aa150486fc) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/webmdashenc: Fix memleak upon realloc failureAndreas Rheinhardt2020-07-021-3/+4
| | | | | | | | | The classical ptr = av_realloc(ptr, size). Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 418e468699868a0265f8b439beedf64bb643b088) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Don't discard the upper 32bits of TrackNumberAndreas Rheinhardt2020-07-021-2/+2
| | | | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit ba36a077342c01faa3f3deb841e8cdcc1379ea3d) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/hnm: Check for extradata allocation failureAndreas Rheinhardt2020-07-021-3/+4
| | | | | | | | | | | and also add padding to it; moreover, don't use memcpy to write one byte to extradata. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9e0f3352d1f37a739d98df4347a2b60a396a56fe) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/subtitles: Don't increment packet counter prematurelyAndreas Rheinhardt2020-07-021-1/+2
| | | | | | | | | | | Do it only if the packet has been successfully allocated in av_new_packet() -- otherwise on error a completely uninitialized packet would be unreferenced later. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6bd8bcc2ac4c64577d964552317989e61db794d8) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/bethsoftvid: Fix potential memleak upon reallocation failureAndreas Rheinhardt2020-07-021-3/+7
| | | | | | | | | | The classical ptr = av_realloc(ptr, size), just with av_fast_realloc(). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 5acef1206144554a48f699b421e8d739e752d8ab) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/smoothstreaming: Fix memleaks on errorsAndreas Rheinhardt2020-07-021-4/+4
| | | | | | | | | | | | | | | | If an AVFormatContext could be allocated, but white-/blacklists couldn't be copied, the AVFormatContext would leak as it was only accessible through a local variable that goes out of scope when one goes to fail. Furthermore, in case writing a header of a submuxer failed, the options used for said call could leak. Both of these memleaks have been fixed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit abbb466368c51285ca27d5e3959a16a9591e9a4c) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskaenc: Check BlockAdditional size before useAndreas Rheinhardt2020-07-021-3/+7
| | | | | | | | | | Don't read a 64bit number before having checked that the data is at least 8 bytes long. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6e9cc964293bf1e0cca6a52b2938a20d711e4146) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/utils: Fix memleaks in avformat_open_input()Andreas Rheinhardt2020-07-021-6/+11
| | | | | | | | | | | | | | | | | A demuxer might have allocated memory while reading the header. If reading the header was successfull and an error happens before returning (e.g. when queueing the attached pictures), the read_close function would have never been called, so that all those allocations would leak. This commit changes this. Furthermore, there would be even more memleaks if the error level was set to AV_EF_EXPLODE in case there is both metadata and id3v2 metadata. This has been fixed, too. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Marton Balint <cus@passwd.hu> (cherry picked from commit e2307f4ff197646a7feee0edbcdd2d3262932676) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/cavsdsp: Fix undefined left shifts of negative numbersAndreas Rheinhardt2020-07-021-26/+26
| | | | | | | | | | | | | | Affected the ffmpeg-filter_colorkey FATE-test (but only if the C version of idct8_add is used and not e.g. the x86 SSE2 version). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Fixes: left shift of negative value -107 Fixes: 20398/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CAVS_fuzzer-5725389278412800 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 0f0f2ab0c3b3d04e904db97b07ae829c72c91778) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/mov: Don't leak MOVFragmentStreamInfo on errorAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | Fixes Coverity issue #1441933. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 43f58f2354bfab3819e44c1a97b0af75cc091226) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/hevc: Fix potential leak in case of ff_hevc_annexb2mp4_buf failureAndreas Rheinhardt2020-07-022-4/+10
| | | | | | | | | | | | | | ff_hevc_annexb2mp4_buf() could indicate an error, yet leave cleaning after itself to the caller, so that a caller could not simply return the error, but had to free the buffer first. (Given that all current callers have set filter_ps = 0, this error can currently not be triggered.) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 680cd59bb21c7bce92789ff885c018207b0b90bc) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskaenc: Check for reformatting errorsAndreas Rheinhardt2020-07-021-11/+17
| | | | | | | | | | | | | This is needed especially for AV1: If a reformatting error happens (e.g. if the length field of an OBU contained in the current packet indicates that said OBU extends beyond the current packet), the data pointer is still NULL, yet the size is unchanged, so that writing the data leads to a segmentation fault. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 58428bef4b2c053f47dce35157fb96833ba8efea) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/ra144enc: Fix invalid left shift of negative numberAndreas Rheinhardt2020-07-021-2/+2
| | | | | | | | | | | | by replacing it with a multiplication. Said multiplication can't overflow an int32_t because lpc_coefs is limited to 16 bit precision. Fixes the FACE-test acodec-ra144 as well as part of #8217. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e3fb9af6f1353f30855eaa1cbd5befaf06e303b8) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/adxenc: Avoid undefined left shift of negative numbersAndreas Rheinhardt2020-07-021-3/+3
| | | | | | | | | | | | Replace "((a << shift) + b) >> shift" by "a + (b >> shift)". This avoids a left shift which also happens to trigger undefined behaviour in case "a" is negative. This affected the FATE-tests acodec-adpcm-adx and acodec-adpcm-adx-trellis; it also fixes ticket #8008. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 59a9d65e0d790821f88527a82569f56eb2f8a9be) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/adpcm: Fix undefined left shifts of negative numbersAndreas Rheinhardt2020-07-021-8/+8
| | | | | | | | | | Affected the adpcm-afc, adpcm-ea-1, adpcm-ea-2, adpcm-ea-maxis-xa, adpcm-thp and ea-cdata FATE-tests. Also fixes ticket #8487. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3ad8af51b7c0a968ac3fd62964780d4ff9136c5a) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/segafilmenc: Fix undefined left shift of 1 by 31 placesAndreas Rheinhardt2020-07-021-1/+1
| | | | | | | | | by changing the type to unsigned. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 8ae026d74f599b2d00b91798af1c1067a879007c) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/proresenc_anatoliy: Fix invalid left shift of negative numberAndreas Rheinhardt2020-07-021-1/+1
| | | | | | | | | | | | | | This fixes ticket #7997 as well as the vsynth*-prores_# FATE-tests (where * ranges over { 1, 2, 3, _lena } and # over { , _int, _444, _444_int }). (Given that prev_dc is in the range -0xC000..0x3FFF, no overflow can happen upon multiplication with 2.) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 198081efb7c7343349f0a7acc836f001c511e990) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/wtvdec: Fix memleak when reading header failsAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | | Fixes #8314. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Peter Ross <pross@xvid.org> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 373c1c9b691fd4c6831b3a114a006b639304c2af) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/fitsdec: Fix potential leak of string in AVBPrintAndreas Rheinhardt2020-07-021-1/+1
| | | | | | | | | by freeing it a bit earlier. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit bb20f3dd730689c3a99f7820cff8b74b06992fff) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Fix use-after-free when demuxing ProResAndreas Rheinhardt2020-07-021-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ProRes in Matroska is supposed to not contain the first atom header (containing a size field and the tag "icpf") and therefore the Matroska demuxer has to recreate it; this involves an allocation and copy, of course. Whether the old buffer (containing the data without the atom header) needs to be freed or not depends upon whether it is what was directly read (in which case it is owned by an AVBuffer) or whether it has been allocated when reversing the track's content compression (e.g. zlib compression) that Matroska supports. So there are three pointers involved: The one pointing to the directly read data (owned by the AVBuffer), the one pointing to the currently valid data (which coincides with the former if no content compression needed to be reverted) and the one pointing to the new data with the first atom header. The check for whether to free the second of these is simply whether the first two are different. This works mostly, but there is a complication: Some muxers don't strip the first atom header away and in this case, it is also not reinserted and no new buffer is allocated; instead, the second and the third pointers agree. In this case, one must never free the second buffer. Yet it is currently done if the track is e.g. zlib compressed. This commit fixes this. This is a regression since b8e75a2a. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit af50f0a515d8096fece9776e2d3034fe990a1373) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Fix demuxing ProResAndreas Rheinhardt2020-07-021-4/+5
| | | | | | | | | | | | | | | | | | | | The structure of a ProRes frame in mov/mp4 is that of a typical atom: First a 32 bit BE size field, then a tag detailling the content. Said size field includes the eight bytes of the atom header. This header is actually redundant, as the size of the atom is already known from the containing atom. It is therefore stripped away when muxed into Matroska and so the Matroska demuxer has to recreate upon demuxing. But it did not account for the fact that the size field includes the size of the header and this can lead to problems when a decoder uses the in-band size field. Fixes ticket #8210. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 581419ea39de6619c3389b8d10ac2cbe212c62a0) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avcodec/bitstream: Don't check for undefined behaviour after it happenedAndreas Rheinhardt2020-07-011-1/+1
| | | | | | | Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 5e196dac22cc510db104922f99626a03b453ef4a) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/mov: fix memleaksZhao Zhili2020-07-011-4/+3
| | | | | | | | | | Fix two cases of memleaks: 1. The leak of dv_demux 2. The leak of dv_fctx upon dv_demux allocate failure Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit f3dc38a186b2326ce03e50969897ea703817ddb0) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* libavformat/mov: Fix memleaks when demuxing DV audioAndreas Rheinhardt2020-07-011-10/+13
| | | | | | | | | | | | | | | | | | | | | | | The code for demuxing DV audio predates the introduction of refcounted packets and when the latter was added, changes to the former were forgotten. This meant that when avpriv_dv_produce_packet initialized the packet containing the AVBufferRef, the AVBufferRef as well as the underlying AVBuffer leaked; the actual packet data didn't leak: They were directly freed, but not via their AVBuffer's free function. https://samples.ffmpeg.org/ffmpeg-bugs/trac/ticket4671/dir1.tar.bz2 contains samples for this (enable_drefs needs to be enabled for them). Moreover, errors in avpriv_dv_produce_packet were ignored; this has been changed, too. Furthermore, in the hypothetical scenario that the track has a palette, this would leak, too, so reorder the code so that the palette code appears after the DV audio code. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 61f5c6ab06fc61e0f9f8f8dab5595b8bb202df73) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* Update for 4.0.6Michael Niedermayer2020-07-013-2/+206
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/utils: reorder duration computation to avoid overflowMichael Niedermayer2020-07-011-1/+1
| | | | | | | | | | Fixes: signed integer overflow: 8 * 9223372036854774783 cannot be represented in type 'long' Fixes: 23381/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4818340509122560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 10cc82c35baabbb07ffec3faccb04d8928c39e4c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/pngdec: Check for fctl after idatMichael Niedermayer2020-07-011-0/+5
| | | | | | | | | | Fixes: out of array access Fixes: 23554/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-4796622520451072.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 65b1ba680fb67902a9c876a49d0146eaae5a1c3d) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/hls: Pass a copy of the URL for probingMichael Niedermayer2020-07-011-2/+4
| | | | | | | | | | | | The segments / url can be modified by the io read when reloading This may be an alternative or additional fix for Ticket8673 as a further alternative the reload stuff could be disabled during probing Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit b5e39880fb7269b1b3577cee288e06aa3dc1dfa2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/hls: check segment duration value of EXTINFSteven Liu2020-07-011-2/+7
| | | | | | | | fix ticket: 8673 set the default EXTINF duration to 1ms if duration is smaller than 1ms Signed-off-by: Steven Liu <lq@chinaffmpeg.org> (cherry picked from commit 9dfb19baeb86a8bb02c53a441682c6e9a6e104cc)
* avutil/common: Fix integer overflow in av_ceil_log2_c()Michael Niedermayer2020-07-011-1/+1
| | | | | | | | | | Fixes: left shift of 1913647649 by 1 places cannot be represented in type 'int' Fixes: 23572/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5082619795734528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit e409262837712016097c187e97bf99aadf6a4cdf) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avcodec/wmalosslessdec: fix overflow with pred in revert_cdlmsMichael Niedermayer2020-07-011-2/+3
| | | | | | | | | | Fixes: signed integer overflow: 2048 + 2147483646 cannot be represented in type 'int' Fixes: 23538/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMALOSSLESS_fuzzer-5227567073460224 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 21598d711d894081d0566282473044ba4f378f33) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mvdec: Fix integer overflow with billions of channelsMichael Niedermayer2020-07-011-2/+2
| | | | | | | | | | Fixes: signed integer overflow: 1394614304 * 2 cannot be represented in type 'int' Fixes: 23491/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5697377020411904 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit b6fbbe08c325415cc784df296058beb6604f0b9c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/microdvddec: skip malformed lines without frame number.Michael Niedermayer2020-07-011-1/+5
| | | | | | | | | | | Fixes: signed integer overflow: 1 - -9223372036854775808 cannot be represented in type 'long' Fixes: 23490/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5133490093031424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit a8fb7612a97530bdd0b2549dacf91dcf71a3187a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
View Lorry Controller Status