summaryrefslogtreecommitdiff
path: root/libavformat
Commit message (Collapse)AuthorAgeFilesLines
* avformat/mov: Fix reel_name size checkAndreas Rheinhardt2020-07-021-1/+1
| | | | | | | | | Only read str_size bytes from offset 30 of extradata if the extradata is indeed at least 30 + str_size bytes long. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit ff3fad6b0edb13dd664403b01bc00309f035b110) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/mov: Fix memleak upon encountering repeating tagsAndreas Rheinhardt2020-07-021-0/+3
| | | | | | | | | | | | | | | mov_read_custom tries to read three strings belonging to three different tags. When an already encountered tag is encountered again, a new buffer for the string to be read is allocated and stored in the pointer destined for this particular tag. But in this scenario, said pointer already holds the address of the string read earlier, leading to a leak. This commit therefore aborts the reading process upon encountering an already encountered tag. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit dfef1d5e3cd4dfead84416a01e6c9ff0da50b34d) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskaenc: Don't use NULL for %s format stringAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | | The argument pertaining to a printf %s conversion specifier must not be NULL, even if the precision (i.e. the number of characters to write) is zero. If it is NULL, it is undefined behaviour. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 6de6ce7bc80e874099895b6c73977bc2efb06a4d) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/webvttdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-0/+2
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit c784fe8b867e42a1c8d2c48d7046e3e0cce7ec31) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/vplayerdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 67434afa7fcb2b411b10a4d09fb30cd3a5907c2c) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/tedcaptionsdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-4/+4
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if allocating the AVStream for the subtitles fails. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 337783b118d4cc265759c103b672dd5d5d3e7cb8) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/subviewerdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-0/+2
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit a708f652737eba08607df84394ca4bec6b458736) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/subviewer1dec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 9751d7515222c7b58d0c6fb31aec6e0464c0f338) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/stldec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit e13874b9eae4e156ca1c478e6d59d3461bbdc09f) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/srtdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-0/+2
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit c70409957c7332971f0e147729d769f6d2f95390) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/sccdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-1/+4
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit f3c63e67bb00fa7d96595203d01a576df651e275) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/samidec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-0/+2
| | | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle or when creating extradata. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit f161f8e4ad10c8ae5b2e97870e09bc6a421408eb) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/pjsdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 9df560e8986640e20c62286f0baee2a80540accd) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/mpsubdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-2/+4
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon creating an AVStream. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit a5ed8aeea4f4199e89520c3fdbd9d07ae7fc3c3f) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/mpl2dec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 331799747e7e995710f5dfc4d413cda35eb01289) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/microdvddec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-5/+12
| | | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle or when allocating extradata. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit b12014a5b861959fd41a32ba3ff4cb139c56efcd) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/lrcdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-0/+1
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit d38694cea9f289b3f9dcce1a2f07746d029b35f3) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/jacosubdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-2/+4
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit c13a752733a9af955b032c55f704b748fe37dd19) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/assdec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-0/+2
| | | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle or if creating the extradata failed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 5ab39c2d8c1e5e00b48d758eee7d5ae435a99ef7) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/aqtitledec: Fix memleak upon read header failureAndreas Rheinhardt2020-07-021-2/+5
| | | | | | | | | The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit a86a5d06d8967d01964833456df1df9fc186f125) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/mov: Fix memleaks upon read_header failureAndreas Rheinhardt2020-07-021-16/+17
| | | | | | | | | | | | | | | | | By default, a demuxer's read_close function is not called automatically if an error happens when reading the header; instead it is up to the demuxer to clean up after itself in this case. The mov demuxer did this by calling its read_close function when it encountered some errors when reading the header. Yet for other errors (mostly adding side-data to streams) this has been forgotten, so that all the internal structures of the demuxer leak. This commit fixes this by making sure mov_read_close is called when necessary. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit ac378c535be907ee383dafb430be7216a2920982) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/omadec: Fix memleaks upon read_header failureAndreas Rheinhardt2020-07-021-16/+28
| | | | | | | | | Fixes possible leaks of id3v2 metadata as well as an AVDES struct in case the content is encrypted and an error happens lateron. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 3d3ba43bc68ca90fe72d0fc390c9e5f5c7de1513) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Fix memleaks in WebM DASH manifest demuxerAndreas Rheinhardt2020-07-021-4/+10
| | | | | | | | | In certain error scenarios, the underlying Matroska demuxer was not properly closed, causing leaks. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 0841063ce6a2e664fb3986b0a255c57392cd9f02) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Use right number of tracksAndreas Rheinhardt2020-07-021-2/+2
| | | | | | | | | | | | When demuxing a Matroska/WebM file, streams are added for tracks and for attachments, so that the array containing the former can be NULL even when the corresponding AVFormatContext has streams. So check for there to be tracks in the MatroskaDemuxContext instead of just streams in the AVFormatContext before dereferencing the pointer to the tracks. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 1ef30571a0a7150cb20c580bfc52af2a7101c20d) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Fix handling gigantic durationsAndreas Rheinhardt2020-07-021-1/+2
| | | | | | | | | | | | matroska_parse_block currently asserts that the duration is not equal to AV_NOPTS_VALUE, but there is nothing that actually guarantees this. It is easy to create (spec-compliant) files which run into this assert; so replace it and instead cap the duration to INT64_MAX, as the duration field of an AVPacket is an int64_t. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 3714d452b894821591a2fbafdd1b8ef15abe4be6) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/aviobuf: Don't check for overflow after it happenedAndreas Rheinhardt2020-07-021-1/+1
| | | | | | | | | | If adding two ints overflows, it doesn't matter whether the result will be stored in an unsigned or not; and checking afterwards does not make it retroactively defined. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 28a078eded1c29985ed078b59d48ff59cf00394b) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskaenc: Fix memleak upon encountering bogus chapterAndreas Rheinhardt2020-07-021-0/+1
| | | | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit cb255b616cf1ebc6bc89b3538b6b7465dc2c526b) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/webmdashenc: Check codec typesAndreas Rheinhardt2020-07-021-0/+8
| | | | | | | | | | | | | | | The WebM DASH Manifest muxer only supports VP8, VP9, Vorbis and Opus, but there was no check for this. The codec type is used to get a pointer to a string containing the codec name or NULL if it is not one of those four codecs. Said pointer has then been used without further checks as string for the %s conversion specifier in an avio_printf()) call which is undefined behaviour. This commit adds a check for the supported codec types. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit cbea58b2b35c6409e062c929f0b2ab763b8661eb) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/avidec: Fix memleak with embedded GAB2 subtitlesAndreas Rheinhardt2020-07-021-4/+5
| | | | | | | | | | | | | | | The code for GAB2 subtitles predates refcounting AVPackets. So in order to transfer the ownership of a packet's data pkt->data was simply stored and the packet zeroed; in the end (i.e. in the read_close-function) this data was then simply freed with av_freep(). This of course leads to a leak of an AVBufferRef and an AVBuffer. It has been fixed by keeping and eventually unreferencing the packet's buf instead. Additionally, the packet is now reset via av_packet_unref(). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit da44bbefaabeb2fdb58a03fe533a44aa150486fc) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/webmdashenc: Fix memleak upon realloc failureAndreas Rheinhardt2020-07-021-3/+4
| | | | | | | | | The classical ptr = av_realloc(ptr, size). Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 418e468699868a0265f8b439beedf64bb643b088) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Don't discard the upper 32bits of TrackNumberAndreas Rheinhardt2020-07-021-2/+2
| | | | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit ba36a077342c01faa3f3deb841e8cdcc1379ea3d) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/hnm: Check for extradata allocation failureAndreas Rheinhardt2020-07-021-3/+4
| | | | | | | | | | | and also add padding to it; moreover, don't use memcpy to write one byte to extradata. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9e0f3352d1f37a739d98df4347a2b60a396a56fe) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/subtitles: Don't increment packet counter prematurelyAndreas Rheinhardt2020-07-021-1/+2
| | | | | | | | | | | Do it only if the packet has been successfully allocated in av_new_packet() -- otherwise on error a completely uninitialized packet would be unreferenced later. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6bd8bcc2ac4c64577d964552317989e61db794d8) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/bethsoftvid: Fix potential memleak upon reallocation failureAndreas Rheinhardt2020-07-021-3/+7
| | | | | | | | | | The classical ptr = av_realloc(ptr, size), just with av_fast_realloc(). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 5acef1206144554a48f699b421e8d739e752d8ab) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/smoothstreaming: Fix memleaks on errorsAndreas Rheinhardt2020-07-021-4/+4
| | | | | | | | | | | | | | | | If an AVFormatContext could be allocated, but white-/blacklists couldn't be copied, the AVFormatContext would leak as it was only accessible through a local variable that goes out of scope when one goes to fail. Furthermore, in case writing a header of a submuxer failed, the options used for said call could leak. Both of these memleaks have been fixed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit abbb466368c51285ca27d5e3959a16a9591e9a4c) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskaenc: Check BlockAdditional size before useAndreas Rheinhardt2020-07-021-3/+7
| | | | | | | | | | Don't read a 64bit number before having checked that the data is at least 8 bytes long. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 6e9cc964293bf1e0cca6a52b2938a20d711e4146) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/utils: Fix memleaks in avformat_open_input()Andreas Rheinhardt2020-07-021-6/+11
| | | | | | | | | | | | | | | | | A demuxer might have allocated memory while reading the header. If reading the header was successfull and an error happens before returning (e.g. when queueing the attached pictures), the read_close function would have never been called, so that all those allocations would leak. This commit changes this. Furthermore, there would be even more memleaks if the error level was set to AV_EF_EXPLODE in case there is both metadata and id3v2 metadata. This has been fixed, too. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Marton Balint <cus@passwd.hu> (cherry picked from commit e2307f4ff197646a7feee0edbcdd2d3262932676) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/mov: Don't leak MOVFragmentStreamInfo on errorAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | Fixes Coverity issue #1441933. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 43f58f2354bfab3819e44c1a97b0af75cc091226) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/hevc: Fix potential leak in case of ff_hevc_annexb2mp4_buf failureAndreas Rheinhardt2020-07-022-4/+10
| | | | | | | | | | | | | | ff_hevc_annexb2mp4_buf() could indicate an error, yet leave cleaning after itself to the caller, so that a caller could not simply return the error, but had to free the buffer first. (Given that all current callers have set filter_ps = 0, this error can currently not be triggered.) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 680cd59bb21c7bce92789ff885c018207b0b90bc) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskaenc: Check for reformatting errorsAndreas Rheinhardt2020-07-021-11/+17
| | | | | | | | | | | | | This is needed especially for AV1: If a reformatting error happens (e.g. if the length field of an OBU contained in the current packet indicates that said OBU extends beyond the current packet), the data pointer is still NULL, yet the size is unchanged, so that writing the data leads to a segmentation fault. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 58428bef4b2c053f47dce35157fb96833ba8efea) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/segafilmenc: Fix undefined left shift of 1 by 31 placesAndreas Rheinhardt2020-07-021-1/+1
| | | | | | | | | by changing the type to unsigned. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 8ae026d74f599b2d00b91798af1c1067a879007c) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/wtvdec: Fix memleak when reading header failsAndreas Rheinhardt2020-07-021-1/+3
| | | | | | | | | | Fixes #8314. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Reviewed-by: Peter Ross <pross@xvid.org> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 373c1c9b691fd4c6831b3a114a006b639304c2af) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/fitsdec: Fix potential leak of string in AVBPrintAndreas Rheinhardt2020-07-021-1/+1
| | | | | | | | | by freeing it a bit earlier. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit bb20f3dd730689c3a99f7820cff8b74b06992fff) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Fix use-after-free when demuxing ProResAndreas Rheinhardt2020-07-021-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ProRes in Matroska is supposed to not contain the first atom header (containing a size field and the tag "icpf") and therefore the Matroska demuxer has to recreate it; this involves an allocation and copy, of course. Whether the old buffer (containing the data without the atom header) needs to be freed or not depends upon whether it is what was directly read (in which case it is owned by an AVBuffer) or whether it has been allocated when reversing the track's content compression (e.g. zlib compression) that Matroska supports. So there are three pointers involved: The one pointing to the directly read data (owned by the AVBuffer), the one pointing to the currently valid data (which coincides with the former if no content compression needed to be reverted) and the one pointing to the new data with the first atom header. The check for whether to free the second of these is simply whether the first two are different. This works mostly, but there is a complication: Some muxers don't strip the first atom header away and in this case, it is also not reinserted and no new buffer is allocated; instead, the second and the third pointers agree. In this case, one must never free the second buffer. Yet it is currently done if the track is e.g. zlib compressed. This commit fixes this. This is a regression since b8e75a2a. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit af50f0a515d8096fece9776e2d3034fe990a1373) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/matroskadec: Fix demuxing ProResAndreas Rheinhardt2020-07-021-4/+5
| | | | | | | | | | | | | | | | | | | | The structure of a ProRes frame in mov/mp4 is that of a typical atom: First a 32 bit BE size field, then a tag detailling the content. Said size field includes the eight bytes of the atom header. This header is actually redundant, as the size of the atom is already known from the containing atom. It is therefore stripped away when muxed into Matroska and so the Matroska demuxer has to recreate upon demuxing. But it did not account for the fact that the size field includes the size of the header and this can lead to problems when a decoder uses the in-band size field. Fixes ticket #8210. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 581419ea39de6619c3389b8d10ac2cbe212c62a0) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/mov: fix memleaksZhao Zhili2020-07-011-4/+3
| | | | | | | | | | Fix two cases of memleaks: 1. The leak of dv_demux 2. The leak of dv_fctx upon dv_demux allocate failure Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit f3dc38a186b2326ce03e50969897ea703817ddb0) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* libavformat/mov: Fix memleaks when demuxing DV audioAndreas Rheinhardt2020-07-011-10/+13
| | | | | | | | | | | | | | | | | | | | | | | The code for demuxing DV audio predates the introduction of refcounted packets and when the latter was added, changes to the former were forgotten. This meant that when avpriv_dv_produce_packet initialized the packet containing the AVBufferRef, the AVBufferRef as well as the underlying AVBuffer leaked; the actual packet data didn't leak: They were directly freed, but not via their AVBuffer's free function. https://samples.ffmpeg.org/ffmpeg-bugs/trac/ticket4671/dir1.tar.bz2 contains samples for this (enable_drefs needs to be enabled for them). Moreover, errors in avpriv_dv_produce_packet were ignored; this has been changed, too. Furthermore, in the hypothetical scenario that the track has a palette, this would leak, too, so reorder the code so that the palette code appears after the DV audio code. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 61f5c6ab06fc61e0f9f8f8dab5595b8bb202df73) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/utils: reorder duration computation to avoid overflowMichael Niedermayer2020-07-011-1/+1
| | | | | | | | | | Fixes: signed integer overflow: 8 * 9223372036854774783 cannot be represented in type 'long' Fixes: 23381/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4818340509122560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 10cc82c35baabbb07ffec3faccb04d8928c39e4c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/hls: Pass a copy of the URL for probingMichael Niedermayer2020-07-011-2/+4
| | | | | | | | | | | | The segments / url can be modified by the io read when reloading This may be an alternative or additional fix for Ticket8673 as a further alternative the reload stuff could be disabled during probing Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit b5e39880fb7269b1b3577cee288e06aa3dc1dfa2) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/hls: check segment duration value of EXTINFSteven Liu2020-07-011-2/+7
| | | | | | | | fix ticket: 8673 set the default EXTINF duration to 1ms if duration is smaller than 1ms Signed-off-by: Steven Liu <lq@chinaffmpeg.org> (cherry picked from commit 9dfb19baeb86a8bb02c53a441682c6e9a6e104cc)
View Lorry Controller Status