diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-03-10 18:29:50 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-03-10 18:31:07 +0100 |
| commit | 15efd9a7c0a6ccc59c07c3118a2e075449c91e68 (patch) | |
| tree | d37ee430dd5c892ab8462337f6d2ebd699265c1d /libavformat | |
| parent | 0d82c3a0ca6c5ed1e757a826b966687382f0180e (diff) | |
| parent | 36017d49e2f797f7371dc24848a2285ca63e39ab (diff) | |
| download | ffmpeg-15efd9a7c0a6ccc59c07c3118a2e075449c91e68.tar.gz | |
Merge commit '36017d49e2f797f7371dc24848a2285ca63e39ab' into release/0.10
* commit '36017d49e2f797f7371dc24848a2285ca63e39ab':
Prepare for 0.8.11 Release
lavf: make av_probe_input_buffer more robust
Updated Changelog for 0.8.10
oggparseogm: check timing variables
mathematics: remove asserts from av_rescale_rnd()
vc1: Always reset numref when parsing a new frame header.
h264: reset num_reorder_frames if it is invalid
Conflicts:
RELEASE
libavcodec/vc1.c
libavformat/utils.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/oggparseogm.c | 5 | ||||
| -rw-r--r-- | libavformat/utils.c | 3 |
2 files changed, 6 insertions, 2 deletions
diff --git a/libavformat/oggparseogm.c b/libavformat/oggparseogm.c index c761bbd7db..b74537c689 100644 --- a/libavformat/oggparseogm.c +++ b/libavformat/oggparseogm.c @@ -75,6 +75,11 @@ ogm_header(AVFormatContext *s, int idx) time_unit = bytestream2_get_le64(&p); spu = bytestream2_get_le64(&p); + if (!time_unit || !spu) { + av_log(s, AV_LOG_ERROR, "Invalid timing values.\n"); + return AVERROR_INVALIDDATA; + } + bytestream2_skip(&p, 4); /* default_len */ bytestream2_skip(&p, 8); /* buffersize + bits_per_sample */ diff --git a/libavformat/utils.c b/libavformat/utils.c index 7e0476ca5f..48fe249b14 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -558,7 +558,6 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt, for(probe_size= PROBE_BUF_MIN; probe_size<=max_probe_size && !*fmt; probe_size = FFMIN(probe_size<<1, FFMAX(max_probe_size, probe_size+1))) { int score = probe_size < max_probe_size ? AVPROBE_SCORE_MAX/4 : 0; - int buf_offset = (probe_size == PROBE_BUF_MIN) ? 0 : probe_size>>1; void *buftmp; if (probe_size < offset) { @@ -572,7 +571,7 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt, return AVERROR(ENOMEM); } buf=buftmp; - if ((ret = avio_read(pb, buf + buf_offset, probe_size - buf_offset)) < 0) { + if ((ret = avio_read(pb, buf + pd.buf_size, probe_size - pd.buf_size)) < 0) { /* fail if error was not end of file, otherwise, lower score */ if (ret != AVERROR_EOF) { av_free(buf); |