| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
| |
Reviewed-by: Michael Niedermayer <[email protected]>
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 5d91b7718efc581da8882a4e9bf2f5953e41adbf)
Signed-off-by: Andreas Rheinhardt <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
| |
No audio stream is created unconditionally and if none has been created,
no packet with stream_index 1 may be returned. This fixes an assert in
ff_read_packet() in libavformat/utils reported in ticket #8782.
Reviewed-by: Michael Niedermayer <[email protected]>
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit ec59dc73f0cc8930bf5dae389cd76d049d537ca7)
Signed-off-by: Andreas Rheinhardt <[email protected]>
|
|
|
|
|
|
|
|
|
| |
mov_read_default
Reviewed-by: Andreas Rheinhardt <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 806a4d5187aeb82b97898683242886ed1e84f894)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: Assertion failure
Fixes: 23758/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5160954605338624.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 321ea59dac6538f92206bab0a2688fa24a25c4d2)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: signed integer overflow: 8 * 9223372036854774783 cannot be represented in type 'long'
Fixes: 23381/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4818340509122560
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 10cc82c35baabbb07ffec3faccb04d8928c39e4c)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
| |
The segments / url can be modified by the io read when reloading
This may be an alternative or additional fix for Ticket8673
as a further alternative the reload stuff could be disabled during
probing
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit b5e39880fb7269b1b3577cee288e06aa3dc1dfa2)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: signed integer overflow: 1394614304 * 2 cannot be represented in type 'int'
Fixes: 23491/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5697377020411904
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit b6fbbe08c325415cc784df296058beb6604f0b9c)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
| |
Fixes: signed integer overflow: 1 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 23490/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5133490093031424
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit a8fb7612a97530bdd0b2549dacf91dcf71a3187a)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fix two cases of memleaks:
1. The leak of dv_demux
2. The leak of dv_fctx upon dv_demux allocate failure
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit f3dc38a186b2326ce03e50969897ea703817ddb0)
Signed-off-by: Andreas Rheinhardt <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The code for demuxing DV audio predates the introduction of refcounted
packets and when the latter was added, changes to the former were
forgotten. This meant that when avpriv_dv_produce_packet initialized the
packet containing the AVBufferRef, the AVBufferRef as well as the
underlying AVBuffer leaked; the actual packet data didn't leak: They
were directly freed, but not via their AVBuffer's free function.
https://samples.ffmpeg.org/ffmpeg-bugs/trac/ticket4671/dir1.tar.bz2
contains samples for this (enable_drefs needs to be enabled for them).
Moreover, errors in avpriv_dv_produce_packet were ignored; this has been
changed, too.
Furthermore, in the hypothetical scenario that the track has a palette,
this would leak, too, so reorder the code so that the palette code
appears after the DV audio code.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 61f5c6ab06fc61e0f9f8f8dab5595b8bb202df73)
Signed-off-by: Andreas Rheinhardt <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Up until now, ff_avc_decode_sps would parse a SPS and return some
properties from it in a freshly allocated structure. Yet said structure
is very small and completely internal to libavformat, so there is no
reason to use the heap for it. This commit therefore changes the
function to return an int and to modify a caller-provided structure.
This will also allow ff_avc_decode_sps to return better error codes in
the future.
It also fixes a memleak in mxfenc: If a packet contained multiple SPS,
only the SPS structure belonging to the last SPS would be freed, the
other ones would leak when the pointer is overwritten to point to the
new SPS structure. Of course, without allocations there are no leaks.
This is Coverity issue #1445194.
Furthermore, the SPS structure has been renamed from
H264SequenceParameterSet to H264SPS in order to avoid overlong lines.
Reviewed-by: Tomas Härdin <[email protected]>
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit a0b6df0a3953e2586e63f513485c4d2d42507d7f)
Signed-off-by: Andreas Rheinhardt <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Two kinds of errors can happen when working with dynamic buffers:
(Re)allocation errors or truncation errors (one has to truncate the
buffer to a size of INT_MAX because avio_close_dyn_buf() and
avio_get_dyn_buf() both return an int). Right now, avio_get_dyn_buf()
returns an empty buffer in either case. But given that
avio_get_dyn_buf() does not destroy the dynamic buffer, one can return
the buffer in case of truncation and let the user check the error flags
and decide for himself instead of hardcoding a single way to proceed
in case of truncation.
(This actually restores the behaviour from before commit
163bb9ac0af495a5cb95441bdb5c02170440d28c.)
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit c33e56c7a6a8bef7d95e1d36eb2f35748d475695)
Signed-off-by: Andreas Rheinhardt <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
If adding two ints overflows, it doesn't matter whether the result will
be stored in an unsigned or not; and checking afterwards does not make it
retroactively defined.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 28a078eded1c29985ed078b59d48ff59cf00394b)
Signed-off-by: Andreas Rheinhardt <[email protected]>
|
|
|
|
|
|
|
|
| |
Only read str_size bytes from offset 30 of extradata if the extradata is
indeed at least 30 + str_size bytes long.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit ff3fad6b0edb13dd664403b01bc00309f035b110)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
mov_read_custom tries to read three strings belonging to three different
tags. When an already encountered tag is encountered again, a new buffer
for the string to be read is allocated and stored in the pointer
destined for this particular tag. But in this scenario, said pointer
already holds the address of the string read earlier, leading to a leak.
This commit therefore aborts the reading process upon encountering
an already encountered tag.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit dfef1d5e3cd4dfead84416a01e6c9ff0da50b34d)
|
|
|
|
|
|
|
|
|
| |
The argument pertaining to a printf %s conversion specifier must not
be NULL, even if the precision (i.e. the number of characters to write)
is zero. If it is NULL, it is undefined behaviour.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 6de6ce7bc80e874099895b6c73977bc2efb06a4d)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit c784fe8b867e42a1c8d2c48d7046e3e0cce7ec31)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 67434afa7fcb2b411b10a4d09fb30cd3a5907c2c)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if allocating the AVStream for the subtitles fails.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 337783b118d4cc265759c103b672dd5d5d3e7cb8)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit a708f652737eba08607df84394ca4bec6b458736)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 9751d7515222c7b58d0c6fb31aec6e0464c0f338)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit e13874b9eae4e156ca1c478e6d59d3461bbdc09f)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit c70409957c7332971f0e147729d769f6d2f95390)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit f3c63e67bb00fa7d96595203d01a576df651e275)
|
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when creating extradata.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit f161f8e4ad10c8ae5b2e97870e09bc6a421408eb)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 9df560e8986640e20c62286f0baee2a80540accd)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon creating an AVStream.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit a5ed8aeea4f4199e89520c3fdbd9d07ae7fc3c3f)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 331799747e7e995710f5dfc4d413cda35eb01289)
|
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or when allocating extradata.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit b12014a5b861959fd41a32ba3ff4cb139c56efcd)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit d38694cea9f289b3f9dcce1a2f07746d029b35f3)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit c13a752733a9af955b032c55f704b748fe37dd19)
|
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle
or if creating the extradata failed.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 5ab39c2d8c1e5e00b48d758eee7d5ae435a99ef7)
|
|
|
|
|
|
|
|
| |
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue)
would leak if an error happened upon reading a subsequent subtitle.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit a86a5d06d8967d01964833456df1df9fc186f125)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
By default, a demuxer's read_close function is not called automatically
if an error happens when reading the header; instead it is up to the
demuxer to clean up after itself in this case. The mov demuxer did this
by calling its read_close function when it encountered some errors when
reading the header. Yet for other errors (mostly adding side-data to
streams) this has been forgotten, so that all the internal structures
of the demuxer leak.
This commit fixes this by making sure mov_read_close is called when
necessary.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit ac378c535be907ee383dafb430be7216a2920982)
|
|
|
|
|
|
|
|
| |
Fixes possible leaks of id3v2 metadata as well as an AVDES struct in
case the content is encrypted and an error happens lateron.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 3d3ba43bc68ca90fe72d0fc390c9e5f5c7de1513)
|
|
|
|
|
|
|
|
| |
In certain error scenarios, the underlying Matroska demuxer was not
properly closed, causing leaks.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 0841063ce6a2e664fb3986b0a255c57392cd9f02)
|
|
|
|
|
|
|
|
|
|
|
| |
When demuxing a Matroska/WebM file, streams are added for tracks and for
attachments, so that the array containing the former can be NULL even
when the corresponding AVFormatContext has streams. So check for there
to be tracks in the MatroskaDemuxContext instead of just streams in the
AVFormatContext before dereferencing the pointer to the tracks.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 1ef30571a0a7150cb20c580bfc52af2a7101c20d)
|
|
|
|
|
|
|
|
|
|
|
| |
matroska_parse_block currently asserts that the duration is not equal to
AV_NOPTS_VALUE, but there is nothing that actually guarantees this. It
is easy to create (spec-compliant) files which run into this assert;
so replace it and instead cap the duration to INT64_MAX, as the duration
field of an AVPacket is an int64_t.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 3714d452b894821591a2fbafdd1b8ef15abe4be6)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
EBML binary elements are already made reference-counted when read;
so when populating the AVStream.attached_pic, one does not need to
allocate a new buffer for the data; instead the current code just
creates a new reference to the underlying AVBuffer. But this can be
improved even further: Just move the already existing reference.
This also fixes a memleak that happens upon error because
matroska_read_close has not been called in this scenario.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit cbe336c9e81e2d9de3a18abef887c9255a9b9da5)
|
|
|
|
|
|
|
|
|
|
|
|
| |
c801ab43c36e8c4f88121aa09af26c77bcbd671b caused a regression: The stream
number is now parsed with strtoll without a fixed basis; as a
consequence, the "010" in a variant stream mapping like "a:010" is now
treated as an octal number (i.e. as eight, not ten). This was not
intended and may break some scripts, so this commit restores the old
behaviour.
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 19a876fd6973724521dd5e7cc8f8e4683b19eda4)
|
|
|
|
|
|
|
|
|
|
|
| |
Fixes: memleak
Fixes: 23415/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5124814510751744
Suggested-by: Marton Balint <[email protected]>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 0aa2768cb275bda9e9e1331ed95adc7cd686eafe)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
| |
for it
Fixes: assertion failure
Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit c517c3f4741b6897ea952d1fba199c93c5217cfe)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
| |
Fixes: 22082/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5688619118624768
Fixes: crash from V-codecs/Theora/theora_testsuite_broken/multi2.ogg
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Lynne on IRC
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 70277f12328fb052c2c758fa7f4eb36b9ea89638)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: memleaks
Fixes: 23306/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5635436931448832
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 9b5fc789fb52af8769ec66e634ea362a67cb5d06)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: division by zero
Fixes: 23162/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4856420817436672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 0e15b01b4e463d12128db2c15de7741637548347)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
| |
Fixes: signed integer overflow: 9223372036854775807 - -1 cannot be represented in type 'long'
Fixes: 23167/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-6425051741290496
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit 9a42a67c5ca198a3879b7f3663cc44ccbcaf0bd3)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
| |
Signed-off-by: Dale Curtis <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit bf446711bc8b7f316771870b8d4dc4dd65f5d94b)
Signed-off-by: Michael Niedermayer <[email protected]>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Previously, prompeg_write() would only report to caller that bytes we
written when a FEC packet was actually created. Not all RTP packets are
expected to generate a FEC packet however, so this behavior was causing
avio to retry writing the RTP packet, eventually forcing the FEC state
machine to send a FEC packet erroneously (and so breaking out of the
retry loop).
This was resulting in incorrect FEC data being generated, and far too
many FEC packets to be sent (~100% FEC overhead).
fix #7863
Signed-off-by: David Holroyd <[email protected]>
(cherry picked from commit ffc1208266c2890a1b0e2391e0a536fe9698e69c)
|
|
|
|
|
|
|
|
| |
fix ticket: 8673
set the default EXTINF duration to 1ms if duration is smaller than 1ms
Signed-off-by: Steven Liu <[email protected]>
(cherry picked from commit 9dfb19baeb86a8bb02c53a441682c6e9a6e104cc)
|
|
|
|
|
|
|
|
| |
fix ticket: 8688
should goto failed workflow if cannot get usable string by ff_make_absolute_url
Signed-off-by: Steven Liu <[email protected]>
(cherry picked from commit ea1940c6e2ead234f6e563c095bb67d352e3328f)
|