Commit graph

9115 commits

Author SHA1 Message Date
Martin Storsjö
99fe4c577f r3d: Add more input value validation
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>

Conflicts:
	libavformat/r3d.c
2013-10-04 04:45:35 +02:00
Martin Storsjö
99f953b3fe rmdec: Validate the fps value
Abort if it is invalid if strict error checking has been requested.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0f310a6f33)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/rmdec.c
2013-10-04 04:45:34 +02:00
Martin Storsjö
fc4d11ec9b asfdec: Check the return value of asf_read_stream_properties
This makes sure errors in setting stream parameters are passed
on to the caller. This avoids successfully opening files while
some parameters aren't filled in properly.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit cc41167aed)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:11 +02:00
Anton Khirnov
fd2ba1807e mxfdec: set audio timebase to 1/samplerate
Fixes sync in some samples (e.g. bugs 7581 and 8374 in VLC).
Based on a commit by Matthieu Bouron <matthieu.bouron@gmail.com>

Reported-by: Jean-Baptiste Kempf <jb@videolan.org>
CC: libav-stable@libav.org
(cherry picked from commit 93370d1216)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:11 +02:00
Martin Storsjö
c10f3fed25 mov: Make sure the read sample count is nonnegative
This avoids setting a negative number of frames, ending up with a
negative average frame rate.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit c231987662)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:10 +02:00
Martin Storsjö
10f384e4f5 bfi: Add some very basic sanity checks for input packet sizes
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 640a2427aa)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:09 +02:00
Martin Storsjö
ad1223d6bc bfi: Avoid divisions by zero
If a zero-length video packet is to be returned, just return
AVERROR(EAGAIN) and switch back to the audio stream.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 9fc7184d1a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:09 +02:00
Martin Storsjö
a89868d714 electronicarts: Add more sanity checking for the number of channels
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit a9221e3960)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/electronicarts.c
2013-10-04 03:52:09 +02:00
Martin Storsjö
607863acae riffdec: Add sanity checks for the sample rate
This avoids a division by zero for G726.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d07aa3f02b)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:09 +02:00
Martin Storsjö
04d2f9ace3 mvi: Add sanity checking for the audio frame size
This avoids a division by zero.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 28ff439efd)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:09 +02:00
Martin Storsjö
2ff935a060 xwma: Avoid division by zero
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit adc09136a4)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:08 +02:00
Martin Storsjö
2e4c649b3e avidec: Make sure a packet is large enough before reading its data
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8d07258bb6)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/avidec.c
2013-10-04 03:52:08 +02:00
Martin Storsjö
60701469ab vqf: Make sure the bitrate is in the valid range
Even if the sample rate is valid, an invalid bitrate could
pass the mode combination test below.

CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 68ff998128)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:08 +02:00
Martin Storsjö
4d60ab62e0 vqf: Make sure sample_rate is set to a valid value
This avoids divisions by zero later (and possibly assertions in
time base scaling), since an invalid rate_flag combined with an
invalid bitrate below could pass the mode combination test.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 9277050e29)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:52:08 +02:00
Martin Storsjö
8bd27a167b electronicarts: Check packet sizes before reading
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit f7e616959a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:30 +02:00
Martin Storsjö
17e7edf75b lavf: Avoid setting avg_frame_rate if delta_dts is negative
This avoids setting avg_frame_rate to invalid (negative)
values.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit ce67f442be)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:29 +02:00
Martin Storsjö
ce1dacb435 rl2: Avoid a division by zero
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 3ca14aa596)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:28 +02:00
Martin Storsjö
78dc022f6f wtv: Add more sanity checks for a length read from the file
Also make sure the existing length check can't overflow.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 83c285f880)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:28 +02:00
Martin Storsjö
5379c5184b segafilm: Validate the number of audio channels
This avoids divisions by zero later.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 82e266c6d3)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:28 +02:00
Martin Storsjö
de75bc01cd idroqdec: Make sure a video stream has been allocated before returning packets
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit bcbe4f3ceb)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:27 +02:00
Martin Storsjö
00516b5491 xmv: Add more sanity checks for parameters read from the bitstream
Since the number of channels is multiplied by 36 and assigned to
to a uint16_t, make sure this calculation didn't overflow. (In
certain cases the calculation could overflow leaving the
truncated block_align at 0, leading to divisions by zero later.)

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d4c2a3740f)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:27 +02:00
Martin Storsjö
fe8bc7d1ee mov: Don't use a negative duration for setting other fields
Some files have the duration set to -1 in the mdhd atom, more
or less legitimately. (We produce such files ourselves, for the
initial duration in fragmented mp4 files.)

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 7f8d41eb09)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:26 +02:00
Martin Storsjö
163196562f oggparseogm: Convert to use bytestream2
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 19b9659f31)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:26 +02:00
Martin Storsjö
9f7a8b8f8f matroskadec: Verify realaudio codec parameters
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 569d18aa9d)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-04 03:26:25 +02:00
Martin Storsjö
e47543eda5 vocdec: Don't update codec parameters mid-stream
If we really want to support parameter changes, they need to be
signalled along with the AVPackets as parameter change side data,
not just changing the AVCodecContext parameters when a packet
is demuxed (since there may be other earlier packets yet undecoded).

Something similar was already done for the sample rate in 0883109b2,
but some parameters were left changeable.

This avoids having to recheck the channel count for validity for
each decoded frame in (ad)pcm decoders, unless the decoders
explicitly say that they accept parameter changes.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5bbfe193a0)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 23:31:38 +02:00
Martin Storsjö
153deed18b sierravmd: Do sanity checking of frame sizes
Limit the size to INT_MAX/2 (for simplicity) to be sure that
size + BYTES_PER_FRAME_RECORD won't overflow.

Also factorize other existing error return paths.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 0ef1660a63)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 23:31:34 +02:00
Martin Storsjö
9eba02d5dd omadec: Properly check lengths before incrementing the position
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 342c43d154)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 23:31:22 +02:00
Martin Storsjö
557df77eab mpc8: Make sure the first stream exists before parsing the seek table
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 17d57848fc)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:36 +02:00
Martin Storsjö
f8a72f041c mpc8: Check the seek table size parsed from the bitstream
Limit the size to INT_MAX/2 (for simplicity) to be sure that
size + FF_INPUT_BUFFER_PADDING_SIZE won't overflow.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 459f2b393a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:34 +02:00
Martin Storsjö
eba112b4e3 ape: Don't allow the seektable to be omitted
The seektable is required for filling in ape->frames[i].pos
further down.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 183b9d843a)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:31 +02:00
Martin Storsjö
47bb4d888e smacker: Avoid integer overflow when allocating packets
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 710b0e2702)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:24 +02:00
Martin Storsjö
057f655dc6 smacker: Don't return packets in unallocated streams
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 8d928023f9)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:21 +02:00
Martin Storsjö
3bd0cd2677 dsicin: Add some basic sanity checks for fields read from the file
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 48d6556dd4)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-10-03 20:29:15 +02:00
Anton Khirnov
777bc81a91 lavf: fix the comparison in an overflow check
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 26f027fba1)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 12:09:58 +02:00
Luca Barbato
1e9e311e21 dv: Add a guard to not overread the ppcm array
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 7ee191cab0)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/dv.c
2013-09-07 12:09:56 +02:00
Martin Storsjö
7b9bcd993c 4xm: Check that the read track value is non-negative
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d719981273)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/4xm.c
2013-09-07 10:25:48 +02:00
Martin Storsjö
aade60ab16 matroskadec: Check that .lang was allocated and set before reading it
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5bcd3ae5b1)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:18:59 +02:00
Anton Khirnov
9486e98712 ape demuxer: check for EOF in potentially long loops
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry-picked from commit 488b2984fe)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:18:18 +02:00
Anton Khirnov
f3c7e604fa 4xm: check that bits per sample is strictly positive
Avoids a divide by zero.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit a7c1689ded)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:15:13 +02:00
Anton Khirnov
4cb3efc206 lavf: avoid integer overflow when estimating bitrate
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit df33a58e53)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-09-07 10:15:00 +02:00
Reimar Döffinger
cbc6ded5b7 ogg: Fix potential infinite discard loop
Seeking in certain broken files would cause ogg_read_timestamp
to fail because ogg_packet would go into a state where all packets
of stream 1 would be discarded until the end of the stream.

Bug-Id: 553
CC: libav-stable@libav.org

Signed-off-by: Jan Gerber <j@v2v.cc>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit 9a27acae9e)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:58:13 +02:00
Luca Barbato
7c30ea5006 segafilm: Error out on impossible packet size
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 5268bd2900)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:47:57 +02:00
Luca Barbato
e2d32ad18e ogg: Always alloc the private context in vorbis_header
It is possible to have an initial broken header and then valid packets.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3562684db7)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:47:48 +02:00
Luca Barbato
dd923878e8 rtmp: Do not misuse memcmp
CC: libav-stable@libav.org
(cherry picked from commit 5718e3487b)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/rtmpproto.c
2013-08-24 16:21:24 +02:00
Luca Barbato
e897e0631a rtmp: rename data_size to size
(cherry picked from commit ba5393a609)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 16:20:33 +02:00
Luca Barbato
d502bd7410 oma: correctly mark and decrypt partial packets
Incomplete crypted files would lead to a read after buffer boundary
otherwise.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2219e27b5b)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/omadec.c
2013-08-24 16:11:29 +02:00
Luca Barbato
97e6099c0c oma: check geob tag boundary
Prevent read after buffer boundary on corrupted tag.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9d0b45ade8)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/omadec.c
2013-08-24 16:10:13 +02:00
Luca Barbato
0b6adcf76b oma: refactor seek function
Properly propagate seek errors from avio and the generic pcm seek.

(cherry picked from commit 4f03a77e52)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavformat/omadec.c
2013-08-24 16:08:27 +02:00
Martin Storsjö
dc556d8bf7 lavf: Make sure avg_frame_rate can be calculated without integer overflow
If either of the deltas is too large for the multiplications to
succeed, don't use this for setting the avg frame rate.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit e740929a07)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 12:12:26 +02:00
Martin Storsjö
7e9debb083 mov: Do not allow updating the time scale after it has been set
The time scale is set in mdhd, and later validated in the
enclosing trak atom once all of its children have been parsed.

A loose mdhd atom outside of a trak atom could update the time
scale of the last stream without any validation.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Cc: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 31931520df)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
2013-08-24 12:11:57 +02:00