A negative `size' will bypass FFMIN(). In the subsequent memcpy() call,
`size' will be considered as a large positive value, leading to a buffer
overflow.
Change the type of `size' to unsigned int to avoid buffer overflow, and
simplify overflow checks accordingly.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 4e692374f7)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Sanity checks like `data + size >= data_end || data + size < data' are
broken, because `data + size < data' assumes pointer overflow, which is
undefined behavior in C. Many compilers such as gcc/clang optimize such
checks away.
Use `size < 0 || size >= data_end - data' instead.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 902cfe2f74)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
The check `start + res < start' is broken since pointer overflow is
undefined behavior in C. Many compilers such as gcc/clang optimize
away this check.
Use `res > end - start' instead. Also change `res' to unsigned int
to avoid signed left-shift overflow.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2f014567cf)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This reverts 312645e :
"Do not set codec_tag property for matroska muxers."
Also adds dummy codec_tag lists with codecs
supported in mkv but not in wav / avi.
Fixes ticket #2169.
(cherry picked from commit df39c3ce38)
* qatar/release/9:
libx264: use the library specific default rc_initial_buffer_occupancy
lavc: set the default rc_initial_buffer_occupancy
lavc: introduce the convenience function init_get_bits8
lavc: check for overflow in init_get_bits
APIchanges: Fill in missing hashes and dates; fix a version number typo.
configure: enable pic for shared libs on AArch64
zmbv: Reset the decoder on keyframe errors
vc1dec: prevent a crash due missing pred_flag parameter
matroska: Fix use after free
vp3: Fix double free in vp3_decode_end()
update Changelog
oggdec: make sure the private parse data is cleaned up
oggdec: free the ogg streams on read_header failure
update Changelog
x86: lavr: use the x86inc.asm automatic stack alignment in mixing functions
Prepare 9.1 Release
Conflicts:
Changelog
RELEASE
doc/APIchanges
libavcodec/utils.c
libavformat/oggdec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Attempting to re-parse the headers at demuxer level is a
pandora box the way its done currently.
This allows full reconfiguration of vorbis streams
Fixes Ticket2117
Fixes Ticket2121
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c994bb2fb7)
Previously we re synced from where we where which cam lead
to loosing pages.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c5cf58d4b9)
Sometimes the muxer modifies the packet, like for instance lavf/mp3enc
changing pkt->destruct in order to keep a copy. These changes must be
kept, even though the muxer behaviour is questionable. Regression since
0072116.
Fixes#2124.
(cherry picked from commit 119d70db50)
The following out-of-memory check is broken.
*sorted_segments = av_mallocz(...);
if (!sorted_segments) { ... }
The correct NULL check should use *sorted_segments.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
* qatar/master:
lavr: fix missing " in header documentation
aviobuf: Discard old buffered, previously read data in ffio_read_partial
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit 'e96406eda4':
rtsp: Add support for depacketizing RTP data via custom IO
Conflicts:
libavformat/version.h
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '3f95f0dda5':
rtpdec: Move the URLContext used for RTCP RR out from the context, to a parameter
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Followup to http://thread.gmane.org/gmane.comp.video.ffmpeg.devel/151321
patch by Reimar and Thomas Mundt fixes some AVC-Intra files from
different tickets.
It does not fix http://samples.ffmpeg.org/ffmpeg-
bugs/trac/ticket524/AVCI50.mov
Authors of this commit are: Reimar and Thomas Mundt
Patch and commit message mostly taken from ffmpeg-devel, mail by Carl
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
To use this, set sdpflags=custom_io to the sdp demuxer. During
the avformat_open_input call, the SDP is read from the AVFormatContext
AVIOContext (ctx->pb) - after the avformat_open_input call,
during the av_read_frame() calls, the same ctx->pb is used for reading
packets (and sending back RTCP RR packets).
Normally, one would use this with a read-only AVIOContext for the
SDP during the avformat_open_input call, then close that one and
replace it with a read-write one for the packets after the
avformat_open_input call has returned.
This allows using the RTP depacketizers as "pure" demuxers, without
having them tied to the libavformat network IO.
Signed-off-by: Martin Storsjö <martin@martin.st>
