- 16 Jul, 2019 5 commits
-
-
Andreas Rheinhardt authored
Currently, resyncing during reading packets works as follows: The current position is recorded, then a call to matroska_parse_cluster is made and if said call fails, the demuxer tries to resync from the earlier position. If the call doesn't fail, but also doesn't deliver a packet, then this is looped. There are two problems with this approach: 1. The Matroska file format aims to be forward-compatible; to achieve this, a demuxer should simply ignore and skip elements it doesn't know about. But it is not possible to reliably distinguish unknown elements from junk. If matroska_parse_cluster encounters an unknown element, it can therefore not simply error out; instead it returns zero and the loop is iterated which includes an update of the position that is intended to be used in case of errors, i.e. the element that is skipped is not searched for level 1 element ids to resync to at all if later calls to matroska_parse_cluster return an error. Notice that in case that sync has been lost there can be a chain of several unknown/possibly junk elements before an error is detected. 2. Even if a call to matroska_parse_cluster delivers a packet, this does not mean that everything is fine. E.g. it might be that some of the block's data is missing and that the data that was presumed to be from the block just read actually contains the beginning of the next element. This will only be apparent at the next call of matroska_read_packet, which uses the (false) end of the earlier block as resync position so that in the (not unlikely) case that the call to matroska_parse_cluster fails, the data believed to be part of the earlier block is not searched for a level 1 element to resync to. To counter this, a "last known good" position is introduced. When an element id that is known to be allowed at this position in the hierarchy (according to the syntax currently in use for parsing) is read and some further checks (regarding the length of the element and its containing master element) are passed, then the beginning of the current element is treated as a "good" position and recorded as such in the MatroskaDemuxContext. Because of 2., only the start of the element is treated as a "good" position, not the whole element. If an error occurs later during parsing of clusters, the resync process starts at the last known good position. Given that when the header is damaged the subsequent resync never skips over data and is therefore unaffected by both issues, the "last known good" concept is not used there. Signed-off-by:
Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
Since the changes to the parsing of SimpleBlocks, both ebml_parse_id and ebml_parse_elem are only called from one place, so that it is possible to inline these two function calls. This is done, but not completely: ebml_parse_id still exists in a modified form. This is done in preparation for a further patch regarding the handling of unknown-length elements. Signed-off-by:
Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
The earlier code set the level to zero upon seeking and after a discontinuity although in both cases parsing (re)starts at a level 1 element. Also set the segment's length to unkown if an error occured in order not to drop any valid data that happens to be beyond the designated end of the segment. Signed-off-by:
Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
This function will be useful later to reset the status (e.g. current level and the already parsed id). Signed-off-by:
Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
When an error happens, the Matroska demuxer tries to resync to level 1 elements from an earlier position onwards. If the seek to said earlier position fails, the demuxer currently treats this as an unrecoverable error. And that behaviour is suboptimal as said failure is nothing unrecoverable or unexpected (when the input isn't seekable). It is preferable to simply resync from the earliest position available (i.e. the start of the AVIOContext's buffer) onwards if the seek failed. Here are some scenarios that might be treated as unrecoverable errors by the current code if the input isn't seekable. They all have in common that the current position is so far away from the desired position that the seek can't be fulfilled from the AVIOContext's buffer: 1. Blocks (both SimpleBlocks as well as a Block in a BlockGroup) for which reading them as binary EBML elements succeeds, but whose parsing triggers an error (e.g. an invalid TrackNumber). In this case the earlier position from which resyncing begins is at the start of the block (or even earlier). 2. BlockGroups, whose parsing fails in one of the latter elements. Just as in 1., the start of the BlockGroup (the target of the seek) might be so far away from the current position that it is no longer in the buffer. 3. At the beginning of parsing a cluster, the cluster is parsed until a SimpleBlock or a BlockGroup is encountered. So if the input is damaged between the beginning of the cluster and the first occurrence of a SimpleBlock/BlockGroup and if said damage makes the demuxer read/skip so much data that the beginning of the cluster is no longer in the buffer, demuxing will currently fail completely. Signed-off-by:
Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
- 15 Jul, 2019 4 commits
-
-
James Almer authored
The field was removed years ago. Signed-off-by:
James Almer <jamrial@gmail.com>
-
Steven Liu authored
Tested-by:
Michael Niedermayer <michael@niedermayer.cc> Signed-off-by:
Steven Liu <lq@chinaffmpeg.org>
-
Steven Liu authored
fix ticket: 8015 Reported-by: Jun Zhao Signed-off-by:
Steven Liu <lq@chinaffmpeg.org>
-
Jun Zhao authored
Add missing documentation for nointra. Reviewed-by:
Michael Niedermayer <michael@niedermayer.cc> Signed-off-by:
Jun Zhao <barryjzhao@tencent.com>
-
- 14 Jul, 2019 15 commits
-
-
Michael Niedermayer authored
Fixes: signed integer overflow: 32 * 538976288 cannot be represented in type 'int' Fixes: 15633/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5752273981931520 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by:
Paul B Mahol <onemda@gmail.com> Signed-off-by:
Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Fixes: left shift of 133 by 24 places cannot be represented in type 'int' Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSuggested-by:
Reimar Döffinger <Reimar.Doeffinger@gmx.de> Reviewed-by:
Reimar Döffinger <Reimar.Doeffinger@gmx.de> Signed-off-by:
Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Reviewed-by:
Peter Ross <pross@xvid.org> Signed-off-by:
Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
The dump_extra bitstream filter currently simply adds the extradata to the packets indicated by the user without checking whether said extradata already exists in the packets. Besides wasting space duplicated extradata in the same packet/access unit is also forbidden for some codecs, e.g. MPEG-2. This check has been added to be able to use the mpeg2_qsv encoder (which only adds the sequence headers to the first packet) in broadcast scenarios where repeating sequence headers are required. The check used here is not perfect: E.g. dump_extra would add the extradata to a H.264 access unit consisting of an access unit delimiter, SPS, PPS and slices. Fixes #8007. Signed-off-by:
Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by:
Michael Niedermayer <michael@niedermayer.cc>
-
Paul B Mahol authored
Fixes non-monotonous timestamps.
-
Paul B Mahol authored
-
Paul B Mahol authored
-
Paul B Mahol authored
Fixes non-monotonous timestamps.
-
Paul B Mahol authored
Fixes non-monotonous timestamps.
-
Steve Lhomme authored
It's better to do it before the buffers are actually created. At least in VLC we currently don't support changing some parameters dynamically easily so we don't use the information if it comes after the buffer are created. Co-authored-by:
James Almer <jamrial@gmail.com> Signed-off-by:
James Almer <jamrial@gmail.com>
-
Steve Lhomme authored
It's better to do it before the buffers are actually created. At least in VLC we currently don't support changing some parameters dynamically easily so we don't use the information if it comes after the buffer are created. Co-authored-by:
James Almer <jamrial@gmail.com> Signed-off-by:
James Almer <jamrial@gmail.com>
-
Paul B Mahol authored
-
Paul B Mahol authored
-
Paul B Mahol authored
Fixes non-monotonous timestamps.
-
Paul B Mahol authored
-
- 13 Jul, 2019 9 commits
-
-
Jernej Fijacko authored
Current version of dvbsub encoder doesn't support HD DVB subtitles. The high resolution bitmaps are muxed into the stream but without the DDS (display definition segment) the players asume that the DVB subtitles are in SD (720x576) resolution which causes them to either render the subtitles too large and misplaced or don't render them at all. By including the DDS as defined in section 7.7.1 of ETSI EN 300 743 (V1.3.1) this problem is fixed. 7.2.1 Display definition segment The display definition for a subtitle service may be defined by the display definition segment if present in the stream. Absence of a DDS implies that the stream is coded in accordance with EN 300 743 (V1.2.1) [5] and that a display width of 720 pixels and a display height of 576 lines may be assumed. https://www.etsi.org/deliver/etsi_en/300700_300799/300743/01.03.01_60/en_300743v010301p.pdfSigned-off-by:
Jernej Fijacko <mikrohard@gmail.com> Signed-off-by:
Marton Balint <cus@passwd.hu>
-
Andreas Rheinhardt authored
Signed-off-by:
Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by:
James Almer <jamrial@gmail.com>
-
Paul B Mahol authored
-
Michael Niedermayer authored
Fixes: out of array access Fixes: 15540/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APNG_fuzzer-5684905029140480 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by:
Paul B Mahol <onemda@gmail.com> Signed-off-by:
Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Fixes: out of array access Fixes: 15484/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5765377054736384 Fixes: 15559/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5710295743332352 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by:
Paul B Mahol <onemda@gmail.com> Signed-off-by:
Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Fixes: null pointer dereference Fixes: 15464/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HYMT_fuzzer-5681391150301184 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegReviewed-by:
Paul B Mahol <onemda@gmail.com> Signed-off-by:
Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Signed-off-by:
Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Fixes: left shift of negative value -456 Fixes: 15561/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPC8_fuzzer-5758130404720640 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSuggested-by:
James Almer <jamrial@gmail.com> Signed-off-by:
Michael Niedermayer <michael@niedermayer.cc>
-
Paul B Mahol authored
Previously it was used only for displaying frequency response.
-
- 12 Jul, 2019 4 commits
-
-
Marton Balint authored
merge_pmt_versions was not usable if multiple programs were present because when it was searching for candidate streams it did not make sure that the PMT was of the same program. This caused the streams of all programs to get merged into a single (garbled) program. This patch makes sure that the program number (service ID) is also matching with the old streams when parsing the PMT making the feature useful for multi program streams. This change might cause issues for single program streams if the program number changes, but I think it is acceptable because the goal of the option is to make the parsing resilient to PID changes, and that is still working as expected. Signed-off-by:
Marton Balint <cus@passwd.hu>
-
Marton Balint authored
English was used before. Signed-off-by:
Marton Balint <cus@passwd.hu>
-
Andreas Rheinhardt authored
Up until now, it was simply presumed that the first packet had a pts of zero; otherwise the duration of the first chunk was wrong. Signed-off-by:
Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
The earlier version of the webm_chunk muxer had several bugs: 1. If the first packet of an audio stream didn't have a PTS of zero, then no chunk will be started before a packet is delivered to the underlying Matroska/WebM muxer, i.e. the AVFormatContext used to write these packets had a NULL as AVIOContext for output. This is behind the crash in ticket #5752. 2. If an error happens during writing a packet, the underlyimg Matroska/WebM muxer context is freed. This leads to a use-after-free coupled with a double-free in webm_chunk_write_trailer (which supposes that the underlying AVFormatContext is still valid). 3. Even when no error occurs at all, webm_chunk_write_trailer is still buggy: After the underlying Matroska/WebM muxer has written its trailer, ending the chunk implicitly flushes it again which is illegal at this point. These bugs have been fixed. Fixes #5752. Signed-off-by:
Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
- 11 Jul, 2019 3 commits
-
-
Paul B Mahol authored
-
Steven Liu authored
Signed-off-by:
Steven Liu <lq@chinaffmpeg.org>
-
Steven Liu authored
Use one handler for m3u8 and segments. Use two handler in byterange mode. Signed-off-by:
Steven Liu <lq@chinaffmpeg.org>
-