- 26 May, 2020 1 commit
-
-
Andreas Rheinhardt authored
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
- 25 May, 2020 7 commits
-
-
Michael Niedermayer authored
Fixes: memleak Fixes: 19949/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5743636058210304 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
It avoids leaving dangling pointers behind in memory. Also remove redundant checks for whether the URLContext to be closed is already NULL. Reviewed-by: Anton Khirnov <anton@khirnov.net> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Mattias Wadman authored
Some flac muxers write truncated metadata picture size if the picture data do not fit in 24 bits. Detect this by truncting the size found inside the picture block and if it matches the block size use it and read rest of picture data. This workaround is only for flac files and not ogg files with flac METADATA_BLOCK_PICTURE comments and it can be disabled with strict level above normal. Currently there is a 500MB limit on truncate size to protect from large memory allocations. The truncation bug in lavf flacenc was fixed in e447a4d1 but based on existing broken files other unknown flac muxers seems to truncate also. Before the fix a broken flac file for reproduction could be generated with: ffmpeg -f lavfi -i sine -f lavfi -i color=red:size=2400x2400 -map 0:0 -map 1:0 -c:v:0 bmp -disposition:1 attached_pic -t 1 test.flac Fixes ticket 6333 Signed-off-by: Anton Khirnov <anton@khirnov.net>
-
Anton Khirnov authored
-
Andreas Rheinhardt authored
ff_id3v2_parse_apic/chapters/priv/priv_dict all had a parameter extra_meta of type ID3v2ExtraMeta ** as if the functions wanted to make *extra_meta point to something else. But they don't, so just use an ID3v2ExtraMeta *. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
Up until now, the ID3v2ExtraMeta structure (which is used when parsing ID3v2 tags containing attached pictures, chapters etc.) contained a pointer to separately allocated data that depended on the type of the tag. Yet the difference of the sizes of the largest and the smallest of these structures is fairly small, so that it is better to simply include a union of all the possible types of tag-dependent structures in ID3v2ExtraMeta. This commit implements this. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
If the write_id3v2 option is set, the aiff muxer would write id3v2 tags if there is global metadata or if there are attached pics to write. Chapters are ignored in this check that precedes writing id3v2 tags. Yet 47ac3449 added support for writing chapters as id3v2 tags, so one should check for the existence of chapters, too; otherwise the chapters would only be written in case there is global metadata or an attached pic. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
- 23 May, 2020 12 commits
-
-
Lynne authored
The Xiph foundation never standardized either Daala nor its mapping in Ogg, and all files that were created are undecodable without knowledge of the git hash.
-
Andreas Rheinhardt authored
The description of AVOutputFormat.init contains the statement that "this method must not write output". Due to this, the webm_chunk muxer defers opening the AVIOContext for the child muxer until avformat_write_header(), i.e. there is no AVIOContext when the sub-muxer's avformat_init_output() is called. But this violates the documentation of said function which requires the AVFormatContext to have an already opened AVIOContext. This commit fixes this. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
by storing s->streams[i] in a pointer instead of constantly using s->streams[i]->... Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
Don't use the functions for searching substrings when all one is looking for is a char anyway. Given that there is already a standard library function for "find last occurence of a char in a string" also allows one to remove a custom loop. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
The current parsing process for adaptation_sets does not guarantee every adaptation set to contain at least one stream, because the loop exits immediately as soon as the end of the string has been reached, without checking whether the currently active adaptation set group is lacking a stream. This would lead to segfaults lateron as the rest of the code presumed that every adaptation set contains a stream. This commit fixes this by erroring out when the last adaptation set group is incomplete. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
The WebM DASH manifest muxer uses a loop to parse the adaptation_sets string (which is given by the user and governs which AVStreams are mapped to what adaptation set) and the very beginning of this loop is "if (*p == ' ') continue;". This of course leads to an infinite loop if the condition is true. It is true if e.g. the string begins with ' ' or if there are more than one ' ' between different adaptation set groups. To fix this, the parsing process has been modified to consume the space if it is at a place where it can legitimately occur, i.e. when a new adaptation set group is expected. The latter restriction implies that an error is returned if a space exists where none is allowed to exist. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
The syntax of the adaptation_sets string by which the user determines the mapping of AVStreams to adaptation sets is "id=x,streams=a,b,c id=y,streams=d,e" (means: the streams with the indices a, b and c belong to the adaptation set with id x). Yet there was no check for whether these indices were actual numbers and if there is a number whether it really extends to the next ',', ' ' or to the end of the string or not. This commit adds a check for this. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
In order to parse a number from a string, the WebM DASH manifest muxer would duplicate (via heap-allocation) the part of the string that contains the number, then read the number via atoi() and then free the duplicate again. This has been replaced by simply using strtoll() (which in contrast to atoi() has defined behaviour when the number is not representable). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
Since commit c5324d92 all custom interleave_packet() functions always return clean packets (even on error), so that unreferencing manually can be removed. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
- 22 May, 2020 6 commits
-
-
Andreas Rheinhardt authored
AVStream.request_probe as well as AVStream.mux_ts_offset are below the separator of public and private fields, so that a further "NOT PART OF PUBLIC API" is redundant. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Martin Storsjö authored
Signed-off-by: Martin Storsjö <martin@martin.st>
-
Martin Storsjö authored
Move the copying of the frame to vos_data further up in the function, so that when writing the actual frame data for the first frame, it's clear that the stream really is in annex b format, for the cases where we create extradata from the first frame. Alternatively - we could invert the checks for bitstream format. If extradata is missing, we can't pretend that the bitstream is in mp4 form, because we can't even know the NAL unit length prefix size in that case. Also avoid creating extradata for AVC intra. If the track tag is an AVC intra tag, don't copy the frame into vos_data - this matches other existing cases of how vos_data and TAG_IS_AVCI interact in other places. Signed-off-by: Martin Storsjö <martin@martin.st>
-
Andreas Rheinhardt authored
Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
by using a const void * pointer as an intermediate. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
av_stream_get_side_data() tells the caller whether a stream has side data of a specific type; if present it can also tell the caller the size of the side data via an optional argument. The Matroska muxer always used this optional argument, although it doesn't really need the size, as the relevant side-data are not buffers, but structures. So change this. Furthermore, relying on the size also made the code susceptible to a quirk of av_stream_get_side_data(): It only sets the size argument if it found side data of the desired type. mkv_write_video_color() checks for side-data twice with the same variable for the size without resetting the size in between; if the second type of side-data isn't present, the size will still be what it was after the first call. This was not dangerous in practice, as the check for the existence of the second side-data compared the size with the expected size, so it would only be problematic if lots of elements were to be added to AVContentLightMetadata. Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
- 21 May, 2020 5 commits
-
-
Joey Smith authored
Some real-world sites use an authorization header with a bearer token; when combined with lengthy request parameters to identify the video segment, it's rather trivial these days to have a request body of more than 4k bytes. MAX_URL_SIZE is hard-coded to 4k bytes in libavformat/internal.h, and HTTP_HEADERS_SIZE is 4k as well in libavformat/http.h, so this patch increases the buffer size to 8k, as that is the default request body limit in Apache, and most other httpds seem to support at least as much, if not more. Signed-off-by: Marton Balint <cus@passwd.hu>
-
Michael Niedermayer authored
Fixes: signed integer overflow: -9223372036854775808 - 45000 cannot be represented in type 'long' Fixes: ticket8187 Found-by: Suhwan Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Fixes: signed integer overflow: 30000299 * 256 cannot be represented in type 'int' Fixes: ticket8184 Found-by: Suhwan Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Michael Niedermayer authored
Fixes: out of array access Fixes: stack-buffer-overflow-READ-0x0831fff1 Found-by: GalyCannon <galycannon@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
Andreas Rheinhardt authored
The TTA muxer writes a seektable in a dynamic buffer as it receives packets and when writing the trailer, closes the dynamic buffer using avio_close_dyn_buf(), writes the seektable and frees the buffer. But the TTA muxer already has a deinit function which unconditionally calls ffio_free_dyn_buf() on the dynamic buffer, so switching to avio_get_dyn_buf() means that one can remove the code to free the buffer; furthermore, it also might save an allocation if the seektable is so small that it fits into the dynamic buffer's write buffer or if adding the padding that avio_close_dyn_buf() adds necessitated reallocating of the underlying buffer. Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
- 20 May, 2020 3 commits
-
-
Andreas Rheinhardt authored
ff_id3v2_free_extra_meta() takes a ID3V2ExtraMeta ** so that it can already reset the pointer. Reviewed-by: Jun Zhao <mypopy@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Martin Storsjö authored
Sticking a full frame in the extradata works, as the code for writing the avcC/hvcC extracts the relevant parameter set NAL units - provided that they actually exist in the frame. Some encoders don't provide split out extradata directly on init (or at all). In particular, the MediaFoundation encoder wrapper doesn't always (depending on the actual encoder device) - this is the case for Qualcomm's HEVC encoder on SD835, and also on some QSV H264 encoders). This only works for cases where the moov hasn't already been written (e.g. when not writing fragmented mp4 with empty_moov, unless using the delay_moov option). Signed-off-by: Martin Storsjö <martin@martin.st>
-
Dale Curtis authored
2d8d554f added a new error condition to mov_read_stsz() but forgot to free a temporary buffer when it occurs. Signed-off-by: Dale Curtis <dalecurtis@chromium.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
- 19 May, 2020 6 commits
-
-
Paul B Mahol authored
-
Steven Liu authored
because it need be check for success, is should not change the old way if it failure. fix ticket: 8674 Signed-off-by: Steven Liu <liuqi05@kuaishou.com>
-
Andreas Rheinhardt authored
Each AttachedFile in Matroska can have a FileDescription element that contains a human-friendly name for the attached file; yet this element has been ignored up until now. This commit changes this and exports it as title tag instead (the Matroska muxer mapped the title tag to the AttachedFile element since support for Attachments was added). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
The Matroska muxer writes the Chapters early when chapters were already available when writing the header; in this case any tags pertaining to these chapters get written, too. Yet if no chapters had been supplied before writing the header, Chapters can also be written when writing the trailer if any are supplied. Tags belonging to these chapters were up until now completely ignored. This commit changes this: Writing the tags belonging to chapters has been moved to mkv_write_chapters(). If mkv_write_tags() has not been called yet (i.e. when chapters are written when writing the header), the AVIOContext for writing the ordinary Tags element is used, but not output, as this is left to mkv_write_tags() in order to only write one Tags element. Yet if mkv_write_tags() has already been called, mkv_write_chapters() will output a Tags element of its own which only contains the tags for chapters. When chapters are available initially, the corresponding tags will now be the first tags in the Tags element; but the ordering of tags in Tags is irrelevant anyway. This commit also makes chapter_id_offset local to mkv_write_chapters() as it is used only there and not reused at all. Potentially writing a second Tags element means that the maximum number of SeekHead entries had to be incremented. All the changes to FATE result from the ensuing increase in the amount of space reserved for the SeekHead (21 bytes more). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
This is needed so that it can access mkv_write_tag() and mkv_check_tag() without using forward declarations (which are unnecessary here). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
Andreas Rheinhardt authored
Up until now, the Matroska muxer writes only one Tags level 1 element and therefore using a certain place to store the dynamic buffer used for writing it was hardcoded; yet the Matroska specifications allow an unlimited amount of Tags elements and we have reason to write a second one: If chapters are provided after writing the header, they are written when writing the trailer; yet the corresponding tags are ignored. This can be fixed by writing them in a second Tags element. Also use a MatroskaMuxContext * instead of an AVFormatContext * as parameter in mkv_write_tag() and mkv_write_tag_targets() as that is all these functions use. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
-