summaryrefslogtreecommitdiff
path: root/libavformat/asfdec_o.c
Commit message (Collapse)AuthorAge
* avformat: Constify all muxer/demuxersAndreas Rheinhardt2021-04-27
| | | | | | | This is possible now that the next-API is gone. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> Signed-off-by: James Almer <jamrial@gmail.com>
* avformat/asfdec_o: Use ff_get_extradata()Michael Niedermayer2021-04-24
| | | | | | | | Fixes: OOM Fixes: 27240/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5937469859823616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/asf: Factor common code outAndreas Rheinhardt2021-03-31
| | | | | | | | Both functions to read attached pictures coincide since e83f27a21a6d2f602b55e541ef66e365400e9827 (save for some log messages in case av_dict_set failed). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/asfdec_o: use av_packet_alloc() to allocate packetsJames Almer2021-03-17
| | | | Signed-off-by: James Almer <jamrial@gmail.com>
* avformat/asfdec_o: Check lang_idxMichael Niedermayer2021-01-29
| | | | | | | | | | Fixes: index 26981 out of bounds for type 'ASFStreamData [128]' Fixes: 27334/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6197611002068992 Alternatively the array could be increased in size or the cases not fitting be ignored Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/asfdec_o: Check for EOF in asf_read_marker()Michael Niedermayer2021-01-25
| | | | | | | | Fixes: Timeout Fixes: 26460/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-5710884393189376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject()Michael Niedermayer2021-01-20
| | | | | | | | | | | Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long' Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800 Alternatively this could be ignored but then the end condition of the loop would be hard to reach as avio_tell() is int64_t Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/asfdec_o: Remove code duplicationAndreas Rheinhardt2020-11-15
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/asfdec_o: Don't reset twiceAndreas Rheinhardt2020-11-15
| | | | | | | | | | A variable has been assigned a value twice consecutively; essentially the same happens when one performs av_init_packet on an AVPacket after a call to av_packet_unref. Found via PVS-Studio (see ticket #8156). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/asfdec_o: Export metadata that applies to the whole fileAndreas Rheinhardt2020-11-15
| | | | | | | | | | | | | | | | | | The ASF specification of Metadata Objects' stream number is as follows: "Specifies whether the entry applies to a specific digital media stream or whether it applies to the whole file. A value of 0 in this field indicates that it applies to the whole file; otherwise, the entry applies only to the indicated stream number and must be between 1 and 127." Yet the asf_o demuxer (the one originating from Libav) has always treated such metadata as if it applied to a stream even though no stream with a stream number may exist in a valid ASF file. This is fixed in this commit; it affected e.g. the file wma_with_metadata_library_object_tag_trimmed.wma from the FATE suite. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/asfdec_o: Don't segfault with lots of attached picsAndreas Rheinhardt2020-11-15
| | | | | | | | | | | | | | | | | | | | | | | The ASF file format has a limit of 127 streams and the "asf_o" demuxer (the ASF demuxer from Libav) has an array of pointers for a structure called ASFStream that is allocated on demand for every stream. Attached pictures are not streams in the sense of the ASF specification, yet the demuxer created an ASFStream for them; and in one codepath it also forgot to check whether the array of ASFStreams is already full. The result is a write beyond the end of the array and a segfault lateron. Fixing this is easy: Don't create ASFStreams for attached picture streams. (Other results of the current state of affairs are unnecessary allocations (of ASFStreams structures), the misparsing of valid files (there might not be enough ASFStreams left for the valid streams if attached pictures take up too many); furthermore, the ASFStreams created for attached pictures all have the stream number 0, an invalid stream number (the valid range is 1-127). This means that invalid data (packets for a stream with stream number 0) won't get rejected lateron.) Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* lavf: move AVStream.*index_entries* to AVStreamInternalAnton Khirnov2020-10-28
| | | | | | | Those are private fields, no reason to have them exposed in a public header. Since there are some (semi-)public fields located after these, even though this section is supposed to be private, keep some dummy padding there until the next major bump to preserve ABI compatibility.
* avformat/id3v2: Remove unnecessary indirectionAndreas Rheinhardt2020-05-25
| | | | | | | | | ff_id3v2_parse_apic/chapters/priv/priv_dict all had a parameter extra_meta of type ID3v2ExtraMeta ** as if the functions wanted to make *extra_meta point to something else. But they don't, so just use an ID3v2ExtraMeta *. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* lavf/asfdec: Simplify the check conditionsJun Zhao2019-11-04
| | | | | | Simplify the check conditions Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
* lavf: Constify the probe function argument.Carl Eugen Hoyos2019-03-21
| | | | | Reviewed-by: Lauri Kasanen Reviewed-by: Tomas Härdin
* avformat/asfdec_o: Check size_bmp more fullyMichael Niedermayer2018-07-05
| | | | | | | | Fixes: integer overflow and out of array access Fixes: asfo-crash-46080c4341572a7137a162331af77f6ded45cbd7 Found-by: Paul Ch <paulcher@icloud.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat: fix id3 chaptersLukas Stabe2017-10-05
| | | | | | | | | | | These changes store id3 chapter data in ID3v2ExtraMeta and introduce ff_id3v2_parse_chapters to parse them into the format context if needed. Encoders using ff_id3v2_read, which previously parsed chapters into the format context automatically, were adjusted to call ff_id3v2_parse_chapters. Signed-off-by: wm4 <nfxjfg@googlemail.com>
* Merge commit 'cd7a2e1502f174c725c0de82711d2c7649057574'James Almer2017-10-03
| | | | | | | * commit 'cd7a2e1502f174c725c0de82711d2c7649057574': asfdec: fix reading files larger than 2GB Merged-by: James Almer <jamrial@gmail.com>
* Merge commit '0539d84d985e811e5989ef27c13f7e2dda0f9b89'James Almer2017-09-28
| | | | | | | | | * commit '0539d84d985e811e5989ef27c13f7e2dda0f9b89': asfdec: Account for different Format Data sizes See 76853a3e0ce4d4ef09ffcca7307991b8db832cd4 Merged-by: James Almer <jamrial@gmail.com>
* Merge commit '8e67039c6312ba520945f2c01b7b14df056d5ed1'James Almer2017-09-26
| | | | | | | * commit '8e67039c6312ba520945f2c01b7b14df056d5ed1': asfdec: Use the ASF stream count when iterating Merged-by: James Almer <jamrial@gmail.com>
* Merge commit '83548fe894cdb455cc127f754d09905b6d23c173'James Almer2017-03-21
| | | | | | | * commit '83548fe894cdb455cc127f754d09905b6d23c173': lavf: fix usage of AVIOContext.seekable Merged-by: James Almer <jamrial@gmail.com>
* avformat/avlanguage: make av_convert_lang_to() internalJames Almer2016-07-19
| | | | | | | The header was never installed and the function is only used in libavformat Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
* Merge commit '41ed7ab45fc693f7d7fc35664c0233f4c32d69bb'Clément Bœsch2016-06-21
| | | | | | | * commit '41ed7ab45fc693f7d7fc35664c0233f4c32d69bb': cosmetics: Fix spelling mistakes Merged-by: Clément Bœsch <u@pkh.me>
* Merge commit '0f40c9098498ad90dbbd2380eb4269015e84bde4'Clément Bœsch2016-06-21
| | | | | | | * commit '0f40c9098498ad90dbbd2380eb4269015e84bde4': Drop pointless assert.h #includes Merged-by: Clément Bœsch <clement@stupeflix.com>
* Merge commit '9200514ad8717c63f82101dc394f4378854325bf'Derek Buitenhuis2016-04-10
| | | | | | | | | | | | | | | | * commit '9200514ad8717c63f82101dc394f4378854325bf': lavf: replace AVStream.codec with AVStream.codecpar This has been a HUGE effort from: - Derek Buitenhuis <derek.buitenhuis@gmail.com> - Hendrik Leppkes <h.leppkes@gmail.com> - wm4 <nfxjfg@googlemail.com> - Clément Bœsch <clement@stupeflix.com> - James Almer <jamrial@gmail.com> - Michael Niedermayer <michael@niedermayer.cc> - Rostislav Pehlivanov <atomnuker@gmail.com> Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
* Merge commit '066281372d90d63ca021b659abcb8faefd6bc4a6'Hendrik Leppkes2016-01-19
| | | | | | | * commit '066281372d90d63ca021b659abcb8faefd6bc4a6': asfdec: Remove unused function parameters Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* asfdec_o: check for too small size in asf_read_unknownAndreas Cadhalpun2016-01-15
| | | | | | | This fixes infinite loops due to seeking back. Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* asfdec_o: break if EOF is reached after asf_read_packet_headerAndreas Cadhalpun2016-01-15
| | | | | | | | | | asf_read_payload can unset eof_reached, so check it also before calling that function. This fixes infinite loops. Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* asfdec_o: make sure packet_size is non-zero before seekingAndreas Cadhalpun2016-01-15
| | | | | | | This fixes infinite loops due to seeking back. Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* asfdec_o: prevent overflow causing seekbackAndreas Cadhalpun2016-01-15
| | | | | | | This fixes infinite loops. Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* asfdec_o: check avio_skip in asf_read_simple_indexAndreas Cadhalpun2016-01-15
| | | | | | | The loop can be very long, even though the file is very short. Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* asfdec_o: reject size > INT64_MAX in asf_read_unknownAndreas Cadhalpun2016-01-15
| | | | | | | | | | Both avio_skip and detect_unknown_subobject use int64_t for the size parameter. This fixes a segmentation fault due to infinite recursion. Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* asfdec_o: only set asf_pkt->data_size after sanity checksAndreas Cadhalpun2016-01-15
| | | | | | | | Otherwise invalid values are used unchecked in the next run. This can cause NULL pointer dereferencing. Reviewed-by: Alexandra Hájková <alexandra.khirnova@gmail.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* Merge commit '8375dc1dd101d51baa430f34c0bcadfa37873896'Hendrik Leppkes2015-11-29
| | | | | | | * commit '8375dc1dd101d51baa430f34c0bcadfa37873896': asfdec: handle the case when the stream index has an invalid value better Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit 'ce70f28a1732c74a9cd7fec2d56178750bd6e457'Hendrik Leppkes2015-10-27
| | | | | | | * commit 'ce70f28a1732c74a9cd7fec2d56178750bd6e457': avpacket: Replace av_free_packet with av_packet_unref Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit '00cc10aee380f882507bac994ac469d8358d12e8'Hendrik Leppkes2015-10-10
| | | | | | | * commit '00cc10aee380f882507bac994ac469d8358d12e8': asfdec: do not skip padding if offset is above packet size - padding Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* doc: fix spelling errorsAndreas Cadhalpun2015-10-09
| | | | | Reviewed-by: Lou Logan <lou@lrcd.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* Merge commit 'c0a49077ea4ff3a0ad30b9e33f1bb06ba9112aaa'Hendrik Leppkes2015-09-12
| | | | | | | * commit 'c0a49077ea4ff3a0ad30b9e33f1bb06ba9112aaa': asfdec: add more checks for size left in asf packet buffer Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit '77cf23668991bfd1fb69339f13e1511b4186b7b3'Hendrik Leppkes2015-09-08
| | | | | | | * commit '77cf23668991bfd1fb69339f13e1511b4186b7b3': asfdec: alloc enough space for storing name in asf_read_metadata_obj Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit '317cfaa5e09755ed0b34af512ec687963a67bdbf'Hendrik Leppkes2015-08-18
| | | | | | | * commit '317cfaa5e09755ed0b34af512ec687963a67bdbf': asfdec: prevent the memory leak in the asf_read_metada_obj Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit 'e5997152f54f790229c99f237f8eb6b5b1ee683a'Hendrik Leppkes2015-08-07
| | | | | | | * commit 'e5997152f54f790229c99f237f8eb6b5b1ee683a': asf: Use time_t where needed Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit '944f60866f507e3c0850ae9c2f30dac1da54587c'Hendrik Leppkes2015-08-07
| | | | | | | * commit '944f60866f507e3c0850ae9c2f30dac1da54587c': asfdec: read values properly Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit 'fdbc544d29176ba69d67dd879df4696f0a19052e'Hendrik Leppkes2015-08-02
| | | | | | | * commit 'fdbc544d29176ba69d67dd879df4696f0a19052e': asfdec: prevent the memory leak while reading metadata Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit '33dc1913ab7aaefc991b3e665d1d0b5d0b088672'Hendrik Leppkes2015-08-02
| | | | | | | * commit '33dc1913ab7aaefc991b3e665d1d0b5d0b088672': asfdec: remove improper assignement that caused wrong timestamps Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit '78491fe8cfed83d2aead95dafe26f0d3f999e961'Hendrik Leppkes2015-08-02
| | | | | | | * commit '78491fe8cfed83d2aead95dafe26f0d3f999e961': asfdec: do not export empty metadata Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit 'cd4d9df22738e6f147521ccb72c7930db6050914'Hendrik Leppkes2015-08-02
| | | | | | | * commit 'cd4d9df22738e6f147521ccb72c7930db6050914': asfdec: free AVDictionaries properly when closing the demuxer Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
* Merge commit 'b5c1c16247ab7d166c84eaf4564e49a1535fdaaf'Michael Niedermayer2015-07-28
| | | | | | | * commit 'b5c1c16247ab7d166c84eaf4564e49a1535fdaaf': asfdec: do not align Data Object when Broadcast Flag is set Merged-by: Michael Niedermayer <michael@niedermayer.cc>
* Merge commit '059a934806d61f7af9ab3fd9f74994b838ea5eba'Michael Niedermayer2015-07-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * commit '059a934806d61f7af9ab3fd9f74994b838ea5eba': lavc: Consistently prefix input buffer defines Conflicts: doc/examples/decoding_encoding.c libavcodec/4xm.c libavcodec/aac_adtstoasc_bsf.c libavcodec/aacdec.c libavcodec/aacenc.c libavcodec/ac3dec.h libavcodec/asvenc.c libavcodec/avcodec.h libavcodec/avpacket.c libavcodec/dvdec.c libavcodec/ffv1enc.c libavcodec/g2meet.c libavcodec/gif.c libavcodec/h264.c libavcodec/h264_mp4toannexb_bsf.c libavcodec/huffyuvdec.c libavcodec/huffyuvenc.c libavcodec/jpeglsenc.c libavcodec/libxvid.c libavcodec/mdec.c libavcodec/motionpixels.c libavcodec/mpeg4videodec.c libavcodec/mpegvideo.c libavcodec/noise_bsf.c libavcodec/nuv.c libavcodec/nvenc.c libavcodec/options.c libavcodec/parser.c libavcodec/pngenc.c libavcodec/proresenc_kostya.c libavcodec/qsvdec.c libavcodec/svq1enc.c libavcodec/tiffenc.c libavcodec/truemotion2.c libavcodec/utils.c libavcodec/utvideoenc.c libavcodec/vc1dec.c libavcodec/wmalosslessdec.c libavformat/adxdec.c libavformat/aiffdec.c libavformat/apc.c libavformat/apetag.c libavformat/avidec.c libavformat/bink.c libavformat/cafdec.c libavformat/flvdec.c libavformat/id3v2.c libavformat/isom.c libavformat/matroskadec.c libavformat/mov.c libavformat/mpc.c libavformat/mpc8.c libavformat/mpegts.c libavformat/mvi.c libavformat/mxfdec.c libavformat/mxg.c libavformat/nutdec.c libavformat/oggdec.c libavformat/oggparsecelt.c libavformat/oggparseflac.c libavformat/oggparseopus.c libavformat/oggparsespeex.c libavformat/omadec.c libavformat/rawdec.c libavformat/riffdec.c libavformat/rl2.c libavformat/rmdec.c libavformat/rtpdec_latm.c libavformat/rtpdec_mpeg4.c libavformat/rtpdec_qdm2.c libavformat/rtpdec_svq3.c libavformat/sierravmd.c libavformat/smacker.c libavformat/smush.c libavformat/spdifenc.c libavformat/takdec.c libavformat/tta.c libavformat/utils.c libavformat/vqf.c libavformat/westwood_vqa.c libavformat/xmv.c libavformat/xwma.c libavformat/yop.c Merged-by: Michael Niedermayer <michael@niedermayer.cc>
* Merge commit '9e8627a1ff9207b9e272d248da2e1bd0cc6fe2fe'Michael Niedermayer2015-07-27
| | | | | | | * commit '9e8627a1ff9207b9e272d248da2e1bd0cc6fe2fe': asfdec: interpret the first flag in an asf packet as length flag Merged-by: Michael Niedermayer <michael@niedermayer.cc>
* Merge commit '7f388c0fabc51eca3106e7cc443393269435ab52'Michael Niedermayer2015-07-23
| | | | | | | * commit '7f388c0fabc51eca3106e7cc443393269435ab52': asfdec: remove the wrong condition Merged-by: Michael Niedermayer <michael@niedermayer.cc>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-24 01:32:40 +0000