summaryrefslogtreecommitdiff
path: root/libavformat/rmdec.c
Commit message (Collapse)AuthorAge
* avformat: Avoid allocation for AVStreamInternalAndreas Rheinhardt2021-09-17
| | | | | | | | | | Do this by allocating AVStream together with the data that is currently in AVStreamInternal; or rather: Put AVStream at the beginning of a new structure called FFStream (which encompasses more than just the internal fields and is a proper context in its own right, hence the name) and remove AVStreamInternal altogether. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4Michael Niedermayer2021-09-15
| | | | | | | | Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int' Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Simplify cleanup after read_header failureAndreas Rheinhardt2021-07-08
| | | | | | by setting the FF_FMT_INIT_CLEANUP flag. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/rmdec: Check old_format len for overflowMichael Niedermayer2021-06-18
| | | | | | | | | | | Maybe such large values could be disallowed earlier and closer to where they are set. Fixes: signed integer overflow: 538976288 * 8224 cannot be represented in type 'int' Fixes: 29102/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6704350354341888 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat: move AVStream.{parser,need_parsing} to AVStreamInternalJames Almer2021-05-07
| | | | | | | Those are private fields, no reason to have them exposed in a public header. Signed-off-by: James Almer <jamrial@gmail.com>
* avformat: Constify all muxer/demuxersAndreas Rheinhardt2021-04-27
| | | | | | | This is possible now that the next-API is gone. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> Signed-off-by: James Almer <jamrial@gmail.com>
* avformat/rmdec: Don't rely on unspecified order of evaluationAndreas Rheinhardt2021-04-08
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/rmdec: Fix memleaks upon read_header failureAndreas Rheinhardt2021-04-08
| | | | | | | | | | | | | | | | | | | | For both the RealMedia as well as the IVR demuxer (which share the same context) each AVStream's priv_data contains an AVPacket that might contain data (even when reading the header) and therefore needs to be unreferenced. Up until now, this has not always been done: The RealMedia demuxer didn't do it when allocating a new stream's priv_data failed although there might be other streams with packets to unreference. (The reason for this was that until recently rm_read_close() couldn't handle an AVStream without priv_data, so one had to choose between a potential crash and a memleak.) The IVR demuxer meanwhile never ever called read_close so that the data already contained in packets leaks upon error. This patch fixes both demuxers by adding the appropriate cleanup code. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/rmdec: use larger intermediate type for audio_framesize * ↵Michael Niedermayer2021-04-01
| | | | | | | | | | sub_packet_h check Fixes: signed integer overflow: 65535 * 65535 cannot be represented in type 'int' Fixes: 31406/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5024692843970560 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Check codec_length without overflowMichael Niedermayer2021-02-16
| | | | | | | | Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int' Fixes: 30333/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5175286983426048 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Check remaining space in debug av_log() loopMichael Niedermayer2021-02-10
| | | | | | | | | Fixes: Timeout (long -> 2 ms) Fixes: 26709/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5665833403285504 Fixes: 27522/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6321071221112832 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Reorder operations to avoid overflowMichael Niedermayer2021-02-04
| | | | | | | | Fixes: signed integer overflow: -2147483648 - 14 cannot be represented in type 'int' Fixes: 27659/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5697250168406016 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Fix codecdata_length overflow checkMichael Niedermayer2021-02-02
| | | | | | | | Fixes: signed integer overflow: 2147483647 + 64 cannot be represented in type 'int' Fixes: 28509/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-6310969680723968 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Check for EOF in index packet readingMichael Niedermayer2020-11-21
| | | | | | | | Fixes: Timeout(>10sec -> 1ms) Fixes: 27284/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-6304211110985728 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: remove unneeded memset() on packet allocationMichael Niedermayer2020-11-04
| | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Make expected_len 64bitMichael Niedermayer2020-10-25
| | | | | | | | Fixes: signed integer overflow: 1347551268 * 14 cannot be represented in type 'int' Fixes: 26458/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-5655364324032512 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: sanity check coded_framesizeMichael Niedermayer2020-10-18
| | | | | | | | Fixes: signed integer overflow: -14671840 * 8224 cannot be represented in type 'int' Fixes: 24793/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5101884323659776 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Fix potential crash on allocation failureAndreas Rheinhardt2020-09-19
| | | | | | | | | | | | | | | | The RealMedia demuxer uses the priv_data of its streams to store a structure containing an AVPacket. These packets are unreferenced in the read_close function, yet said function simply presumed that the priv_data has been successfully allocated. This implies that it mustn't be called when an allocation of priv_data fails; but this can happen since commit 35bbc1955a58ba74552c50d9161084644f00bbd3 if one has a stream with multiple substreams (also exported as AVStream) and if allocating the priv_data for one of these substreams fails. This has been fixed by making sure that read_close can handle the case in which priv_data has not been successfully allocated. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat/rmdec: Actually return value < 0 on read_header failureAndreas Rheinhardt2020-09-19
| | | | | | | | | | | | | | | The RealMedia demuxer's read_header function initially initializes ret, the variable designated for the return variable to -1. Afterwards, chunks of the file are parsed in a loop until an error happens or until the actual frame data is encountered. If the first function whose return value is put into ret doesn't fail, then ret contains a value >= 0 (actually == 0) and this is what will be returned if an error is encountered afterwards. This is a regression since 35bbc1955a58ba74552c50d9161084644f00bbd3. Before that, ret had never been overwritten with a nonnegative value. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
* avformat: Improve returned error codesAndreas Rheinhardt2020-01-08
| | | | | | | | | | This commit improves returned error codes by forwarding error codes. In some instances, the hardcoded returned error codes made no sense at all: The normal error code for failure of av_new_packet() is AVERROR(ENOMEM), yet there were instances where AVERROR(EIO) was returned. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat: Forward errors where possibleAndreas Rheinhardt2019-12-12
| | | | | | | | | | It is not uncommon to find code where the caller thinks to know better what the return value should be than the callee. E.g. something like "if (av_new_packet(pkt, size) < 0) return AVERROR(ENOMEM);". This commit changes several instances of this to instead forward the actual error. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Initialize and sanity check offset in ivr_read_header()Michael Niedermayer2019-12-10
| | | | | | | | Fixes: signed integer overflow: -9223372036854775808 - 17 cannot be represented in type 'long' Fixes: 18768/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5674385247830016 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Use av_packet_move_ref() for packet ownership transferAndreas Rheinhardt2019-12-04
| | | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec.c: fix brackets around argumentsJames Almer2019-09-15
| | | | | | Regression since 78f52b4fe3 Signed-off-by: James Almer <jamrial@gmail.com>
* avformat/rmdec.c: fix left shift of negative value in rm_sync()James Almer2019-09-15
| | | | | | | Fixes ticket 8143. Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
* lavf: Constify the probe function argument.Carl Eugen Hoyos2019-03-21
| | | | | Reviewed-by: Lauri Kasanen Reviewed-by: Tomas Härdin
* avformat/rmdec: Fix EOF check in the stream loop in ivr_read_header()Michael Niedermayer2018-08-17
| | | | | | | | | Fixes: long running loop Fixes: ivr-timeout-42468cb797f52f025fb329394702f5d4d64322d6 Found-by: Paul Ch <paulcher@icloud.com> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: Do not pass mime type in rm_read_multi() to ↵Michael Niedermayer2018-07-05
| | | | | | | | | | ff_rm_read_mdpr_codecdata() Fixes: use after free() Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362 Found-by: Paul Ch <paulcher@icloud.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/rmdec: make use of avio_get_str()Paul B Mahol2018-04-02
| | | | | | Also do not set empty metadata. Signed-off-by: Paul B Mahol <onemda@gmail.com>
* Merge commit '95ce02b35d3d1bb16111031df1d82a6e4d894d36'James Almer2017-11-07
|\ | | | | | | | | | | | | | | | | * commit '95ce02b35d3d1bb16111031df1d82a6e4d894d36': rmdec: don't ignore the return value of av_get_packet() See 65b83ce01b94eae944290c11257799a9288f2d4c Merged-by: James Almer <jamrial@gmail.com>
| * rmdec: don't ignore the return value of av_get_packet()Sean McGovern2017-07-17
| |
| * Use correct printf conversion specifiers for POSIX integer typesDiego Biurrun2016-12-23
| |
* | avformat/rmdec: Fix DoS due to lack of eof check孙浩 and 张洪亮(望初)2017-08-27
| | | | | | | | | | | | | | Fixes: loop.ivr Found-by: Xiaohei and Wangchu from Alibaba Security Team Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | Fix all -Wformat warnings raised by DJGPPClément Bœsch2017-03-29
| |
* | lavf: use av_fourcc2str() where appropriateClément Bœsch2017-03-29
| |
* | Merge commit '83548fe894cdb455cc127f754d09905b6d23c173'James Almer2017-03-21
|\| | | | | | | | | | | | | * commit '83548fe894cdb455cc127f754d09905b6d23c173': lavf: fix usage of AVIOContext.seekable Merged-by: James Almer <jamrial@gmail.com>
| * lavf: fix usage of AVIOContext.seekableAnton Khirnov2016-09-30
| | | | | | | | | | | | | | | | It is supposed to be a flag. The only currently defined value is AVIO_SEEKABLE_NORMAL, but other ones may be added in the future. However all the current lavf code treats this field as a bool (mainly for historical reasons). Change all those cases to properly check for AVIO_SEEKABLE_NORMAL.
* | Merge commit 'd9442d13033a24b14ebae149dcdb42709430e2d9'Clément Bœsch2017-03-19
|\| | | | | | | | | | | | | * commit 'd9442d13033a24b14ebae149dcdb42709430e2d9': rm: Drop broken disabled cruft Merged-by: Clément Bœsch <u@pkh.me>
| * rm: Drop broken disabled cruftDiego Biurrun2016-08-17
| |
* | avcodec: add SIPR parserPaul B Mahol2017-01-16
| | | | | | | | | | | | Fixes #2056. Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | rmdec: validate block alignmentAndreas Cadhalpun2016-11-23
| | | | | | | | | | | | | | This fixes division by zero crashes. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
* | lavf/rmdec: Do not return EIO on EOF.Carl Eugen Hoyos2016-08-02
| | | | | | | | Reported-by: applemax82
* | avformat/rmdec: Clear extradata when extradata_size is clearedMichael Niedermayer2016-07-29
| | | | | | | | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat: add AVFormatContext to ff_get_extradata()Paul B Mahol2016-04-14
| | | | | | | | | | | | Needed for av_log() inside that function. Signed-off-by: Paul B Mahol <onemda@gmail.com>
* | Merge commit '9200514ad8717c63f82101dc394f4378854325bf'Derek Buitenhuis2016-04-10
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * commit '9200514ad8717c63f82101dc394f4378854325bf': lavf: replace AVStream.codec with AVStream.codecpar This has been a HUGE effort from: - Derek Buitenhuis <derek.buitenhuis@gmail.com> - Hendrik Leppkes <h.leppkes@gmail.com> - wm4 <nfxjfg@googlemail.com> - Clément Bœsch <clement@stupeflix.com> - James Almer <jamrial@gmail.com> - Michael Niedermayer <michael@niedermayer.cc> - Rostislav Pehlivanov <atomnuker@gmail.com> Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
| * lavf: replace AVStream.codec with AVStream.codecparAnton Khirnov2016-02-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, AVStream contains an embedded AVCodecContext instance, which is used by demuxers to export stream parameters to the caller and by muxers to receive stream parameters from the caller. It is also used internally as the codec context that is passed to parsers. In addition, it is also widely used by the callers as the decoding (when demuxer) or encoding (when muxing) context, though this has been officially discouraged since Libav 11. There are multiple important problems with this approach: - the fields in AVCodecContext are in general one of * stream parameters * codec options * codec state However, it's not clear which ones are which. It is consequently unclear which fields are a demuxer allowed to set or a muxer allowed to read. This leads to erratic behaviour depending on whether decoding or encoding is being performed or not (and whether it uses the AVStream embedded codec context). - various synchronization issues arising from the fact that the same context is used by several different APIs (muxers/demuxers, parsers, bitstream filters and encoders/decoders) simultaneously, with there being no clear rules for who can modify what and the different processes being typically delayed with respect to each other. - avformat_find_stream_info() making it necessary to support opening and closing a single codec context multiple times, thus complicating the semantics of freeing various allocated objects in the codec context. Those problems are resolved by replacing the AVStream embedded codec context with a newly added AVCodecParameters instance, which stores only the stream parameters exported by the demuxers or read by the muxers.
* | avcodec/rmdec: add missing av_log argumentJames Almer2016-01-15
| | | | | | | | | | | | Also change the format specifier to expect an unsigned int Signed-off-by: James Almer <jamrial@gmail.com>
* | avformat/rmdec: Fix Packet memleak at close()Michael Niedermayer2016-01-14
| | | | | | | | | | | | | | Fixes: asan_heap-oob_445b39_1741_d00eb645ab48eb2203b4a04a5b997103.ivr Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | avformat/rmdec: Check size in ivr_read_packet() before useMichael Niedermayer2016-01-14
| | | | | | | | | | | | | | | | Fixes out of array access Fixes: asan_heap-oob_445b39_1741_d00eb645ab48eb2203b4a04a5b997103.ivr Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* | lavf/rmdec: Use correct format specifier for int64_t.Carl Eugen Hoyos2015-12-22
| | | | | | | | Fixes ticket #5100.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-10 02:05:39 +0000