summaryrefslogtreecommitdiff
path: root/libavformat
Commit message (Collapse)AuthorAge
* avformat/mux, utils: Use dedicated pointer for AVStreamInternalAndreas Rheinhardt2021-09-17
| | | | | | | This gets rid of ugly "->internal" and is in preparation for removing AVStreamInternal altogether. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat: Avoid allocation for AVFormatInternalAndreas Rheinhardt2021-09-17
| | | | | | | | | | | | | Do this by allocating AVFormatContext together with the data that is currently in AVFormatInternal; or rather: Put AVFormatContext at the beginning of a new structure called FFFormatContext (which encompasses more than just the internal fields and is a proper context in its own right, hence the name) and remove AVFormatInternal altogether. The biggest simplifications occured in avformat_alloc_context(), where one can now simply call avformat_free_context() in case of errors. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/mux, mxfenc, utils: Use dedicated pointer for AVFormatInternalAndreas Rheinhardt2021-09-17
| | | | | | | This gets rid of ugly "->internal" and is in preparation for removing AVFormatInternal altogether. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/asfenc, mux, utils: Use smaller scope for variablesAndreas Rheinhardt2021-09-17
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/mp3dec: Simplify checking for no-metadataAndreas Rheinhardt2021-09-17
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/mp3dec: Avoid calling avio_tell() multiple timesAndreas Rheinhardt2021-09-17
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/mvdec: Don't signal success on parse_audio_var() errorJames Almer2021-09-16
| | | | | | Propagate the error it returned instead. Signed-off-by: James Almer <jamrial@gmail.com>
* avformat/mvdec: Do not set invalid sample rateMichael Niedermayer2021-09-16
| | | | | | | | | Fixes: signed integer overflow: -682581959642593728 * 16 cannot be represented in type 'long' Fixes: 37883/clusterfuzz-testcase-minimized-ffmpeg_dem_MV_fuzzer-5311691517198336 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Peter Ross <pross@xvid.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/sbgdec: Check for t0 overflow in expand_tseq()Michael Niedermayer2021-09-16
| | | | | | | | | Fixes: signed integer overflow: 4611686025627387904 + 4611686025627387904 cannot be represented in type 'long' Fixes: 35489/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-4862678601433088 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* lavf/concatdec: add stream_extradata directiveNicolas George2021-09-16
|
* lavf/concat: add support for chaptersNicolas George2021-09-16
|
* lavf/concatdec: add stream_codec directiveNicolas George2021-09-16
|
* lavf/concatdec: support stream metadataNicolas George2021-09-16
|
* lavf/concat: deprecate file_packet_metadataNicolas George2021-09-16
|
* lavf/concat: add file_packet_meta directiveNicolas George2021-09-16
| | | | Same as file_packet_metadata without the double parsing.
* lavf/concat: refactor parsingNicolas George2021-09-16
|
* avformat/rmdec: Use 64bit for intermediate for DEINT_ID_INT4Michael Niedermayer2021-09-15
| | | | | | | | Fixes: runtime error: signed integer overflow: 65312 * 65535 cannot be represented in type 'int' Fixes: 32832/clusterfuzz-testcase-minimized-ffmpeg_dem_RM_fuzzer-4817710040088576 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/sbgdec: Check opt_duration and start for overflowMichael Niedermayer2021-09-15
| | | | | | | | Fixes: signed integer overflow: 2788626175500000000 + 7118941284000000000 cannot be represented in type 'long' Fixes: 35215/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6123272247836672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mov: Check for duplicate clliMichael Niedermayer2021-09-14
| | | | | | | | Fixes: memleak Fixes: 35261/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4869656287510528 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/utils: Ignore negative duration in codec_info_duration computationMichael Niedermayer2021-09-14
| | | | | | | | Fixes: signed integer overflow: -5994697211974418462 + -3255307777713450286 cannot be represented in type 'long' Fixes: 35332/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-5868035117285376 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/jacosubdec: Check for min in t overflow in get_shift()Michael Niedermayer2021-09-13
| | | | | | | | Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself Fixes: 34651/clusterfuzz-testcase-minimized-ffmpeg_dem_JACOSUB_fuzzer-5157941012463616 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/mxfdec: check channel number in mxf_get_d10_aes3_packet()Michael Niedermayer2021-09-13
| | | | | | | | | Fixes: Out of array access Fixes: 37030/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5387719147651072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/dv: always set audio packet durationPaul B Mahol2021-09-12
| | | | If audio packet is present in DV stream it have duration of 1 in DV timebase units.
* avformat/rtpdec: Make ff_rtp_handler_iterate() staticAndreas Rheinhardt2021-09-08
| | | | | | Possible since 61974537610d82bd35b6e3ac91ccd270c6bdc711. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/rawdec: Make ff_raw_data_read_header() staticAndreas Rheinhardt2021-09-08
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/mov_chan: Make ff_mov_get_channel_layout() staticAndreas Rheinhardt2021-09-08
| | | | | | Possible since 3bab7cd12802dc5abf2c5cc6dec49e9e249ce204. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/dhav: use frame number if timestamp difference is zeroPaul B Mahol2021-09-08
|
* avformat/mlpdec: fix time_base for packet timestampsPaul B Mahol2021-09-07
|
* avcodec/siren: MSN Siren decoderPeter Ross2021-09-07
| | | | | Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Peter Ross <pross@xvid.org>
* avformat/mux: Fix double-free when using AVPacket.opaque_refAndreas Rheinhardt2021-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Up until now, ff_write_chained() copied the packet (manually, not with av_packet_move_ref()) from a packet given to it to a stack packet whose timing and stream_index is then modified before being sent to another muxer via av_(interleaved_)write_frame(). Afterwards it is intended to sync the fields of the packet relevant to freeing again; yet this only encompasses buf, side_data and side_data_elems and not the newly added opaque_ref. The other fields are not synced so that the returned packet can have a size > 0 and data != NULL despite its buf being NULL (this always happens in the interleaved codepath; before commit fe251f77c80b0512ab8907902e1dbed3f4fe1aad it could also happen in the noninterleaved one). This leads to double-frees if the interleaved codepath is used and opaque_ref is set. This commit therefore changes this by directly reusing the packet instead of a spare packet. Given that av_write_frame() does not change the packet given to it, one only needs to restore the timing information to return it as it was; for the interleaved codepath it is not possible to do likewise*, because av_interleaved_write_frame() takes ownership of the packets given to it and returns blank packets. But precisely because of this users of the interleaved codepath have no legitimate expectation that their packet will be returned unchanged. In line with av_interleaved_write_frame() ff_write_chained() therefore returns blank packets when using the interleaved codepath. Making the only user of said codepath compatible with this was trivial. *: Unless one wanted to create a full new reference. Reviewed-by: Lynne <dev@lynne.ee> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/cafdec: try skipping various chunks only when seeking is possiblePaul B Mahol2021-09-03
|
* avformat: add an AV1 Low overhead bitstream format muxerJames Almer2021-09-01
| | | | | Suggested-by: BBB Signed-off-by: James Almer <jamrial@gmail.com>
* avformat/utils: Use av_memdup to duplicate array of AVChapter *Andreas Rheinhardt2021-08-31
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/utils: Don't allocate zero-sized arrayAndreas Rheinhardt2021-08-31
| | | | | | | It is unnecessary and also ill-defined: av_malloc() returns a 1-byte block of memory in this case, but this is not documented. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/utils: Don't compare pointers when sorting chaptersAndreas Rheinhardt2021-08-31
| | | | | | | | | | | The chapters are independently allocated, so that comparing the pointers is undefined behaviour. Furthermore, its result is not platform-independent (and may not even be deterministic on a particular platform). So compare the chapters' ids instead. (avpriv_new_chapter() ensures that there are no duplicate ids.) Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/utils: Allocate AVStream.info only for input streamsAndreas Rheinhardt2021-08-30
| | | | | | | This structure is only used for demuxers (mostly in avformat_find_stream_info()), so only allocate it for them. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/utils: Don't initialize AVStreamInternal.info multiple timesAndreas Rheinhardt2021-08-30
| | | | | | | | | | | | | | | | It has been allocated and initialized in avformat_find_stream_info() until fd0368e7ca35e2feaf7960564e61a76655c4d1f6 when the structure was moved to AVStreamInternal and its allocation to avformat_new_stream. In order to also initialize the struct for new streams that only get created during avformat_find_stream_info() said the initialization has been added to avformat_new_stream() later. Due to the Libav-FFmpeg split this has been done twice: In 4cda8aa1c5bc58f8a7f53a21a19b03e7379bbcdc and in 30c26c2442e4e44ac5a763c23c4b0fdd9921a7f5. The initialization in avformat_find_stream_info() has not been removed at all despite being redundant. This commit removes it and the duplicated initialization in avformat_new_stream(). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/utils: Remove redundant flushing of packet queueAndreas Rheinhardt2021-08-30
| | | | | | | The packet queue is already flushed in avformat_free_context() which is called a few lines below. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/mux: Don't access AVStream's internal AVCodecContextAndreas Rheinhardt2021-08-30
| | | | | | | | | | An AVStream's internal AVCodecContext is pretty much unused for muxing: The only place where any of its fields are set is avformat_transfer_internal_stream_timing_info() where its time base is set based upon the desired output format. The max_b_frames field is never set at all, so don't read it in mux.c. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/utils: Make ff_compute_frame_duration() staticAndreas Rheinhardt2021-08-30
| | | | | | | | Since 1c0885334dda9ee8652e60c586fa2e3674056586 ff_compute_frame_duration is only called from within utils.c and only for demuxers. So make it static and remove the code in it that deals with muxers. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/utils: Remove obsolete todoAndreas Rheinhardt2021-08-30
| | | | | | Also initialize the AVCodecContexts directly. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/utils: Remove always-false checkAndreas Rheinhardt2021-08-30
| | | | | | | | | AVFormatContext.internal is already allocated by avformat_alloc_context() on success; and on error, avformat_alloc_context() cleans up manually without avformat_free_context(). Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/yuv4mpegdec: Don't call avio_tell() twiceAndreas Rheinhardt2021-08-30
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/matroskadec: Fix heap-buffer overflow upon gigantic timestampsAndreas Rheinhardt2021-08-30
| | | | | | | | | | | | | | | | | | | The WebM DASH Manifest demuxer creates a comma-delimited list of all the timestamps of index entries. It allocates 20 bytes per timestamp; yet the largest 64bit numbers have 20 decimal digits (for int64_t it can be '-'+ 19 digits), so that one needs 21B per entry because of the comma (resp. the final NUL). The code uses snprintf, but snprintf returns the strlen of the string that would have been written had the supplied buffer been big enough. And if this is 21, then the next entry is written at an offset of 21 from the current position. So if enough such entries exist, the buffer won't suffice. This commit fixes this by replacing the allocation of buffer for the supposedly worst-case with dynamic allocations by using an AVBPrint. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/mov: Check dts for overflow in mov_read_trun()Michael Niedermayer2021-08-29
| | | | | | | | Fixes: signed integer overflow: 9223372034248226491 + 3275247799 cannot be represented in type 'long' Fixes: clusterfuzz-testcase-minimized-audio_decoder_fuzzer-4538729166077952 Reported-by: Matt Wolenetz <wolenetz@google.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/avidec: Use 64bit for frame number in odml index parsingMichael Niedermayer2021-08-28
| | | | | | | | Fixes: signed integer overflow: 1179337772 + 1392508928 cannot be represented in type 'int' Fixes: 34088/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5846945303232512 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avformat/flac_picture: ReindentationAndreas Rheinhardt2021-08-28
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/flac_picture: Simplify parsing titleAndreas Rheinhardt2021-08-28
| | | | | | | Don't allocate the buffer for the title ourselves, leave it to av_dict_set(). This simplifies freeing. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/flac_picture: Try to reuse buffer for attached pictureAndreas Rheinhardt2021-08-28
| | | | Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
* avformat/oggparsevorbis: Avoid tmp bufs when parsing VorbisCommentAndreas Rheinhardt2021-08-28
| | | | | | | | | | | | | | | | | | | | | | | | A single VorbisComment consists of a length field and a non-NUL-terminated string of the form "key=value". Up until now, when parsing such a VorbisComment, zero-terminated duplicates of key and value would be created. This is wasteful if these duplicates are freed shortly afterwards, as happens in particular in case of attached pictures: In this case value is base64 encoded and only needed to decode the actual data. Therefore this commit changes this: The buffer is temporarily modified so that both key and value are zero-terminated. Then the data is used in-place and restored to its original state afterwards. This requires that the buffer has at least one byte of padding. All buffers currently have AV_INPUT_BUFFER_PADDING_SIZE bytes padding, so this is ok. Finally, this also fixes weird behaviour from ogm_chapter(): It sometimes freed given to it, leaving the caller with dangling pointers. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-12 18:37:57 +0000