From b864b38397a2962d265ad39005265bac4fb001ef Mon Sep 17 00:00:00 2001 From: Mike Melanson Date: Sun, 29 Jan 2012 21:24:41 -0800 Subject: yuv4mpeg: allow YUV4MPEG2 demuxer to recognize 'C420' colorspace. Current demuxer recognizes several colorspace formats that begin with 'C420' but does not yet recognize plain 'C420'. GStreamer's y4menc component generates .y4m files with a 'C420' colorspace. This new comparison is placed after the other 'C420' checks so that it doesn't interfere with them. Signed-off-by: Anton Khirnov --- libavformat/yuv4mpeg.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'libavformat') diff --git a/libavformat/yuv4mpeg.c b/libavformat/yuv4mpeg.c index afb5bfaab2..df0fc8f1a5 100644 --- a/libavformat/yuv4mpeg.c +++ b/libavformat/yuv4mpeg.c @@ -244,6 +244,9 @@ static int yuv4_read_header(AVFormatContext *s) } else if (strncmp("420paldv", tokstart, 8) == 0) { pix_fmt = PIX_FMT_YUV420P; chroma_sample_location = AVCHROMA_LOC_TOPLEFT; + } else if (strncmp("420", tokstart, 3) == 0) { + pix_fmt = PIX_FMT_YUV420P; + chroma_sample_location = AVCHROMA_LOC_CENTER; } else if (strncmp("411", tokstart, 3) == 0) pix_fmt = PIX_FMT_YUV411P; else if (strncmp("422", tokstart, 3) == 0) -- cgit v1.2.3 From cc09dc7863e4ffdf5d7c18472721c5ce739f26b0 Mon Sep 17 00:00:00 2001 From: Mike Melanson Date: Sun, 29 Jan 2012 21:29:25 -0800 Subject: s/vbsf/bsf/ -vbsf doesn't exist anymore. It got renamed to -bsf somewhere along the line. Update print statement accordingly. Signed-off-by: Anton Khirnov --- libavformat/mpegtsenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavformat') diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c index c05f7f690e..8232cbc76d 100644 --- a/libavformat/mpegtsenc.c +++ b/libavformat/mpegtsenc.c @@ -956,7 +956,7 @@ static int mpegts_write_packet(AVFormatContext *s, AVPacket *pkt) if (pkt->size < 5 || AV_RB32(pkt->data) != 0x0000001) { av_log(s, AV_LOG_ERROR, "H.264 bitstream malformed, " - "no startcode found, use -vbsf h264_mp4toannexb\n"); + "no startcode found, use -bsf h264_mp4toannexb\n"); return -1; } -- cgit v1.2.3 From 420df8b7c414cfd0cae29930344889651825f9d0 Mon Sep 17 00:00:00 2001 From: Rafaël Carré Date: Sat, 28 Jan 2012 23:29:26 -0500 Subject: avformat_write_header(): detail error message Give the exact aspect ratios when there is a mismatch between encoder and muxer. Signed-off-by: Anton Khirnov --- libavformat/utils.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'libavformat') diff --git a/libavformat/utils.c b/libavformat/utils.c index 41450971af..9c59947fb7 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -2782,7 +2782,11 @@ int avformat_write_header(AVFormatContext *s, AVDictionary **options) goto fail; } if(av_cmp_q(st->sample_aspect_ratio, st->codec->sample_aspect_ratio)){ - av_log(s, AV_LOG_ERROR, "Aspect ratio mismatch between encoder and muxer layer\n"); + av_log(s, AV_LOG_ERROR, "Aspect ratio mismatch between encoder " + "(%d/%d) and muxer layer (%d/%d)\n", + st->sample_aspect_ratio.num, st->sample_aspect_ratio.den, + st->codec->sample_aspect_ratio.num, + st->codec->sample_aspect_ratio.den); ret = AVERROR(EINVAL); goto fail; } -- cgit v1.2.3 From a846202343af7c56bf444ec47d4bb26a5d2b83ce Mon Sep 17 00:00:00 2001 From: Diego Biurrun Date: Mon, 30 Jan 2012 09:38:41 +0100 Subject: rtsp: Remove some unused variables from ff_rtsp_connect(). --- libavformat/rtsp.c | 1 - 1 file changed, 1 deletion(-) (limited to 'libavformat') diff --git a/libavformat/rtsp.c b/libavformat/rtsp.c index cdcda7eb67..1fb7b2bcda 100644 --- a/libavformat/rtsp.c +++ b/libavformat/rtsp.c @@ -1357,7 +1357,6 @@ int ff_rtsp_connect(AVFormatContext *s) { RTSPState *rt = s->priv_data; char host[1024], path[1024], tcpname[1024], cmd[2048], auth[128]; - char *option_list, *option, *filename; int port, err, tcp_fd; RTSPMessageHeader reply1 = {0}, *reply = &reply1; int lower_transport_mask = 0; -- cgit v1.2.3 From b7d3dd907f51c1b86c5aad7e2ec4870da53e095e Mon Sep 17 00:00:00 2001 From: Martin Storsjö Date: Mon, 30 Jan 2012 16:19:15 +0200 Subject: movenc: cosmetics: Get rid of camelCase identifiers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Also add spacing around operators on touched lines, and split one line to match the common style. Signed-off-by: Martin Storsjö --- libavformat/movenc.c | 287 ++++++++++++++++++++++++++------------------------- libavformat/movenc.h | 16 +-- 2 files changed, 152 insertions(+), 151 deletions(-) (limited to 'libavformat') diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 22e8d842f4..ee0d96e534 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -69,7 +69,7 @@ static const AVClass flavor ## _muxer_class = {\ }; //FIXME support 64 bit variant with wide placeholders -static int64_t updateSize(AVIOContext *pb, int64_t pos) +static int64_t update_size(AVIOContext *pb, int64_t pos) { int64_t curpos = avio_tell(pb); avio_seek(pb, pos, SEEK_SET); @@ -99,7 +99,7 @@ static int mov_write_stco_tag(AVIOContext *pb, MOVTrack *track) else avio_wb32(pb, track->cluster[i].pos); } - return updateSize(pb, pos); + return update_size(pb, pos); } /* Sample size atom */ @@ -137,7 +137,7 @@ static int mov_write_stsz_tag(AVIOContext *pb, MOVTrack *track) } } } - return updateSize(pb, pos); + return update_size(pb, pos); } /* Sample to chunk atom */ @@ -153,12 +153,12 @@ static int mov_write_stsc_tag(AVIOContext *pb, MOVTrack *track) entryPos = avio_tell(pb); avio_wb32(pb, track->entry); // entry count for (i=0; ientry; i++) { - if(oldval != track->cluster[i].samplesInChunk) + if (oldval != track->cluster[i].samples_in_chunk) { avio_wb32(pb, i+1); // first chunk - avio_wb32(pb, track->cluster[i].samplesInChunk); // samples per chunk + avio_wb32(pb, track->cluster[i].samples_in_chunk); // samples per chunk avio_wb32(pb, 0x1); // sample description index - oldval = track->cluster[i].samplesInChunk; + oldval = track->cluster[i].samples_in_chunk; index++; } } @@ -167,7 +167,7 @@ static int mov_write_stsc_tag(AVIOContext *pb, MOVTrack *track) avio_wb32(pb, index); // rewrite size avio_seek(pb, curpos, SEEK_SET); - return updateSize(pb, pos); + return update_size(pb, pos); } /* Sync sample atom */ @@ -191,7 +191,7 @@ static int mov_write_stss_tag(AVIOContext *pb, MOVTrack *track, uint32_t flag) avio_seek(pb, entryPos, SEEK_SET); avio_wb32(pb, index); // rewrite size avio_seek(pb, curpos, SEEK_SET); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_amr_tag(AVIOContext *pb, MOVTrack *track) @@ -215,13 +215,13 @@ static int mov_write_ac3_tag(AVIOContext *pb, MOVTrack *track) uint8_t buf[3]; int fscod, bsid, bsmod, acmod, lfeon, frmsizecod; - if (track->vosLen < 7) + if (track->vos_len < 7) return -1; avio_wb32(pb, 11); ffio_wfourcc(pb, "dac3"); - init_get_bits(&gbc, track->vosData+4, (track->vosLen-4) * 8); + init_get_bits(&gbc, track->vos_data + 4, (track->vos_len - 4) * 8); fscod = get_bits(&gbc, 2); frmsizecod = get_bits(&gbc, 6); bsid = get_bits(&gbc, 5); @@ -270,7 +270,7 @@ static int mov_write_enda_tag(AVIOContext *pb) return 10; } -static void putDescr(AVIOContext *pb, int tag, unsigned int size) +static void put_descr(AVIOContext *pb, int tag, unsigned int size) { int i = 3; avio_w8(pb, tag); @@ -282,19 +282,19 @@ static void putDescr(AVIOContext *pb, int tag, unsigned int size) static int mov_write_esds_tag(AVIOContext *pb, MOVTrack *track) // Basic { int64_t pos = avio_tell(pb); - int decoderSpecificInfoLen = track->vosLen ? 5+track->vosLen : 0; + int decoder_specific_info_len = track->vos_len ? 5 + track->vos_len : 0; avio_wb32(pb, 0); // size ffio_wfourcc(pb, "esds"); avio_wb32(pb, 0); // Version // ES descriptor - putDescr(pb, 0x03, 3 + 5+13 + decoderSpecificInfoLen + 5+1); - avio_wb16(pb, track->trackID); + put_descr(pb, 0x03, 3 + 5+13 + decoder_specific_info_len + 5+1); + avio_wb16(pb, track->track_id); avio_w8(pb, 0x00); // flags (= no flags) // DecoderConfig descriptor - putDescr(pb, 0x04, 13 + decoderSpecificInfoLen); + put_descr(pb, 0x04, 13 + decoder_specific_info_len); // Object type indication if ((track->enc->codec_id == CODEC_ID_MP2 || @@ -320,16 +320,16 @@ static int mov_write_esds_tag(AVIOContext *pb, MOVTrack *track) // Basic else avio_wb32(pb, track->enc->rc_max_rate); // avg bitrate - if (track->vosLen) { + if (track->vos_len) { // DecoderSpecific info descriptor - putDescr(pb, 0x05, track->vosLen); - avio_write(pb, track->vosData, track->vosLen); + put_descr(pb, 0x05, track->vos_len); + avio_write(pb, track->vos_data, track->vos_len); } // SL descriptor - putDescr(pb, 0x06, 1); + put_descr(pb, 0x06, 1); avio_w8(pb, 0x02); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_pcm_le_gt16(enum CodecID codec_id) @@ -347,7 +347,7 @@ static int mov_write_ms_tag(AVIOContext *pb, MOVTrack *track) avio_wl32(pb, track->tag); // store it byteswapped track->enc->codec_tag = av_bswap16(track->tag >> 16); ff_put_wav_header(pb, track->enc); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_chan_tag(AVIOContext *pb, MOVTrack *track) @@ -372,7 +372,7 @@ static int mov_write_chan_tag(AVIOContext *pb, MOVTrack *track) avio_wb32(pb, bitmap); // mChannelBitmap avio_wb32(pb, 0); // mNumberChannelDescriptions - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_wave_tag(AVIOContext *pb, MOVTrack *track) @@ -409,15 +409,15 @@ static int mov_write_wave_tag(AVIOContext *pb, MOVTrack *track) avio_wb32(pb, 8); /* size */ avio_wb32(pb, 0); /* null tag */ - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_glbl_tag(AVIOContext *pb, MOVTrack *track) { - avio_wb32(pb, track->vosLen+8); + avio_wb32(pb, track->vos_len + 8); ffio_wfourcc(pb, "glbl"); - avio_write(pb, track->vosData, track->vosLen); - return 8+track->vosLen; + avio_write(pb, track->vos_data, track->vos_len); + return 8 + track->vos_len; } /** @@ -484,7 +484,7 @@ static int mov_write_audio_tag(AVIOContext *pb, MOVTrack *track) avio_wb32(pb, 0x7F000000); avio_wb32(pb, av_get_bits_per_sample(track->enc->codec_id)); avio_wb32(pb, mov_get_lpcm_flags(track->enc->codec_id)); - avio_wb32(pb, track->sampleSize); + avio_wb32(pb, track->sample_size); avio_wb32(pb, track->audio_vbr ? track->enc->frame_size : 1); } else { /* reserved for mp4/3gp */ @@ -514,10 +514,10 @@ static int mov_write_audio_tag(AVIOContext *pb, MOVTrack *track) mov_write_ac3_tag(pb, track); else if(track->enc->codec_id == CODEC_ID_ALAC) mov_write_extradata_tag(pb, track); - else if(track->vosLen > 0) + else if (track->vos_len > 0) mov_write_glbl_tag(pb, track); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_d263_tag(AVIOContext *pb) @@ -551,8 +551,8 @@ static int mov_write_avcc_tag(AVIOContext *pb, MOVTrack *track) avio_wb32(pb, 0); ffio_wfourcc(pb, "avcC"); - ff_isom_write_avcc(pb, track->vosData, track->vosLen); - return updateSize(pb, pos); + ff_isom_write_avcc(pb, track->vos_data, track->vos_len); + return update_size(pb, pos); } /* also used by all avid codecs (dv, imx, meridien) and their variants */ @@ -577,10 +577,10 @@ static int mov_write_avid_tag(AVIOContext *pb, MOVTrack *track) ffio_wfourcc(pb, "ARES"); ffio_wfourcc(pb, "ARES"); ffio_wfourcc(pb, "0001"); - avio_wb32(pb, AV_RB32(track->vosData + 0x28)); /* dnxhd cid, some id ? */ + avio_wb32(pb, AV_RB32(track->vos_data + 0x28)); /* dnxhd cid, some id ? */ avio_wb32(pb, track->enc->width); /* values below are based on samples created with quicktime and avid codecs */ - if (track->vosData[5] & 2) { // interlaced + if (track->vos_data[5] & 2) { // interlaced avio_wb32(pb, track->enc->height/2); avio_wb32(pb, 2); /* unknown */ avio_wb32(pb, 0); /* unknown */ @@ -820,7 +820,7 @@ static int mov_write_subtitle_tag(AVIOContext *pb, MOVTrack *track) if (track->enc->extradata_size) avio_write(pb, track->enc->extradata, track->enc->extradata_size); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_pasp_tag(AVIOContext *pb, MOVTrack *track) @@ -896,7 +896,7 @@ static int mov_write_video_tag(AVIOContext *pb, MOVTrack *track) mov_write_uuid_tag_ipod(pb); } else if (track->enc->field_order != AV_FIELD_UNKNOWN) mov_write_fiel_tag(pb, track); - else if(track->vosLen > 0) + else if (track->vos_len > 0) mov_write_glbl_tag(pb, track); if (track->enc->sample_aspect_ratio.den && track->enc->sample_aspect_ratio.num && @@ -904,7 +904,7 @@ static int mov_write_video_tag(AVIOContext *pb, MOVTrack *track) mov_write_pasp_tag(pb, track); } - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_rtp_tag(AVIOContext *pb, MOVTrack *track) @@ -924,7 +924,7 @@ static int mov_write_rtp_tag(AVIOContext *pb, MOVTrack *track) ffio_wfourcc(pb, "tims"); avio_wb32(pb, track->timescale); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_stsd_tag(AVIOContext *pb, MOVTrack *track) @@ -942,7 +942,7 @@ static int mov_write_stsd_tag(AVIOContext *pb, MOVTrack *track) mov_write_subtitle_tag(pb, track); else if (track->enc->codec_tag == MKTAG('r','t','p',' ')) mov_write_rtp_tag(pb, track); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_ctts_tag(AVIOContext *pb, MOVTrack *track) @@ -988,7 +988,7 @@ static int mov_write_stts_tag(AVIOContext *pb, MOVTrack *track) if (track->enc->codec_type == AVMEDIA_TYPE_AUDIO && !track->audio_vbr) { stts_entries = av_malloc(sizeof(*stts_entries)); /* one entry */ - stts_entries[0].count = track->sampleCount; + stts_entries[0].count = track->sample_count; stts_entries[0].duration = 1; entries = 1; } else { @@ -997,7 +997,7 @@ static int mov_write_stts_tag(AVIOContext *pb, MOVTrack *track) NULL; for (i=0; ientry; i++) { int64_t duration = i + 1 == track->entry ? - track->trackDuration - track->cluster[i].dts + track->start_dts : /* readjusting */ + track->track_duration - track->cluster[i].dts + track->start_dts : /* readjusting */ track->cluster[i+1].dts - track->cluster[i].dts; if (i && duration == stts_entries[entries].duration) { stts_entries[entries].count++; /* compress */ @@ -1045,7 +1045,7 @@ static int mov_write_stbl_tag(AVIOContext *pb, MOVTrack *track) mov_write_stts_tag(pb, track); if ((track->enc->codec_type == AVMEDIA_TYPE_VIDEO || track->enc->codec_tag == MKTAG('r','t','p',' ')) && - track->hasKeyframes && track->hasKeyframes < track->entry) + track->has_keyframes && track->has_keyframes < track->entry) mov_write_stss_tag(pb, track, MOV_SYNC_SAMPLE); if (track->mode == MODE_MOV && track->flags & MOV_TRACK_STPS) mov_write_stss_tag(pb, track, MOV_PARTIAL_SYNC_SAMPLE); @@ -1055,7 +1055,7 @@ static int mov_write_stbl_tag(AVIOContext *pb, MOVTrack *track) mov_write_stsc_tag(pb, track); mov_write_stsz_tag(pb, track); mov_write_stco_tag(pb, track); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_dinf_tag(AVIOContext *pb) @@ -1064,7 +1064,7 @@ static int mov_write_dinf_tag(AVIOContext *pb) avio_wb32(pb, 0); /* size */ ffio_wfourcc(pb, "dinf"); mov_write_dref_tag(pb); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_nmhd_tag(AVIOContext *pb) @@ -1150,7 +1150,7 @@ static int mov_write_hdlr_tag(AVIOContext *pb, MOVTrack *track) avio_write(pb, descr, strlen(descr)); /* handler description */ if (track && track->mode != MODE_MOV) avio_w8(pb, 0); /* c string */ - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_hmhd_tag(AVIOContext *pb) @@ -1187,12 +1187,12 @@ static int mov_write_minf_tag(AVIOContext *pb, MOVTrack *track) mov_write_hdlr_tag(pb, NULL); mov_write_dinf_tag(pb); mov_write_stbl_tag(pb, track); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_mdhd_tag(AVIOContext *pb, MOVTrack *track) { - int version = track->trackDuration < INT32_MAX ? 0 : 1; + int version = track->track_duration < INT32_MAX ? 0 : 1; (version == 1) ? avio_wb32(pb, 44) : avio_wb32(pb, 32); /* size */ ffio_wfourcc(pb, "mdhd"); @@ -1206,7 +1206,7 @@ static int mov_write_mdhd_tag(AVIOContext *pb, MOVTrack *track) avio_wb32(pb, track->time); /* modification time */ } avio_wb32(pb, track->timescale); /* time scale (sample rate for audio) */ - (version == 1) ? avio_wb64(pb, track->trackDuration) : avio_wb32(pb, track->trackDuration); /* duration */ + (version == 1) ? avio_wb64(pb, track->track_duration) : avio_wb32(pb, track->track_duration); /* duration */ avio_wb16(pb, track->language); /* language */ avio_wb16(pb, 0); /* reserved (quality) */ @@ -1228,12 +1228,12 @@ static int mov_write_mdia_tag(AVIOContext *pb, MOVTrack *track) mov_write_mdhd_tag(pb, track); mov_write_hdlr_tag(pb, track); mov_write_minf_tag(pb, track); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_tkhd_tag(AVIOContext *pb, MOVTrack *track, AVStream *st) { - int64_t duration = av_rescale_rnd(track->trackDuration, MOV_TIMESCALE, + int64_t duration = av_rescale_rnd(track->track_duration, MOV_TIMESCALE, track->timescale, AV_ROUND_UP); int version = duration < INT32_MAX ? 0 : 1; @@ -1248,7 +1248,7 @@ static int mov_write_tkhd_tag(AVIOContext *pb, MOVTrack *track, AVStream *st) avio_wb32(pb, track->time); /* creation time */ avio_wb32(pb, track->time); /* modification time */ } - avio_wb32(pb, track->trackID); /* track-id */ + avio_wb32(pb, track->track_id); /* track-id */ avio_wb32(pb, 0); /* reserved */ (version == 1) ? avio_wb64(pb, duration) : avio_wb32(pb, duration); @@ -1317,13 +1317,13 @@ static int mov_write_tapt_tag(AVIOContext *pb, MOVTrack *track) avio_wb32(pb, track->enc->width << 16); avio_wb32(pb, track->enc->height << 16); - return updateSize(pb, pos); + return update_size(pb, pos); } // This box seems important for the psp playback ... without it the movie seems to hang static int mov_write_edts_tag(AVIOContext *pb, MOVTrack *track) { - int64_t duration = av_rescale_rnd(track->trackDuration, MOV_TIMESCALE, + int64_t duration = av_rescale_rnd(track->track_duration, MOV_TIMESCALE, track->timescale, AV_ROUND_UP); int version = duration < INT32_MAX ? 0 : 1; int entry_size, entry_count, size; @@ -1434,13 +1434,13 @@ static int mov_write_trak_tag(AVIOContext *pb, MOVMuxContext *mov, if (track->mode == MODE_PSP) mov_write_uuid_tag_psp(pb,track); // PSP Movies require this uuid box if (track->tag == MKTAG('r','t','p',' ')) - mov_write_udta_sdp(pb, track->rtp_ctx, track->trackID); + mov_write_udta_sdp(pb, track->rtp_ctx, track->track_id); if (track->enc->codec_type == AVMEDIA_TYPE_VIDEO && track->mode == MODE_MOV) { double sample_aspect_ratio = av_q2d(st->sample_aspect_ratio); if (0.0 != sample_aspect_ratio && 1.0 != sample_aspect_ratio) mov_write_tapt_tag(pb, track); }; - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_iods_tag(AVIOContext *pb, MOVMuxContext *mov) @@ -1462,14 +1462,14 @@ static int mov_write_iods_tag(AVIOContext *pb, MOVMuxContext *mov) avio_wb32(pb, 0x0); /* size */ ffio_wfourcc(pb, "iods"); avio_wb32(pb, 0); /* version & flags */ - putDescr(pb, 0x10, 7); + put_descr(pb, 0x10, 7); avio_wb16(pb, 0x004f); avio_w8(pb, 0xff); avio_w8(pb, 0xff); avio_w8(pb, audio_profile); avio_w8(pb, video_profile); avio_w8(pb, 0xff); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_trex_tag(AVIOContext *pb, MOVTrack *track) @@ -1477,7 +1477,7 @@ static int mov_write_trex_tag(AVIOContext *pb, MOVTrack *track) avio_wb32(pb, 0x20); /* size */ ffio_wfourcc(pb, "trex"); avio_wb32(pb, 0); /* version & flags */ - avio_wb32(pb, track->trackID); /* track ID */ + avio_wb32(pb, track->track_id); /* track ID */ avio_wb32(pb, 1); /* default sample description index */ avio_wb32(pb, 0); /* default sample duration */ avio_wb32(pb, 0); /* default sample size */ @@ -1493,29 +1493,29 @@ static int mov_write_mvex_tag(AVIOContext *pb, MOVMuxContext *mov) ffio_wfourcc(pb, "mvex"); for (i = 0; i < mov->nb_streams; i++) mov_write_trex_tag(pb, &mov->tracks[i]); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_mvhd_tag(AVIOContext *pb, MOVMuxContext *mov) { - int maxTrackID = 1, i; - int64_t maxTrackLenTemp, maxTrackLen = 0; + int max_track_id = 1, i; + int64_t max_track_len_temp, max_track_len = 0; int version; for (i=0; inb_streams; i++) { if(mov->tracks[i].entry > 0) { - maxTrackLenTemp = av_rescale_rnd(mov->tracks[i].trackDuration, - MOV_TIMESCALE, - mov->tracks[i].timescale, - AV_ROUND_UP); - if(maxTrackLen < maxTrackLenTemp) - maxTrackLen = maxTrackLenTemp; - if(maxTrackID < mov->tracks[i].trackID) - maxTrackID = mov->tracks[i].trackID; + max_track_len_temp = av_rescale_rnd(mov->tracks[i].track_duration, + MOV_TIMESCALE, + mov->tracks[i].timescale, + AV_ROUND_UP); + if (max_track_len < max_track_len_temp) + max_track_len = max_track_len_temp; + if (max_track_id < mov->tracks[i].track_id) + max_track_id = mov->tracks[i].track_id; } } - version = maxTrackLen < UINT32_MAX ? 0 : 1; + version = max_track_len < UINT32_MAX ? 0 : 1; (version == 1) ? avio_wb32(pb, 120) : avio_wb32(pb, 108); /* size */ ffio_wfourcc(pb, "mvhd"); avio_w8(pb, version); @@ -1528,7 +1528,7 @@ static int mov_write_mvhd_tag(AVIOContext *pb, MOVMuxContext *mov) avio_wb32(pb, mov->time); /* modification time */ } avio_wb32(pb, MOV_TIMESCALE); - (version == 1) ? avio_wb64(pb, maxTrackLen) : avio_wb32(pb, maxTrackLen); /* duration of longest track */ + (version == 1) ? avio_wb64(pb, max_track_len) : avio_wb32(pb, max_track_len); /* duration of longest track */ avio_wb32(pb, 0x00010000); /* reserved (preferred rate) 1.0 = normal */ avio_wb16(pb, 0x0100); /* reserved (preferred volume) 1.0 = normal */ @@ -1553,7 +1553,7 @@ static int mov_write_mvhd_tag(AVIOContext *pb, MOVMuxContext *mov) avio_wb32(pb, 0); /* reserved (selection time) */ avio_wb32(pb, 0); /* reserved (selection duration) */ avio_wb32(pb, 0); /* reserved (current time) */ - avio_wb32(pb, maxTrackID+1); /* Next track id */ + avio_wb32(pb, max_track_id + 1); /* Next track id */ return 0x6c; } @@ -1600,7 +1600,7 @@ static int mov_write_string_tag(AVIOContext *pb, const char *name, const char *v avio_wb32(pb, 0); /* size */ ffio_wfourcc(pb, name); mov_write_string_data_tag(pb, value, lang, long_style); - size= updateSize(pb, pos); + size = update_size(pb, pos); } return size; } @@ -1676,7 +1676,7 @@ static int mov_write_ilst_tag(AVIOContext *pb, MOVMuxContext *mov, mov_write_string_metadata(s, pb, "tven", "episode_id",1); mov_write_string_metadata(s, pb, "tvnn", "network" , 1); mov_write_trkn_tag(pb, mov, s); - return updateSize(pb, pos); + return update_size(pb, pos); } /* iTunes meta data tag */ @@ -1690,7 +1690,7 @@ static int mov_write_meta_tag(AVIOContext *pb, MOVMuxContext *mov, avio_wb32(pb, 0); mov_write_itunes_hdlr_tag(pb, mov, s); mov_write_ilst_tag(pb, mov, s); - size = updateSize(pb, pos); + size = update_size(pb, pos); return size; } @@ -1740,7 +1740,7 @@ static int mov_write_3gp_udta_tag(AVIOContext *pb, AVFormatContext *s, (t = av_dict_get(s->metadata, "track", NULL, 0))) avio_w8(pb, atoi(t->value)); } - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_chpl_tag(AVIOContext *pb, AVFormatContext *s) @@ -1766,7 +1766,7 @@ static int mov_write_chpl_tag(AVIOContext *pb, AVFormatContext *s) } else avio_w8(pb, 0); } - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_udta_tag(AVIOContext *pb, MOVMuxContext *mov, @@ -1866,8 +1866,8 @@ static int mov_write_uuidusmt_tag(AVIOContext *pb, AVFormatContext *s) // snprintf(dt,32,"%04d/%02d/%02d %02d:%02d:%02d",t_st->tm_year+1900,t_st->tm_mon+1,t_st->tm_mday,t_st->tm_hour,t_st->tm_min,t_st->tm_sec); mov_write_psp_udta_tag(pb, "2006/04/01 11:11:11", "und", 0x03); - updateSize(pb, pos2); - return updateSize(pb, pos); + update_size(pb, pos2); + return update_size(pb, pos); } return 0; @@ -1886,19 +1886,19 @@ static int mov_write_moov_tag(AVIOContext *pb, MOVMuxContext *mov, continue; mov->tracks[i].time = mov->time; - mov->tracks[i].trackID = i+1; + mov->tracks[i].track_id = i+1; } if (mov->chapter_track) for (i=0; inb_streams; i++) { mov->tracks[i].tref_tag = MKTAG('c','h','a','p'); - mov->tracks[i].tref_id = mov->tracks[mov->chapter_track].trackID; + mov->tracks[i].tref_id = mov->tracks[mov->chapter_track].track_id; } for (i = 0; i < mov->nb_streams; i++) { if (mov->tracks[i].tag == MKTAG('r','t','p',' ')) { mov->tracks[i].tref_tag = MKTAG('h','i','n','t'); mov->tracks[i].tref_id = - mov->tracks[mov->tracks[i].src_track].trackID; + mov->tracks[mov->tracks[i].src_track].track_id; } } @@ -1918,7 +1918,7 @@ static int mov_write_moov_tag(AVIOContext *pb, MOVMuxContext *mov, else mov_write_udta_tag(pb, mov, s); - return updateSize(pb, pos); + return update_size(pb, pos); } static void param_write_int(AVIOContext *pb, const char *name, int value) @@ -1985,7 +1985,7 @@ static int mov_write_isml_manifest(AVIOContext *pb, MOVMuxContext *mov) for (i = 0; i < mov->nb_streams; i++) { MOVTrack *track = &mov->tracks[i]; const char *type; - /* track->trackID is initialized in write_moov, and thus isn't known + /* track->track_id is initialized in write_moov, and thus isn't known * here yet */ int track_id = i + 1; @@ -2040,7 +2040,7 @@ static int mov_write_isml_manifest(AVIOContext *pb, MOVMuxContext *mov) avio_printf(pb, "\n"); avio_printf(pb, "\n"); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_mfhd_tag(AVIOContext *pb, MOVMuxContext *mov) @@ -2074,7 +2074,7 @@ static int mov_write_tfhd_tag(AVIOContext *pb, MOVTrack *track, avio_w8(pb, 0); /* version */ avio_wb24(pb, flags); - avio_wb32(pb, track->trackID); /* track-id */ + avio_wb32(pb, track->track_id); /* track-id */ if (flags & 0x01) avio_wb64(pb, moof_offset); if (flags & 0x08) { @@ -2094,7 +2094,7 @@ static int mov_write_tfhd_tag(AVIOContext *pb, MOVTrack *track, avio_wb32(pb, track->default_sample_flags); } - return updateSize(pb, pos); + return update_size(pb, pos); } static uint32_t get_sample_flags(MOVTrack *track, MOVIentry *entry) @@ -2110,7 +2110,7 @@ static int mov_write_trun_tag(AVIOContext *pb, MOVTrack *track) for (i = 0; i < track->entry; i++) { int64_t duration = i + 1 == track->entry ? - track->trackDuration - track->cluster[i].dts + track->start_dts : + track->track_duration - track->cluster[i].dts + track->start_dts : track->cluster[i + 1].dts - track->cluster[i].dts; if (duration != track->default_duration) flags |= 0x100; /* sample-duration-present */ @@ -2137,7 +2137,7 @@ static int mov_write_trun_tag(AVIOContext *pb, MOVTrack *track) for (i = 0; i < track->entry; i++) { int64_t duration = i + 1 == track->entry ? - track->trackDuration - track->cluster[i].dts + track->start_dts : + track->track_duration - track->cluster[i].dts + track->start_dts : track->cluster[i + 1].dts - track->cluster[i].dts; if (flags & 0x100) avio_wb32(pb, duration); @@ -2149,7 +2149,7 @@ static int mov_write_trun_tag(AVIOContext *pb, MOVTrack *track) avio_wb32(pb, track->cluster[i].cts); } - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_tfxd_tag(AVIOContext *pb, MOVTrack *track) @@ -2166,10 +2166,10 @@ static int mov_write_tfxd_tag(AVIOContext *pb, MOVTrack *track) avio_w8(pb, 1); avio_wb24(pb, 0); avio_wb64(pb, track->frag_start); - avio_wb64(pb, track->start_dts + track->trackDuration - + avio_wb64(pb, track->start_dts + track->track_duration - track->cluster[0].dts); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_tfrf_tag(AVIOContext *pb, MOVMuxContext *mov, @@ -2245,7 +2245,7 @@ static int mov_write_traf_tag(AVIOContext *pb, MOVMuxContext *mov, } } - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_moof_tag(AVIOContext *pb, MOVMuxContext *mov, int tracks) @@ -2279,7 +2279,7 @@ static int mov_write_moof_tag(AVIOContext *pb, MOVMuxContext *mov, int tracks) } avio_seek(pb, end, SEEK_SET); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_tfra_tag(AVIOContext *pb, MOVTrack *track) @@ -2292,7 +2292,7 @@ static int mov_write_tfra_tag(AVIOContext *pb, MOVTrack *track) avio_w8(pb, 1); /* version */ avio_wb24(pb, 0); - avio_wb32(pb, track->trackID); + avio_wb32(pb, track->track_id); avio_wb32(pb, 0); /* length of traf/trun/sample num */ avio_wb32(pb, track->nb_frag_info); for (i = 0; i < track->nb_frag_info; i++) { @@ -2303,7 +2303,7 @@ static int mov_write_tfra_tag(AVIOContext *pb, MOVTrack *track) avio_w8(pb, 1); /* sample number */ } - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_mfra_tag(AVIOContext *pb, MOVMuxContext *mov) @@ -2316,7 +2316,7 @@ static int mov_write_mfra_tag(AVIOContext *pb, MOVMuxContext *mov) /* An empty mfra atom is enough to indicate to the publishing point that * the stream has ended. */ if (mov->flags & FF_MOV_FLAG_ISML) - return updateSize(pb, pos); + return update_size(pb, pos); for (i = 0; i < mov->nb_streams; i++) { MOVTrack *track = &mov->tracks[i]; @@ -2329,7 +2329,7 @@ static int mov_write_mfra_tag(AVIOContext *pb, MOVMuxContext *mov) avio_wb32(pb, 0); /* version + flags */ avio_wb32(pb, avio_tell(pb) + 4 - pos); - return updateSize(pb, pos); + return update_size(pb, pos); } static int mov_write_mdat_tag(AVIOContext *pb, MOVMuxContext *mov) @@ -2402,17 +2402,17 @@ static int mov_write_ftyp_tag(AVIOContext *pb, AVFormatContext *s) ffio_wfourcc(pb, "MSNV"); else if (mov->mode == MODE_MP4) ffio_wfourcc(pb, "mp41"); - return updateSize(pb, pos); + return update_size(pb, pos); } static void mov_write_uuidprof_tag(AVIOContext *pb, AVFormatContext *s) { - AVCodecContext *VideoCodec = s->streams[0]->codec; - AVCodecContext *AudioCodec = s->streams[1]->codec; - int AudioRate = AudioCodec->sample_rate; - int FrameRate = ((VideoCodec->time_base.den) * (0x10000))/ (VideoCodec->time_base.num); - int audio_kbitrate= AudioCodec->bit_rate / 1000; - int video_kbitrate= FFMIN(VideoCodec->bit_rate / 1000, 800 - audio_kbitrate); + AVCodecContext *video_codec = s->streams[0]->codec; + AVCodecContext *audio_codec = s->streams[1]->codec; + int audio_rate = audio_codec->sample_rate; + int frame_rate = ((video_codec->time_base.den) * (0x10000))/ (video_codec->time_base.num); + int audio_kbitrate = audio_codec->bit_rate / 1000; + int video_kbitrate = FFMIN(video_codec->bit_rate / 1000, 800 - audio_kbitrate); avio_wb32(pb, 0x94); /* size */ ffio_wfourcc(pb, "uuid"); @@ -2440,14 +2440,14 @@ static void mov_write_uuidprof_tag(AVIOContext *pb, AVFormatContext *s) avio_wb32(pb, 0x0); avio_wb32(pb, audio_kbitrate); avio_wb32(pb, audio_kbitrate); - avio_wb32(pb, AudioRate); - avio_wb32(pb, AudioCodec->channels); + avio_wb32(pb, audio_rate); + avio_wb32(pb, audio_codec->channels); avio_wb32(pb, 0x34); /* size */ ffio_wfourcc(pb, "VPRF"); /* video */ avio_wb32(pb, 0x0); avio_wb32(pb, 0x1); /* TrackID */ - if (VideoCodec->codec_id == CODEC_ID_H264) { + if (video_codec->codec_id == CODEC_ID_H264) { ffio_wfourcc(pb, "avc1"); avio_wb16(pb, 0x014D); avio_wb16(pb, 0x0015); @@ -2459,10 +2459,10 @@ static void mov_write_uuidprof_tag(AVIOContext *pb, AVFormatContext *s) avio_wb32(pb, 0x0); avio_wb32(pb, video_kbitrate); avio_wb32(pb, video_kbitrate); - avio_wb32(pb, FrameRate); - avio_wb32(pb, FrameRate); - avio_wb16(pb, VideoCodec->width); - avio_wb16(pb, VideoCodec->height); + avio_wb32(pb, frame_rate); + avio_wb32(pb, frame_rate); + avio_wb16(pb, video_codec->width); + avio_wb16(pb, video_codec->height); avio_wb32(pb, 0x010001); /* ? */ } @@ -2514,7 +2514,7 @@ static int mov_flush_fragment(AVFormatContext *s) for (i = 0; i < mov->nb_streams; i++) { if (mov->tracks[i].entry) mov->tracks[i].frag_start += mov->tracks[i].start_dts + - mov->tracks[i].trackDuration - + mov->tracks[i].track_duration - mov->tracks[i].cluster[0].dts; mov->tracks[i].entry = 0; } @@ -2545,7 +2545,7 @@ static int mov_flush_fragment(AVFormatContext *s) int64_t duration = 0; if (track->entry) - duration = track->start_dts + track->trackDuration - + duration = track->start_dts + track->track_duration - track->cluster[0].dts; if (mov->flags & FF_MOV_FLAG_SEPARATE_MOOF) { if (!track->mdat_buf) @@ -2601,7 +2601,7 @@ static int mov_write_packet_internal(AVFormatContext *s, AVPacket *pkt) AVIOContext *pb = s->pb; MOVTrack *trk = &mov->tracks[pkt->stream_index]; AVCodecContext *enc = trk->enc; - unsigned int samplesInChunk = 0; + unsigned int samples_in_chunk = 0; int size= pkt->size; uint8_t *reformatted_data = NULL; @@ -2636,27 +2636,27 @@ static int mov_write_packet_internal(AVFormatContext *s, AVPacket *pkt) {13, 14, 16, 18, 20, 21, 27, 32, 6, 0, 0, 0, 0, 0, 0, 1}; int len = 0; - while (len < size && samplesInChunk < 100) { + while (len < size && samples_in_chunk < 100) { len += packed_size[(pkt->data[len] >> 3) & 0x0F]; - samplesInChunk++; + samples_in_chunk++; } - if(samplesInChunk > 1){ + if (samples_in_chunk > 1) { av_log(s, AV_LOG_ERROR, "fatal error, input is not a single packet, implement a AVParser for it\n"); return -1; } - } else if (trk->sampleSize) - samplesInChunk = size/trk->sampleSize; + } else if (trk->sample_size) + samples_in_chunk = size / trk->sample_size; else - samplesInChunk = 1; + samples_in_chunk = 1; /* copy extradata if it exists */ - if (trk->vosLen == 0 && enc->extradata_size > 0) { - trk->vosLen = enc->extradata_size; - trk->vosData = av_malloc(trk->vosLen); - memcpy(trk->vosData, enc->extradata, trk->vosLen); + if (trk->vos_len == 0 && enc->extradata_size > 0) { + trk->vos_len = enc->extradata_size; + trk->vos_data = av_malloc(trk->vos_len); + memcpy(trk->vos_data, enc->extradata, trk->vos_len); } - if (enc->codec_id == CODEC_ID_H264 && trk->vosLen > 0 && *(uint8_t *)trk->vosData != 1) { + if (enc->codec_id == CODEC_ID_H264 && trk->vos_len > 0 && *(uint8_t *)trk->vos_data != 1) { /* from x264 or from bytestream h264 */ /* nal reformating needed */ if (trk->hint_track >= 0 && trk->hint_track < mov->nb_streams) { @@ -2671,13 +2671,13 @@ static int mov_write_packet_internal(AVFormatContext *s, AVPacket *pkt) } if ((enc->codec_id == CODEC_ID_DNXHD || - enc->codec_id == CODEC_ID_AC3) && !trk->vosLen) { + enc->codec_id == CODEC_ID_AC3) && !trk->vos_len) { /* copy frame to create needed atoms */ - trk->vosLen = size; - trk->vosData = av_malloc(size); - if (!trk->vosData) + trk->vos_len = size; + trk->vos_data = av_malloc(size); + if (!trk->vos_data) return AVERROR(ENOMEM); - memcpy(trk->vosData, pkt->data, size); + memcpy(trk->vos_data, pkt->data, size); } if (!(trk->entry % MOV_INDEX_CLUSTER_SIZE)) { @@ -2687,20 +2687,20 @@ static int mov_write_packet_internal(AVFormatContext *s, AVPacket *pkt) } trk->cluster[trk->entry].pos = avio_tell(pb) - size; - trk->cluster[trk->entry].samplesInChunk = samplesInChunk; + trk->cluster[trk->entry].samples_in_chunk = samples_in_chunk; trk->cluster[trk->entry].size = size; - trk->cluster[trk->entry].entries = samplesInChunk; + trk->cluster[trk->entry].entries = samples_in_chunk; trk->cluster[trk->entry].dts = pkt->dts; if (!trk->entry && trk->start_dts != AV_NOPTS_VALUE) { /* First packet of a new fragment. We already wrote the duration - * of the last packet of the previous fragment based on trackDuration, + * of the last packet of the previous fragment based on track_duration, * which might not exactly match our dts. Therefore adjust the dts * of this packet to be what the previous packets duration implies. */ - trk->cluster[trk->entry].dts = trk->start_dts + trk->trackDuration; + trk->cluster[trk->entry].dts = trk->start_dts + trk->track_duration; } if (trk->start_dts == AV_NOPTS_VALUE) trk->start_dts = pkt->dts; - trk->trackDuration = pkt->dts - trk->start_dts + pkt->duration; + trk->track_duration = pkt->dts - trk->start_dts + pkt->duration; if (pkt->pts == AV_NOPTS_VALUE) { av_log(s, AV_LOG_WARNING, "pts has no value\n"); @@ -2720,10 +2720,10 @@ static int mov_write_packet_internal(AVFormatContext *s, AVPacket *pkt) trk->cluster[trk->entry].flags = MOV_SYNC_SAMPLE; } if (trk->cluster[trk->entry].flags & MOV_SYNC_SAMPLE) - trk->hasKeyframes++; + trk->has_keyframes++; } trk->entry++; - trk->sampleCount += samplesInChunk; + trk->sample_count += samples_in_chunk; mov->mdat_size += size; avio_flush(pb); @@ -2877,13 +2877,13 @@ static int mov_write_header(AVFormatContext *s) "or choose different container.\n"); }else if(st->codec->codec_type == AVMEDIA_TYPE_AUDIO){ track->timescale = st->codec->sample_rate; - /* set sampleSize for PCM and ADPCM */ + /* set sample_size for PCM and ADPCM */ if (av_get_bits_per_sample(st->codec->codec_id)) { if (!st->codec->block_align) { av_log(s, AV_LOG_ERROR, "track %d: codec block align is not set\n", i); goto error; } - track->sampleSize = st->codec->block_align; + track->sample_size = st->codec->block_align; } /* set audio_vbr for compressed audio */ if (av_get_bits_per_sample(st->codec->codec_id) < 8) { @@ -2919,9 +2919,9 @@ static int mov_write_header(AVFormatContext *s) /* copy extradata if it exists */ if (st->codec->extradata_size) { - track->vosLen = st->codec->extradata_size; - track->vosData = av_malloc(track->vosLen); - memcpy(track->vosData, st->codec->extradata, track->vosLen); + track->vos_len = st->codec->extradata_size; + track->vos_data = av_malloc(track->vos_len); + memcpy(track->vos_data, st->codec->extradata, track->vos_len); } } @@ -3021,7 +3021,8 @@ static int mov_write_trailer(AVFormatContext *s) av_freep(&mov->tracks[i].cluster); av_freep(&mov->tracks[i].frag_info); - if(mov->tracks[i].vosLen) av_free(mov->tracks[i].vosData); + if (mov->tracks[i].vos_len) + av_free(mov->tracks[i].vos_data); } diff --git a/libavformat/movenc.h b/libavformat/movenc.h index 0b74a61d06..5fc71fb99d 100644 --- a/libavformat/movenc.h +++ b/libavformat/movenc.h @@ -44,7 +44,7 @@ typedef struct MOVIentry { uint64_t pos; int64_t dts; unsigned int size; - unsigned int samplesInChunk; + unsigned int samples_in_chunk; unsigned int entries; int cts; #define MOV_SYNC_SAMPLE 0x0001 @@ -78,20 +78,20 @@ typedef struct MOVIndex { int entry; unsigned timescale; uint64_t time; - int64_t trackDuration; - long sampleCount; - long sampleSize; - int hasKeyframes; + int64_t track_duration; + long sample_count; + long sample_size; + int has_keyframes; #define MOV_TRACK_CTTS 0x0001 #define MOV_TRACK_STPS 0x0002 uint32_t flags; int language; - int trackID; + int track_id; int tag; ///< stsd fourcc AVCodecContext *enc; - int vosLen; - uint8_t *vosData; + int vos_len; + uint8_t *vos_data; MOVIentry *cluster; int audio_vbr; int height; ///< active picture (w/o VBI) height for D-10/IMX -- cgit v1.2.3 From 6a89b41d9780325ba6d89a37f2aeb925aa68e6a3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 24 Jan 2012 22:20:26 +0100 Subject: nsvdec: Fix use of uninitialized streams. Fixes CVE-2011-3940 (Out of bounds read resulting in out of bounds write) Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer (cherry picked from commit 5c011706bc752d34bc6ada31d7df2ca0c9af7c6b) Signed-off-by: Alex Converse --- libavformat/nsvdec.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'libavformat') diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c index b5bc87aa8c..aa114db097 100644 --- a/libavformat/nsvdec.c +++ b/libavformat/nsvdec.c @@ -605,12 +605,12 @@ null_chunk_retry: } /* map back streams to v,a */ - if (s->streams[0]) + if (s->nb_streams > 0) st[s->streams[0]->id] = s->streams[0]; - if (s->streams[1]) + if (s->nb_streams > 1) st[s->streams[1]->id] = s->streams[1]; - if (vsize/* && st[NSV_ST_VIDEO]*/) { + if (vsize && st[NSV_ST_VIDEO]) { nst = st[NSV_ST_VIDEO]->priv_data; pkt = &nsv->ahead[NSV_ST_VIDEO]; av_get_packet(pb, pkt, vsize); @@ -623,7 +623,7 @@ null_chunk_retry: if(st[NSV_ST_VIDEO]) ((NSVStream*)st[NSV_ST_VIDEO]->priv_data)->frame_offset++; - if (asize/*st[NSV_ST_AUDIO]*/) { + if (asize && st[NSV_ST_AUDIO]) { nst = st[NSV_ST_AUDIO]->priv_data; pkt = &nsv->ahead[NSV_ST_AUDIO]; /* read raw audio specific header on the first audio chunk... */ -- cgit v1.2.3 From 8fd8a48263ff1437f9d02d7e78dc63efb9b5ed3a Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Thu, 26 Jan 2012 17:21:46 -0800 Subject: nsvdec: Be more careful with av_malloc(). Check results for av_malloc() and fix an overflow in one call. Related to CVE-2011-3940. Based in part on work from Michael Niedermayer. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind --- libavformat/nsvdec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'libavformat') diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c index aa114db097..7e32e439ea 100644 --- a/libavformat/nsvdec.c +++ b/libavformat/nsvdec.c @@ -314,7 +314,9 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) char *token, *value; char quote; - p = strings = av_mallocz(strings_size + 1); + p = strings = av_mallocz((size_t)strings_size + 1); + if (!p) + return AVERROR(ENOMEM); endp = strings + strings_size; avio_read(pb, strings, strings_size); while (p < endp) { @@ -349,6 +351,8 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) if((unsigned)table_entries_used >= UINT_MAX / sizeof(uint32_t)) return -1; nsv->nsvs_file_offset = av_malloc((unsigned)table_entries_used * sizeof(uint32_t)); + if (!nsv->nsvs_file_offset) + return AVERROR(ENOMEM); for(i=0;insvs_file_offset[i] = avio_rl32(pb) + size; @@ -356,6 +360,8 @@ static int nsv_parse_NSVf_header(AVFormatContext *s) if(table_entries > table_entries_used && avio_rl32(pb) == MKTAG('T','O','C','2')) { nsv->nsvs_timestamps = av_malloc((unsigned)table_entries_used*sizeof(uint32_t)); + if (!nsv->nsvs_timestamps) + return AVERROR(ENOMEM); for(i=0;insvs_timestamps[i] = avio_rl32(pb); } -- cgit v1.2.3 From c898431ca5ef2a997fe9388b650f658fb60783e5 Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Thu, 26 Jan 2012 17:23:09 -0800 Subject: nsvdec: Propagate errors Related to CVE-2011-3940. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind --- libavformat/nsvdec.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'libavformat') diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c index 7e32e439ea..2ad8cb3a8b 100644 --- a/libavformat/nsvdec.c +++ b/libavformat/nsvdec.c @@ -532,11 +532,16 @@ static int nsv_read_header(AVFormatContext *s) for (i = 0; i < NSV_MAX_RESYNC_TRIES; i++) { if (nsv_resync(s) < 0) return -1; - if (nsv->state == NSV_FOUND_NSVF) + if (nsv->state == NSV_FOUND_NSVF) { err = nsv_parse_NSVf_header(s); + if (err < 0) + return err; + } /* we need the first NSVs also... */ if (nsv->state == NSV_FOUND_NSVS) { err = nsv_parse_NSVs_header(s); + if (err < 0) + return err; break; /* we just want the first one */ } } -- cgit v1.2.3