- 15 6月, 2020 40 次提交
-
-
由 Andreas Rheinhardt 提交于
Only read str_size bytes from offset 30 of extradata if the extradata is indeed at least 30 + str_size bytes long. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
mov_read_custom tries to read three strings belonging to three different tags. When an already encountered tag is encountered again, a new buffer for the string to be read is allocated and stored in the pointer destined for this particular tag. But in this scenario, said pointer already holds the address of the string read earlier, leading to a leak. This commit therefore aborts the reading process upon encountering an already encountered tag. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The argument pertaining to a printf %s conversion specifier must not be NULL, even if the precision (i.e. the number of characters to write) is zero. If it is NULL, it is undefined behaviour. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if allocating the AVStream for the subtitles fails. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle or when creating extradata. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon creating an AVStream. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle or when allocating extradata. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle or if creating the extradata failed. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The already parsed subtitles (contained in an FFDemuxSubtitlesQueue) would leak if an error happened upon reading a subsequent subtitle. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
By default, a demuxer's read_close function is not called automatically if an error happens when reading the header; instead it is up to the demuxer to clean up after itself in this case. The mov demuxer did this by calling its read_close function when it encountered some errors when reading the header. Yet for other errors (mostly adding side-data to streams) this has been forgotten, so that all the internal structures of the demuxer leak. This commit fixes this by making sure mov_read_close is called when necessary. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
Fixes possible leaks of id3v2 metadata as well as an AVDES struct in case the content is encrypted and an error happens lateron. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
In certain error scenarios, the underlying Matroska demuxer was not properly closed, causing leaks. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
When demuxing a Matroska/WebM file, streams are added for tracks and for attachments, so that the array containing the former can be NULL even when the corresponding AVFormatContext has streams. So check for there to be tracks in the MatroskaDemuxContext instead of just streams in the AVFormatContext before dereferencing the pointer to the tracks. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
matroska_parse_block currently asserts that the duration is not equal to AV_NOPTS_VALUE, but there is nothing that actually guarantees this. It is easy to create (spec-compliant) files which run into this assert; so replace it and instead cap the duration to INT64_MAX, as the duration field of an AVPacket is an int64_t. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
EBML binary elements are already made reference-counted when read; so when populating the AVStream.attached_pic, one does not need to allocate a new buffer for the data; instead the current code just creates a new reference to the underlying AVBuffer. But this can be improved even further: Just move the already existing reference. This also fixes a memleak that happens upon error because matroska_read_close has not been called in this scenario. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Thilo Borgmann 提交于
-
由 Przemysław Sobala 提交于
-
由 Andreas Rheinhardt 提交于
c801ab43 caused a regression: The stream number is now parsed with strtoll without a fixed basis; as a consequence, the "010" in a variant stream mapping like "a:010" is now treated as an octal number (i.e. as eight, not ten). This was not intended and may break some scripts, so this commit restores the old behaviour. Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
Commit 17e88bf0 created a memleak by removing a call to ff_iir_filter_free_coeffsp on error; this has been found by Coverity (ID 1464159). This commit fixes the memleak by readding the call to ff_iir_filter_free_coeffsp. Notice that this is not a simple revert, because several macros that were used before 17e88bf0 were replaced in commit 44863b2c and completely removed in 2658680d. Reviewed-by: NLimin Wang <lance.lmwang@gmail.com> Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Andreas Rheinhardt 提交于
The hevc_mp4toannexb bsf does not explicitly check whether a NAL unit is so big that it extends beyond the end of the input packet; it does so only implicitly by using the checked version of the bytestream2 API. But this has downsides compared to real checks: It can lead to huge allocations (up to 2GiB) even when the input packet is just a few bytes. And furthermore it leads to uninitialized data being output. So add a check to error out early if it happens. Also check directly whether there is enough data for the length field. Reviewed-by: NMichael Niedermayer <michael@niedermayer.cc> Signed-off-by: NAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
-
由 Limin Wang 提交于
Signed-off-by: NLimin Wang <lance.lmwang@gmail.com>
-
由 Limin Wang 提交于
Signed-off-by: NLimin Wang <lance.lmwang@gmail.com>
-
由 Limin Wang 提交于
Signed-off-by: NLimin Wang <lance.lmwang@gmail.com>
-
由 James Almer 提交于
If this happens, it's a sign of parsing issues earlier in the process, or misuse by the calling module. Prevents writing invalid bitstreams. Reviewed-by: NMichael Niedermayer <michael@niedermayer.cc> Signed-off-by: NJames Almer <jamrial@gmail.com>
-
由 James Almer 提交于
If this happens, it's a sign of parsing issues earlier in the process, or misuse by the calling module. Prevents writing invalid bitstreams. Reviewed-by: NMichael Niedermayer <michael@niedermayer.cc> Signed-off-by: NJames Almer <jamrial@gmail.com>
-
由 Michael Niedermayer 提交于
Fixes: memleak Fixes: 23415/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5124814510751744 Suggested-by: NMarton Balint <cus@passwd.hu> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: NMichael Niedermayer <michael@niedermayer.cc>
-
由 Michael Niedermayer 提交于
Fixes: assertion failure Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: NMichael Niedermayer <michael@niedermayer.cc>
-
由 Marton Balint 提交于
Max region ID is 87. Also the region affects not only the G0 charset but G2 and the national subset as well. Signed-off-by: NMarton Balint <cus@passwd.hu>
-
由 Michael Niedermayer 提交于
Alternatively these conditions could be treated as errors Fixes: 23147/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5639254549200896 Fixes: signed integer overflow: 9223372036854775807 + 1 cannot be represented in type 'int64_t' (aka 'long') Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: NMichael Niedermayer <michael@niedermayer.cc>
-