Specially crafted files can lead the parsing code to take too long.
We fix a lot of these problems by not allowing local tags to extend
past the end of the set and not allowing other KLVs to be read past
the end of themselves.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
This can happen if an index table segment has a very large IndexStartPosition.
zzuf3.mxf is an example of such a file.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Only the OPAtom demuxing logic is guaranteed to have index tables,
meaning OP1a files that lack an index would cause SIGSEGV.
Signed-off-by: Diego Biurrun <diego@biurrun.de>
Calculates based on total file size and wavetaillength from the header.
Falls back to multiplying finalframeblocks by 8 instead of 4 so that it will
at least be overestimating for 24-bit. Currently it can underestimate the
final packet size, leading to decoding errors.
Right now those muxers use the default timebase in all cases(1/90000).
This patch avoid unnecessary rescaling and makes the printed timestamps
more readable.
Also, extend the printed information to include the timebases and packet
pts/duration and align the columns.
Obviously changes the results of all fate tests which use those two
muxers.
Normally, the actual payload data contains sequence headers, too,
and the parser can extract this and set it as extradata. However,
the data in the dvc1 atom is the "official" extradata for the file.
This is required for proper stream copy of vc1 from ismv to ismv.
Signed-off-by: Martin Storsjö <martin@martin.st>
Do not use AVStream's duration for dts generation since it contains in
some cases the duration of the whole file instead of duration of the
samples in the moov. This happens if the mdhd holds the duration of the
whole file but has no entries or a zero duration in its stts.
dv: Fix null pointer dereference due to ach=0
Fixes part2 of CVE-2011-3929
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Roman Shaposhnik <roman@shaposhnik.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Alex Converse <alex.converse@gmail.com>
dv: check stype
Fixes part1 of CVE-2011-3929
Possibly fixes part of CVE-2011-3936
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Reviewed-by: Roman Shaposhnik <roman@shaposhnik.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Alex Converse <alex.converse@gmail.com>
This way, if the AVCodecContext is allocated for a specific codec, the
caller doesn't need to store this codec separately and then pass it
again to avcodec_open2().
It also allows to set codec private options using av_opt_set_* before
opening the codec.
It allows to check whether an AVCodecContext is open in a documented
way. Right now the undocumented way this check is done in lavf/lavc is
by checking whether AVCodecContext.codec is NULL. However it's desirable
to be able to set AVCodecContext.codec before avcodec_open2().
This makes the first packet of a track fragment run to get
the keyframe flag set properly if sample_degradation_priority
is nonzero.
This makes the keyframes flag be set properly for ismv files
created by Microsoft.
Signed-off-by: Martin Storsjö <martin@martin.st>
Previously, we've only passed the key string on to the recursive
amf_parse_object for the mixedarray type, not for 'object'. By
passing the key string on, the recursive amf_parse_object can
store the amf objects as metadata.
This kind of data was seen in data from XSplit Broadcaster, received
over RTMP via Wowza. This patch allows reading this metadata.
Signed-off-by: Martin Storsjö <martin@martin.st>
Check results for av_malloc() and fix an overflow in one call.
Related to CVE-2011-3940.
Based in part on work from Michael Niedermayer.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Fixes CVE-2011-3940 (Out of bounds read resulting in out of bounds write)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c011706bc)
Signed-off-by: Alex Converse <alex.converse@gmail.com>
-vbsf doesn't exist anymore. It got renamed to -bsf somewhere along the
line. Update print statement accordingly.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Current demuxer recognizes several colorspace formats that begin with 'C420'
but does not yet recognize plain 'C420'. GStreamer's y4menc component
generates .y4m files with a 'C420' colorspace. This new comparison is
placed after the other 'C420' checks so that it doesn't interfere with
them.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
In this mode, no seeks will be done except for within moov/moof
fragments, which should fit within the AVIOContext buffer.
This allows pushing live smooth streaming format data to
a live publishing point on IIS over http.
Signed-off-by: Martin Storsjö <martin@martin.st>
