If bit_rate is negative, it can trigger an av_assert2 in av_rescale_rnd.
Since av_rescale returns int64_t, but st->codec_bit_rate is int, it can
also overflow into a negative value.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0eec40b713eee84e2aec8af35ccce059817cad2a)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
If max in clean_index is set to a negative ast->sample_size, the
following loop never ends:
while (max < 1024)
max += max;
Thus set ast->sample_size to 0 if it would otherwise be negative.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ca234639ac49a0dc073ac1f10977979acdb94f97)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Instead check for all mov code-points when demuxing avi
and print a warning if a video codec is found like this.
Fixes ticket #4307.
(cherry picked from commit 2e0b5f5c90a4bc1440703ba5e8bf7139ff42f367)
Conflicts:
libavformat/riff.c
Considering the palette is located at the end of extradata may be flawed
when the extradata contains the palette followed by the BottomUp field.
When the BottomUp field is present, exclude it from the palette.
Fixes part of ticket #1304
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Additional fixes by Nigel Touati-Evans <nigel.touatievans@gmail.com>.
Check the index for streams with a time drift of 2s or a buffer drift
of 64MB.
Bug-Id: 666
CC: libav-stable@libav.org
Sample-Id: yet-another-broken-interleaved-avi.avi
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Signed-off-by: Diego Biurrun <diego@biurrun.de>
* commit 'f1c4a54f6ecbf77a29aaaee09ca70c5468d0c509':
lavf: add supported extension to avi and mov demuxers
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Fixes out of array read
Fixes: 0ff9841c2a102f06e0d582bfc3376cbd-asan_heap-oob_495589_6836_cov_1763916974_mewmew_ssa.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Its possible in various rare cases that an index cannot be created or allocated.
Fixes assertion failure
Fixes: signal_sigabrt_7ffff7126425_7712_pokem.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
* commit '756547ce7f4d67a18663503e2157aebed3531703':
avi: DV in AVI must be considered single stream
Conflicts:
libavformat/avidec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
* commit '8d07258bb6063d0780ce2d39443d6dc6d8eedc5a':
avidec: Make sure a packet is large enough before reading its data
Conflicts:
libavformat/avidec.c
See: 028cc42a1638e6f93a857f11c2568d1c3a51e612
Note: data!=NULL implies that the allocated array is at least FF_INPUT_BUFFER_PADDING_SIZE large
Merged-by: Michael Niedermayer <michaelni@gmx.at>
When av_reallocp fails, the associated variables that keep track of
the number of elements in the array (and in some cases, the
separate number of allocated elements) need to be reset.
Not all of these might technically be needed, but it's better to
reset them if in doubt, to make sure variables don't end up
conflicting.
Signed-off-by: Martin Storsjö <martin@martin.st>
