1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-02-14 22:22:59 +02:00

23292 Commits

Author SHA1 Message Date
Michael Niedermayer
0bee216ad4 avformat/asfdec_o: Check size vs. offset in detect_unknown_subobject()
Fixes: signed integer overflow: 2314885530818453566 + 7503032301549264928 cannot be represented in type 'long'
Fixes: 26639/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_O_fuzzer-6024222100684800

Alternatively this could be ignored but then the end condition of the loop
would be hard to reach as avio_tell() is int64_t

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-20 21:26:46 +01:00
Michael Niedermayer
03c479ce23 avformat/utils: check for integer overflow in av_get_frame_filename2()
Fixes: signed integer overflow: 317316873 * 10 cannot be represented in type 'int'
Fixes: 24708/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5731180885049344

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-20 21:26:46 +01:00
rcombs
eabf5e6d6b All: update names in copyright headers 2021-01-20 01:02:56 -06:00
Michael Niedermayer
c48110a4a4 avformat/id3v2: Check against max compression ratio before allocation
Fixes: Timeout (>10sec -> 12ms)
Fixes: 27612/clusterfuzz-testcase-minimized-ffmpeg_dem_PCM_S24BE_fuzzer-6605893000757248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-19 00:05:50 +01:00
Michael Niedermayer
7d7ae68972 avformat/avidec: Use av_sat_sub64() in check_stream_max_drift()
Fixes: signed integer overflow: 8833900919969684211 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 26726/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5669377724383232
Fixes: 27587/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6294562263531520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-19 00:05:50 +01:00
Michael Niedermayer
8c9a5a0fe9 avformat/mov: Check a.size before computing next_root_atom
Fixes: signed integer overflow: 64 + 9223372036854775799 cannot be represented in type 'long'
Fixes: 27563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6244650163372032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-19 00:05:50 +01:00
Michael Niedermayer
ac6c8993f7 avformat/sbgdec: Reduce the amount of floating point in str_to_time()
Fixes: 1e+75 is outside the range of representable values of type 'long'
Fixes: 26910/clusterfuzz-testcase-minimized-ffmpeg_dem_SBG_fuzzer-6626834808700928

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-19 00:05:50 +01:00
tpol
71ce5c32f0 avformat/rtsp: correctly set media control uri with mpegts
Fixes 

Currently the media control uri is not correctly assigned when mpegts is
signalled in the media description.

The code checks whether at least one AVStream has been setup before
assigning to the media's uri. With mpegts the AVStreams are setup when
parsing packets and so the media's uri is skipped. This is fixed by
using rt->nb_rtsp_streams in the check which counts all medias in the
sdp.

Reviewed-by: Andriy Gelman <andriy.gelman@gmail.com>
Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
2021-01-17 21:36:16 -05:00
Limin Wang
bf1cc9a43b avformat/hlsenc: reindent the code
Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
2021-01-16 08:53:27 +08:00
Limin Wang
5ef20244de avformat/udp: add memory alloc checks
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
2021-01-16 08:51:31 +08:00
Limin Wang
f6eaa864f3 avformat/udp: return the error code instead of generic EIO
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Limin Wang <lance.lmwang@gmail.com>
2021-01-16 08:51:22 +08:00
Martin Storsjö
c2424b1f35 movenc: Present durations in mvhd/tkhd/mdhd as they are after edits
If the edit lists remove parts of the output timeline, or add a
delay to it, this should be included in the mvhd/tkhd/mdhd durations,
which should correspond to the edit lists.

For tracks starting with pts < 0, the edit list trims out the segment
before pts=0. For tracks starting with pts > 0, a delay element is
added in the edit list, delaying the start of the track data.

In both cases, the practical effect is that the post-edit output
is as if the track had started with pts = 0. Thus calculate the range
from pts=0 to end_pts, for the purposes of mvhd/tkhd/mdhd, unless
edit lists explicitly are disabled.

mov_write_edts_tag needs to operate on the actual pts duration of
the track samples, not the duration that already takes the edit
list effect into account.

Signed-off-by: Martin Storsjö <martin@martin.st>
2021-01-15 15:01:03 +02:00
Idan Freiberg
a6912e5b88 avformat/dhav: Fix incorrect non-DHAV chunk skipping logic
DAV files may contain a variable length padding in between chunks
filled with 0xff bytes. The current skipping logic is incorrect as it
may skip over DHAV chunks not appearing sequentially in the file.

We now look for the 'DHAV' tag using a byte-by-byte search in order
to handle such situations. Also the dhav->last_good_pos field will
not be updated while skipping unrecognized data.
2021-01-14 14:20:02 +01:00
AlexisWilke
ca21cb1e36 avformat/allformats: test pointer to be used
Two tests check the opposite pointer before using it. If only one of these
is set to a valid pointer, one of these functions will crash, the other will
ignore the pointer.

Signed-off-by: James Almer <jamrial@gmail.com>
2021-01-12 00:17:30 -03:00
Michael Niedermayer
88519be8db avformat/mxfdec: Free all types for both Descriptors
Fixes: memleak
Fixes: 26352/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5201158714687488

Suggested-by: Tomas Härdin <tjoppen@acc.umu.se>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-11 23:23:36 +01:00
Michael Niedermayer
b0259aa248 avformat/utils: wrap_timestamp() is only needed for less than 64 bits
Fixes: shift exponent 64 is too large for 64-bit type 'unsigned long long'
Fixes: 26497/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-5690188355076096
Fixes: 26903/clusterfuzz-testcase-minimized-ffmpeg_dem_LUODAT_fuzzer-5641466929741824

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-11 23:17:36 +01:00
Michael Niedermayer
fcc263caa9 avformat/aaxdec: Check string before strcmp()
Fixes: NULL ptr dereference
Fixes: 26508/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-5694725249826816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-11 23:15:04 +01:00
Michael Niedermayer
7186ec88b9 uavformat/rsd: check for EOF in extradata
Fixes: OOM
Fixes: 26503/clusterfuzz-testcase-minimized-ffmpeg_dem_RSD_fuzzer-6530816735444992

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-11 23:15:04 +01:00
Marton Balint
2e2891383e avformat: remove some mpegts details from AVStream
These fields were added to support -merge_pmt_versions, but the mpegts demuxer
is also keeping track its programs internally, so that should be a better place
to handle it.

Also it is not a very good idea to keep fields like program_num or
pmt_stream_idx in an AVStream, because a single stream can be part of multiple
programs, multiple PMTs, so the stream attributes can refer to any program the
stream is part of.

Since they are not part of public API, lets simply remove them, or rather
replace them with placeholders for ABI compatibility with libavdevice.

Signed-off-by: Marton Balint <cus@passwd.hu>
2021-01-09 22:38:12 +01:00
Marton Balint
e57879ec18 avformat/mpegts: use stream index based lookup with merge_pmt_versions if stream identifier matches multiple streams
Also make sure we are checking the old state of the streams because otherwise
some streams might already have the newly parsed stream identifiers which
corrupts matching.

Fixes streams having the same identifier mixed up on pmt version change.

Fixes ticket .

Signed-off-by: Marton Balint <cus@passwd.hu>
2021-01-09 22:38:12 +01:00
Marton Balint
f143a6c151 avformat/mpegts: only clear programs which no longer exist or have a new PMT
Otherwise there can be a small period when the programs only contain the PMT
pid.

Also make sure skip_clear only affects AVProgram clear, and that pmt_pid is
always kept as the first entry of the PID list of the programs. Also reject
PMTs for programs on the wrong PID.

Signed-off-by: Marton Balint <cus@passwd.hu>
2021-01-09 22:38:12 +01:00
Marton Balint
10c8e53294 avformat/mpegts: rework clearing and adding pid to program
And use better function names.

Signed-off-by: Marton Balint <cus@passwd.hu>
2021-01-09 22:38:12 +01:00
Marton Balint
5ea37923a8 avformat/mpegts: never discard PAT pid
PID 0 was removed from the pid list when then PMT was parsed, it is better
to explictly avoid it from being discarded instead of keeing it in the list of
every program.

Signed-off-by: Marton Balint <cus@passwd.hu>
2021-01-09 22:38:12 +01:00
Marton Balint
9298e8eb61 avformat/utils: do not overwrite already existing program with defaults in av_new_program
av_new_program returns the existing program if that already exists, in that
case it makes no sense to overwrite existing attributes.

Signed-off-by: Marton Balint <cus@passwd.hu>
2021-01-09 22:38:12 +01:00
Matthieu Bouron
2e17435480 avformat/mov: adjust skip_samples according to seek timestamp
Currently skip_samples is set to start_pad if sample_time is lesser or
equal to 0. This can cause issues if the stream starts with packets that
have negative pts. Calling avformat_seek_file() with ts set to 0 on such
streams makes the mov demuxer return the right corresponding packets
(near the 0 timestamp) but set skip_samples to start_pad which is
incorrect as the audio decoder will discard the returned samples
according to skip_samples from the first packet it receives (which has
its timestamp near 0).

For example, considering the following audio stream with start_pad=1344:

 [PKT pts=-1344] [PKT pts=-320] [PKT pts=704] [PKT pts=1728] [...]

Calling avformat_seek_file() with ts=0 makes the next call to
av_read_frame() return the packet with pts=-320 and a skip samples
side data set to 1344 (start_pad). This makes the audio decoder
incorrectly discard (1344 - 320) samples.

This commit makes the move demuxer adjust skip_samples according to the
stream start_pad, seek timestamp and first sample timestamp.

The above example will now result in av_read_frame() still returning the
packet with pts=-320 but with a skip samples side data set to 320
(src_pad - (seek_timestamp - first_timestamp)). This makes the audio
decoder only discard 320 samples (from pts=-320 to pts=0).

Signed-off-by: Marton Balint <cus@passwd.hu>
2021-01-09 17:08:27 +01:00
Michael Niedermayer
0a0b92b4b2 avformat/dhav: Check position for overflow
Fixes: signed integer overflow: 9223372036854775807 + 32768 cannot be represented in type 'long'
Fixes: 27744/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-5179319491756032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-08 18:08:57 +01:00
Michael Niedermayer
ac5a568e6d avformat/utils: Change compute_chapters_end() from O(n²) to O(n log n)
Fixes: Timeout (49sec -> 9sec)
Fixes: 27427/clusterfuzz-testcase-minimized-ffmpeg_dem_FFMETADATA_fuzzer-5140589838073856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-08 18:02:55 +01:00
Andreas Rheinhardt
cb4c3b6162 avformat/hashenc: Deduplicate (stream)hash options
Also saves relocations.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2021-01-08 05:06:11 +01:00
Andreas Rheinhardt
ac0e75b647 avformat/mxf: Deduplicate random_index_pack_key
Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2021-01-08 05:05:13 +01:00
Michael Niedermayer
66deab3a26 avformat/vividas: Check number of audio channels
Fixes: division by 0
Fixes: 28597/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-5752201490333696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-05 02:00:05 +01:00
Jonathan Baudanza
6c24f2bf41 avformat/rtpdec: export Opus extradata in ff_rtp_parse_open() 2021-01-03 20:30:33 -03:00
erankor
fde5593c7c avformat/http: support retry on connection error
Add 2 new options:
- reconnect_on_http_error - a list of http status codes that should be
    retried. the list can contain explicit status codes / the strings
    4xx/5xx.
- reconnect_on_network_error - reconnects on arbitrary errors during
    connect, e.g. ECONNRESET/ETIMEDOUT

the retry employs the same exponential backoff logic as the existing
reconnect/reconnect_at_eof flags.

related tickets:
https://trac.ffmpeg.org/ticket/6066
https://trac.ffmpeg.org/ticket/7768

Signed-off-by: Marton Balint <cus@passwd.hu>
2021-01-03 16:47:29 +01:00
Michael Niedermayer
f26b5acfc0 avformat/wavdec: Avoid zeroing written to array
Fixes: OOM
Fixes: 26934/clusterfuzz-testcase-minimized-ffmpeg_dem_W64_fuzzer-5996784213819392

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2021-01-03 01:16:25 +01:00
Andreas Rheinhardt
2c6f532e0a Mark some pointers as const
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2021-01-01 15:25:48 +01:00
Aman Karmani
d20f059fb9 avformat/rtsp: add satip_raw flag to receive raw mpegts stream
This can be used to receive the raw mpegts stream from a SAT>IP
server, by letting avformat handle the RTSP/RTP/UDP negotiation
and setup, but then simply passing the MP2T stream through
instead of demuxing it further.

For example, this command would demux/remux the mpegts stream:

    SATIP_URL='satip://192.168.1.99:554/?src=1&freq=12188&pol=h&ro=0.35&msys=dvbs&mtype=qpsk&plts=off&sr=27500&fec=34&pids=0,17,18,167,136,47,71'
    ffmpeg -i $SATIP_URL -map 0 -c copy -f mpegts -y remux.ts

Whereas this command will simply write out the raw stream, with
the original PAT/PMT/PIDs intact:

    ffmpeg -rtsp_flags satip_raw -i $SATIP_URL -map 0 -c copy -f data -y raw.ts

Signed-off-by: Aman Karmani <aman@tmm1.net>
2020-12-28 14:08:44 -08:00
Aman Karmani
98b76bb11f avformat/rtsp: add support for satip://
The SAT>IP protocol[1] is similar to RTSP. However SAT>IP servers
are assumed to speak only MP2T, so DESCRIBE is not used in the same
way. When no streams are active, DESCRIBE will return 404 according
to the spec (see section 3.5.7). When streams are active, DESCRIBE
will return a list of all current streams along with information
about their signal strengths.

Previously, attemping to use ffmpeg with a rtsp:// url that points
to a SAT>IP server would work with some devices, but fail due to 404
response on others. Further, if the SAT>IP server was already
streaming, ffmpeg would incorrectly consume the DESCRIBE SDP response
and join an existing tuner instead of requesting a new session with
the URL provided by the user. These issues have been noted by many
users across the internet[2][3][4].

This commit adds proper spec-compliant support for SAT>IP, including:

- support for the satip:// psuedo-protocol[5]
- avoiding the use of DESCRIBE
- parsing and consuming the com.ses.streamID response header
- using "Transport: RTP/AVP;unicast" because the optional "/UDP"
  suffix confuses some servers

This patch has been validated against multiple SAT>IP vendor devices:

- Telestar Digibit R2
  (https://telestar.de/en/produkt/digibit-r1-2/)
- Kathrein EXIP 418
  (https://www.kathrein-ds.com/en/produkte/sat-zf-verteiltechnik/sat-ip/227/exip-418)
- Kathrein EXIP 4124
  (https://www.kathrein-ds.com/en/products/sat-if-signal-distribution/sat-ip/226/exip-4124)
- Megasat MEG-8000
  (https://www.megasat.tv/produkt/sat-ip-server-3/)
- Megasat Twin
  (https://www.megasat.tv/en/produkt/sat-ip-server-twin/)
- Triax TSS 400
  (https://www.conrad.com/p/triax-tss-400-mkii-sat-ip-server-595256)

[1] https://www.satip.info/sites/satip/files/resource/satip_specification_version_1_2_2.pdf
[2] https://stackoverflow.com/questions/61194344/does-ffmpeg-violate-the-satip-specification-describe-syntax
[3] https://github.com/kodi-pvr/pvr.iptvsimple/issues/196
[4] https://forum.kodi.tv/showthread.php?tid=359072&pid=2995884#pid2995884
[5] https://www.satip.info/resources/channel-lists/
2020-12-28 14:08:44 -08:00
Michael Niedermayer
654b21ef17 avformat/mpegts: Fix argument type for av_log
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-12-28 19:36:57 +01:00
Michael Niedermayer
93bf8004d1 avformat/mxfdec: Do not clear arrays in mxf_read_index_entry_array()
They are written too immediately, so it should not be needed.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-12-28 19:34:40 +01:00
Steven Liu
6080c5e24f avformat/hlsproto: update comment of file description
reference link to rfc8216

Signed-off-by: liuqi05 <liuqi05@kuaishou.com>
2020-12-28 11:09:19 +08:00
Steven Liu
e7703ae335 avformat/hls: update comment of file description
reference link to rfc8216

Signed-off-by: liuqi05 <liuqi05@kuaishou.com>
2020-12-28 11:09:17 +08:00
Michael Niedermayer
aea8d4061d avformat/swfdec: Allocate output buffer after reading input
Fixes: Timeout (>10sec -> 0.26sec)
Fixes: 27419/clusterfuzz-testcase-minimized-ffmpeg_dem_SWF_fuzzer-5678307361947648

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-12-24 15:25:00 +01:00
Michael Niedermayer
684aec6a68 avformat/cafdec: clip sample rate
Fixes: 1.21126e+111 is outside the range of representable values of type 'int'
Fixes: 27398/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5412960339755008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-12-24 15:25:00 +01:00
Carl Eugen Hoyos
2943c3debd lavf/img2dec: Increase score for very large jpeg images.
Avoids a conflict with the raw mjpeg demuxer.
2020-12-24 13:16:44 +01:00
Derek Buitenhuis
a7f9b3b954 avformat/hlsenc: Add dependency on avc.o
a2b1dd0ce301450a47c972745a6b33c4c273aa5d added a dependency
on ff_nal_unit_extract_rbsp.

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
2020-12-22 18:03:18 -05:00
Michael Niedermayer
c0e660ba14 avformat/mpegts: simplify nb_packets code
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-12-22 00:30:50 +01:00
Michael Niedermayer
ef7b117b7b avformat/mpegts: Increase pcr_incr width to 64bit
Fixes: division by zero
Fixes: 26459/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5666350112178176
Fixes: 28154/clusterfuzz-testcase-minimized-ffmpeg_dem_MPEGTSRAW_fuzzer-5195728439476224

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-12-22 00:30:50 +01:00
Andriy Gelman
cd97e1ff4d avformat/libamqp: parse vhost in uri
Reviewed-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
2020-12-21 01:27:33 -05:00
Michael Niedermayer
0afbaabdca avformat/mov: Check if hoov is at the end
Fixes: Timeout, probably infinite loop
Fixes: 26559/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5391165484171264

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-12-19 20:07:56 +01:00
Andriy Gelman
207658112b avformat/rtsp: set AV_OPT_FLAG_DEPRECATED on deprecated options
Reviewed-by: Zhao Zhili <zhilizhao@tencent.com>
Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
2020-12-18 16:14:17 -05:00
Michael Niedermayer
ef59a40c2a avformat/url: Change () position in ff_make_absolute_url()
No testcase
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2020-12-16 22:45:28 +01:00