virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-08 13:22:53 +02:00
Code Issues Releases Activity
Mirror of https://git.ffmpeg.org/ffmpeg.git
98,477 Commits 37 Branches 400 Tags 470 MiB
C 90.3%
Assembly 7.8%
Makefile 1.3%
C++ 0.2%
Objective-C 0.2%
Other 0.1%
4516fc3e2b
Go to file
Andreas Rheinhardt 4516fc3e2b avfilter/formats: Fix double frees and memleaks on error 
The formats API deals with lists of channel layouts, sample rates,
pixel formats and sample formats. These lists are refcounted in a way in
which the list structure itself contains pointers to all of its owners.
Furthermore, it is possible for a list to be not owned by anyone yet;
this status is temporary until the list has been attached to an owner.
Adding an owner to a list involves reallocating the list's list of
owners and can therefore fail.

In order to reduce the amount of checks and cleanup code for the users
of this API, the API is supposed to be lenient when faced with input
lists that are NULL and it is supposed to clean up if adding an owner
to a list fails, so that a simple use case like

list = ff_make_format_list(foo_fmts);
if ((ret = ff_formats_ref(list, &ctx->inputs[0]->out_formats)) < 0)
    return ret;

needn't check whether list could be successfully allocated
(ff_formats_ref() return AVERROR(ENOMEM) if it couldn't) and it also
needn't free list if ff_formats_ref() couldn't add an owner for it.

But the cleaning up after itself was broken. The root cause was that
the refcount was decremented during unreferencing whether or not the
element to be unreferenced was actually an owner of the list or not.
This means that if the above sample code is continued by

if ((ret = ff_formats_ref(list, &ctx->inputs[1]->out_formats)) < 0)
    return ret;

and that if an error happens at the second ff_formats_ref() call, the
automatic cleaning of list will decrement the refcount from 1 (the sole
owner of list at this moment is ctx->input[0]->out_formats) to 0 and so
the list will be freed; yet ctx->input[0]->out_formats still points to
the list and this will lead to a double free/use-after-free when
ctx->input[0] is freed later.

Presumably in order to work around such an issue, commit
93afb338a4 restricted unreferencing to
lists with owners. This does not solve the root cause (the above example
is not fixed by this) at all, but it solves some crashs.

This commit fixes the API: The list's refcount is only decremented if
an owner is removed from the list of owners and not if the
unref-function is called with a pointer that is not among the owners of
the list. Furtermore, the requirement for the list to have owners is
dropped.

This implies that if the first call to ff_formats_ref() in the above
example fails, the refcount which is initially zero during unreferencing
is not modified, so that the list will be freed automatically in said
call to ff_formats_ref() as every list whose refcount reaches zero is.

If on the other hand, the second call to ff_formats_ref() is the first
to fail, the refcount would stay at one during the automatic
unreferencing in ff_formats_ref(). The list would later be freed when
its last (and in this case sole) owner (namely
ctx->inputs[0]->out_formats) gets unreferenced.

The issues described here for ff_formats_ref() also affected the other
functions of this API. E.g. ff_add_format() failed to clean up after
itself if adding an entry to an already existing list failed (the case
of a freshly allocated list was handled specially and this commit also
removes said code). E.g. ff_all_formats() inherited the flaw.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 2a471af50a)
2021-02-27 07:20:57 +01:00
compat compat/cuda/ptx2c: remove shell loop; fix BSD sed compat 2020-06-01 22:10:41 -05:00
doc Update for 4.3.2 2021-02-02 14:55:32 +01:00
ffbuild common.mak: Also clean Windows debug files. 2020-03-21 18:46:00 +01:00
fftools fftools/ffmpeg: Fix leak of AVFilterInOut in case of error 2021-02-27 07:20:56 +01:00
libavcodec avcodec/hapdec: Change compressed_offset to unsigned 32bit 2021-02-20 14:21:24 +01:00
libavdevice Bump minor versions to separate 4.3 from master 2020-06-08 22:49:04 +02:00
libavfilter avfilter/formats: Fix double frees and memleaks on error 2021-02-27 07:20:57 +01:00
libavformat avformat/mlvdec: Only store dimensions after having validated them 2021-02-27 07:20:56 +01:00
libavresample
libavutil libavutil/eval: Remove CONFIG_TRAPV special handling 2021-02-20 14:21:24 +01:00
libpostproc Bump minor versions to separate 4.3 from master 2020-06-08 22:49:04 +02:00
libswresample Bump minor versions to separate 4.3 from master 2020-06-08 22:49:04 +02:00
libswscale swscale/x86/yuv2rgb: fix crashes when loading alpha from unaligned buffers 2020-11-02 00:51:05 +01:00
presets
tests lavf/url: fix relative url parsing when the query string or fragment has a colon 2020-10-28 21:41:21 +01:00
tools tools/target_dec_fuzzer: enable mjpeg for tiff or tdsc 2020-06-08 20:45:56 +02:00
.gitattributes
.gitignore
.mailmap mailmap: fix 3-address entries 2020-03-31 04:14:14 -05:00
.travis.yml
Changelog Changelog: update 2021-02-20 14:22:23 +01:00
configure configure: update copyright year 2021-01-01 09:44:00 +05:30
CONTRIBUTING.md
COPYING.GPLv2
COPYING.GPLv3
COPYING.LGPLv2.1
COPYING.LGPLv3
CREDITS
INSTALL.md
LICENSE.md avfilter/vf_geq: Relicense to LGPL 2019-12-28 11:20:48 +01:00
MAINTAINERS oggdec: remove the oggparsedaala subdemuxer 2020-05-23 19:07:20 +01:00
Makefile Makefile: Delete more created files when running "make distclean". 2020-03-11 11:43:01 +01:00
README.md
RELEASE Update for 4.3.2 2021-02-02 14:55:32 +01:00
RELEASE_NOTES RELEASE_NOTES: Based on the version from 4.1 2020-06-14 22:02:34 +02:00

README.md

FFmpeg README

FFmpeg is a collection of libraries and tools to process multimedia content such as audio, video, subtitles and related metadata.

Libraries

  • libavcodec provides implementation of a wider range of codecs.
  • libavformat implements streaming protocols, container formats and basic I/O access.
  • libavutil includes hashers, decompressors and miscellaneous utility functions.
  • libavfilter provides a mean to alter decoded Audio and Video through chain of filters.
  • libavdevice provides an abstraction to access capture and playback devices.
  • libswresample implements audio mixing and resampling routines.
  • libswscale implements color conversion and scaling routines.

Tools

  • ffmpeg is a command line toolbox to manipulate, convert and stream multimedia content.
  • ffplay is a minimalistic multimedia player.
  • ffprobe is a simple analysis tool to inspect multimedia content.
  • Additional small tools such as aviocat, ismindex and qt-faststart.

Documentation

The offline documentation is available in the doc/ directory.

The online documentation is available in the main website and in the wiki.

Examples

Coding examples are available in the doc/examples directory.

License

FFmpeg codebase is mainly LGPL-licensed with optional components licensed under GPL. Please refer to the LICENSE file for detailed information.

Contributing

Patches should be submitted to the ffmpeg-devel mailing list using git format-patch or git send-email. Github pull requests should be avoided because they are not part of our review process and will be ignored.