Andreas Rheinhardt cfce16449c avformat/mpegenc: Ensure packet queue stays valid ... The MPEG-PS muxer uses a custom queue of custom packets. To keep track of it, it has a pointer (named predecode_packet) to the head of the queue and a pointer to where the next packet is to be added (it points to the next-pointer of the last element of the queue); furthermore, there is also a pointer that points into the queue (called premux_packet). The exact behaviour was as follows: If premux_packet was NULL when a packet is received, it is taken to mean that the old queue is empty and a new queue is started. premux_packet will point to the head of said queue and the next_packet-pointer points to its next pointer. If predecode_packet is NULL, it will also made to point to the newly allocated element. But if premux_packet is NULL and predecode_packet is not, then there will be two queues with head elements premux_packet and predecode_packet. Yet only elements reachable from predecode_packet are ever freed, so the premux_packet queue leaks. Worse yet, when the predecode_packet queue will be eventually exhausted, predecode_packet will be made to point into the other queue and when predecode_packet will be freed, the next pointer of the preceding element of the queue will still point to the element just freed. This element might very well be still reachable from premux_packet which leads to use-after-frees lateron. This happened in the tickets mentioned below. Fix this by never creating two queues in the first place by checking for predecode_packet to know whether the queue is empty. If premux_packet is NULL, then it is set to the newly allocated element of the queue. Fixes tickets #6887, #8188 and #8266. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>		2021-02-19 07:45:48 +01:00
..
tests
.gitignore
3dostr.c	avformat/3dostr: Check sample_rate	2021-02-09 19:37:27 +01:00
4xm.c	avformat/4xm: Make audio_frame_count 64bit	2021-02-04 23:34:29 +01:00
a64.c
aacdec.c
aadec.c
aaxdec.c	avformat/aaxdec: Check string before strcmp()	2021-01-11 23:15:04 +01:00
ac3dec.c
acedec.c
acm.c
act.c
adp.c
ads.c	avformat/ads: Check size	2021-01-23 14:32:54 +01:00
adtsenc.c
adxdec.c
aea.c
afc.c
aiff.h
aiffdec.c	avformat/aiffdec: Check size before subtraction in get_aiff_header()	2021-01-29 19:36:46 +01:00
aiffenc.c
aixdec.c
allformats.c	avformat: add xbm_pipe demuxer	2021-02-05 15:36:19 +01:00
alp.c
amr.c
amvenc.c
anm.c
apc.c
ape.c
apetag.c
apetag.h
apm.c
apngdec.c
apngenc.c
aptxdec.c
aqtitledec.c
argo_asf.c
argo_asf.h
argo_brp.c
asf.c
asf.h
asfcrypt.c
asfcrypt.h
asfdec_f.c	avformat/asfdec_f: Add an additional check for the extradata size	2021-02-09 19:37:27 +01:00
asfdec_o.c	avformat/asfdec_o: Check lang_idx	2021-01-29 19:36:46 +01:00
asfenc.c
assdec.c
assenc.c
ast.c
ast.h
astdec.c
astenc.c
async.c	avformat/avio: Remove ffurl_open	2021-02-02 23:53:29 +01:00
au.c
av1.c	avformat/av1: add support for passing through MP4/Matroska av1c	2020-11-24 10:13:55 +02:00
av1.h
av1dec.c	avformat/av1dec: check size before addition in probing	2020-12-06 21:00:03 +01:00
avc.c
avc.h
avformat.h	avdevice/avdevice: Deprecate AVDevice Capabilities API	2021-02-14 21:07:57 +01:00
avformatres.rc
avi.h
avidec.c	avformat/avidec: Use 64bit in get_duration()	2021-02-10 12:28:30 +01:00
avienc.c
avio_internal.h
avio.c	avformat/avio: Remove ffurl_open	2021-02-02 23:53:29 +01:00
avio.h
aviobuf.c
avisynth.c
avlanguage.c
avlanguage.h
avr.c
avs2dec.c
avs3dec.c
avs.c	avformat/avs: Use 64bit for the avio_tell() output	2020-11-22 17:45:17 +01:00
bethsoftvid.c
bfi.c	avformat/bfi: Check chunk_header	2021-01-23 14:32:54 +01:00
bink.c
binka.c	avformat: add binka demuxer	2021-02-04 17:52:45 +01:00
bintext.c
bit.c
bluray.c
bmv.c
boadec.c
brstm.c
c93.c
cache.c
caf.c
caf.h
cafdec.c	avformat/cafdec: clip sample rate	2020-12-24 15:25:00 +01:00
cafenc.c
cavsvideodec.c
cdg.c
cdxl.c	avformat/cdxl: add back options to override sample and frame rate	2021-02-05 18:11:42 +01:00
chromaprint.c	All: update names in copyright headers	2021-01-20 01:02:56 -06:00
cinedec.c
codec2.c
concat.c
concatdec.c
crcenc.c
crypto.c
dash.c
dash.h
dashdec.c	avformat/dashdec: Avoid segfault when URL template is unexpectedly missing	2021-02-04 10:30:39 +08:00
dashenc.c
data_uri.c
dauddec.c
daudenc.c
dcstr.c
derf.c
dfa.c
dhav.c	avformat/dhav: Break out of infinite dhav search loop	2021-01-21 20:21:32 +01:00
diracdec.c
dnxhddec.c
dsfdec.c	avformat/dsfdec: Check block_align more completely	2020-12-06 21:00:03 +01:00
dsicin.c
dss.c
dtsdec.c
dtshddec.c
dump.c	av_dump_format(): reduce indentation for streams	2021-02-03 10:41:33 +01:00
dv.c	avformat/dv: fix timestamps of audio packets in case of dropped corrupt audio frames	2020-12-06 18:09:24 +01:00
dv.h
dvbsub.c
dvbtxt.c
dvenc.c	avformat/cutils, dvenc: Move ff_brktimegm to its only user	2021-02-03 21:35:43 +01:00
dxa.c
eacdata.c
electronicarts.c	avformat/electronicarts: Clear partial_packet on error	2021-02-12 23:42:16 +01:00
epafdec.c
ffmeta.h
ffmetadec.c
ffmetaenc.c
fifo_test.c
fifo.c
file_open.c
file.c
filmstripdec.c
filmstripenc.c
fitsdec.c	avformat/fitsdec: Better size checks	2021-01-23 01:05:25 +01:00
fitsenc.c	avformat/fitsenc: write DATAMIN/DATAMAX to encoded output	2021-02-10 00:03:38 +01:00
flac_picture.c
flac_picture.h
flacdec.c
flacenc_header.c
flacenc.c	avformat/flacenc: Fix memleak when writing attached pictures fails	2020-11-26 13:32:30 +01:00
flacenc.h
flic.c
flv.h
flvdec.c	avformat/flvdec: Treat high ts byte as unsigned	2021-02-10 21:18:16 +01:00
flvenc.c
format.c
framecrcenc.c	avformat/framecrcenc: Make side-data checksums endian-independent	2020-12-08 18:54:20 +01:00
framehash.c
frmdec.c
fsb.c
ftp.c
fwse.c
g722.c
g723_1.c
g726.c
g729dec.c
gdv.c
genh.c
gif.c
gifdec.c
golomb_tab.c
gopher.c
gsmdec.c
gxf.c
gxf.h
gxfenc.c
h261dec.c
h263dec.c
h264dec.c
hashenc.c	avformat/hashenc: Deduplicate (stream)hash options	2021-01-08 05:06:11 +01:00
hca.c
hcom.c
hdsenc.c
hevc.c
hevc.h
hevcdec.c
hls.c	avformat/hls: change sequence number type to int64_t	2021-01-24 10:55:29 +08:00
hlsenc.c	avformat/hlsenc: use AV_OPT_TYPE_DURATION	2021-02-02 20:55:50 +08:00
hlsplaylist.c
hlsplaylist.h
hlsproto.c	avformat/hlsproto: update comment of file description	2020-12-28 11:09:19 +08:00
hnm.c
http.c	lavf/http: treat 308 as 301	2021-01-25 09:36:47 +01:00
http.h
httpauth.c
httpauth.h
icecast.c
icodec.c
icoenc.c
id3v1.c
id3v1.h
id3v2.c	avformat/id3v2: Check the return from avio_get_str()	2021-02-10 12:28:29 +01:00
id3v2.h
id3v2enc.c
idcin.c
idroqdec.c
idroqenc.c
iff.c	avformat/iff: Check block align also for ID_MAUD	2021-01-23 14:32:54 +01:00
ifv.c
ilbc.c
img2_alias_pix.c
img2_brender_pix.c
img2.c
img2.h
img2dec.c	lavf/img2dec: Autodetect pfm images.	2021-02-15 00:34:01 +01:00
img2enc.c	avcodec: add initial exr image encoder	2021-02-18 13:00:40 +01:00
ingenientdec.c
internal.h	avformat/mux: return a pointer to the packet in ff_interleaved_peek()	2021-02-13 13:05:26 -03:00
ip.c
ip.h
ipmovie.c
ipudec.c
ircam.c
ircam.h
ircamdec.c	avformat/ircamdec: use lrintf() for rounding	2021-02-16 23:45:01 +01:00
ircamenc.c
isom.c
isom.h
iss.c
iv8.c
ivfdec.c
ivfenc.c
jacosubdec.c
jacosubenc.c
jvdec.c
kvag.c
latmenc.c
libamqp.c	avformat/libamqp: parse vhost in uri	2020-12-21 01:27:33 -05:00
libavformat.v
libgme.c
libmodplug.c
libopenmpt.c
librtmp.c
libsmbclient.c
libsrt.c	avformat/libsrt: fix race condition with libsrt_network_wait_fd and epoll	2021-02-07 19:42:22 +01:00
libssh.c
libzmq.c
lmlm4.c
loasdec.c
log2_tab.c
lrc.c
lrc.h
lrcdec.c
lrcenc.c
luodatdec.c
lvfdec.c
lxfdec.c
m4vdec.c
Makefile	avformat: add xbm_pipe demuxer	2021-02-05 15:36:19 +01:00
matroska.c
matroska.h
matroskadec.c	avformat/matroskadec: Sanity check codec_id/track type	2020-12-09 21:41:15 +01:00
matroskaenc.c
mca.c
mccdec.c
md5proto.c
metadata.c
metadata.h
mgsts.c
microdvddec.c
microdvdenc.c
mj2kdec.c
mkvtimestamp_v2.c
mlpdec.c
mlvdec.c
mm.c
mmf.c
mms.c
mms.h
mmsh.c
mmst.c
mods.c
moflex.c	avformat/moflex: Check pkt_size	2020-11-22 17:45:17 +01:00
mov_chan.c
mov_chan.h
mov_esds.c
mov.c	avformat/mov: Check element count in mov_metadata_hmmt()	2021-02-16 19:02:24 +01:00
movenc.c	avformat/mux: return a pointer to the packet in ff_interleaved_peek()	2021-02-13 13:05:26 -03:00
movenc.h
movenccenc.c
movenccenc.h
movenchint.c
mp3dec.c
mp3enc.c
mpc8.c	avformat/mpc8: Check size before implicitly converting to int	2021-01-28 21:06:48 +01:00
mpc.c
mpeg.c
mpeg.h
mpegenc.c	avformat/mpegenc: Ensure packet queue stays valid	2021-02-19 07:45:48 +01:00
mpegts.c	avformat: remove some mpegts details from AVStream	2021-01-09 22:38:12 +01:00
mpegts.h
mpegtsenc.c
mpegvideodec.c
mpjpeg.c
mpjpegdec.c
mpl2dec.c
mpsubdec.c	avformat/mpsubdec: Use av_sat_add/sub64() in fracval handling	2021-01-26 18:37:12 +01:00
msf.c
msnwc_tcp.c
mspdec.c	avformat/mspdec: Microsoft Paint (MSP) demuxer	2020-12-06 20:03:47 +11:00
mtaf.c
mtv.c
musx.c
mux.c	avformat/mux: return a pointer to the packet in ff_interleaved_peek()	2021-02-13 13:05:26 -03:00
mvdec.c	avformat/mvdec: Check for EOF in read_index()	2021-02-10 12:28:29 +01:00
mvi.c	avformat/mvi: Use 64bit for testing dimensions	2021-01-26 18:37:12 +01:00
mxf.c	avformat/mxf: Establish register of local tags	2021-02-01 23:52:55 +01:00
mxf.h	avformat/mxf: Establish register of local tags	2021-02-01 23:52:55 +01:00
mxfdec.c	avformat/mxfdec: set toolkit version metadata	2021-02-05 09:27:05 +08:00
mxfenc.c	avformat/mxfenc: Discard audio until valid video has been received	2021-02-16 22:51:11 +01:00
mxg.c
ncdec.c
network.c
network.h
nistspheredec.c	avformat/nistspheredec: Check bits_per_coded_sample and channels	2021-01-21 20:21:32 +01:00
nspdec.c
nsvdec.c
nullenc.c
nut.c
nut.h
nutdec.c	avformat/nutdec: Check timebase count against main header length	2021-02-14 19:55:02 +01:00
nutenc.c
nuv.c	avformat/nuv: Check channels	2021-01-28 21:08:11 +01:00
oggdec.c
oggdec.h
oggenc.c
oggparsecelt.c
oggparsedirac.c
oggparseflac.c
oggparseogm.c
oggparseopus.c
oggparseskeleton.c
oggparsespeex.c
oggparsetheora.c
oggparsevorbis.c
oggparsevp8.c
oma.c
oma.h
omadec.c
omaenc.c
options_table.h
options.c
os_support.c
os_support.h
paf.c	avformat/paf: Do not zero allocated tables which are immedeately filled	2021-01-21 20:21:32 +01:00
pcm.c
pcm.h
pcmdec.c
pcmenc.c
pjsdec.c
pmpdec.c
pp_bnk.c
prompeg.c
protocols.c
psxstr.c
pva.c
pvfdec.c
qcp.c
qtpalette.c	avformat/qtpalette: Use better headers	2021-02-03 22:28:11 +01:00
qtpalette.h	avformat/qtpalette: Use better headers	2021-02-03 22:28:11 +01:00
r3d.c	avformat/r3d: Check samples before computing duration	2021-02-12 23:42:16 +01:00
rawdec.c	lavf/rawdec: Return a low score if the mjpeg probe function detected one frame.	2020-12-11 00:23:41 +01:00
rawdec.h
rawenc.c
rawenc.h
rawutils.c
rawvideodec.c
rdt.c	avformat/rtpdec: Constify RTPDynamicProtocolHandlers	2021-01-24 11:28:53 +01:00
rdt.h
realtextdec.c	avformat/realtextdec: Avoid undefined overflow in the end of read_ts()	2021-01-26 18:37:12 +01:00
redspark.c
replaygain.c
replaygain.h
riff.c
riff.h
riffdec.c
riffenc.c
rl2.c
rm.c
rm.h
rmdec.c	avformat/rmdec: Check codec_length without overflow	2021-02-16 19:02:24 +01:00
rmenc.c
rmsipr.c
rmsipr.h
rpl.c	avformat/rpl: Check the number of streams	2020-12-09 21:41:15 +01:00
rsd.c	uavformat/rsd: check for EOF in extradata	2021-01-11 23:15:04 +01:00
rso.c
rso.h
rsodec.c
rsoenc.c
rtmp.h
rtmpcrypt.c
rtmpcrypt.h
rtmpdh.c
rtmpdh.h
rtmpdigest.c
rtmphttp.c
rtmppkt.c	avformat/rtmppkt: Only compile ff_rtmp_packet_dump if defined(DEBUG)	2021-02-02 23:53:29 +01:00
rtmppkt.h	avformat/rtmppkt: Remove ff_amf_read_bool	2021-02-02 23:53:29 +01:00
rtmpproto.c	avformat/rtmpproto: Only include RTMP protocols that are enabled	2021-02-02 23:53:29 +01:00
rtp.c
rtp.h
rtpdec_ac3.c
rtpdec_amr.c
rtpdec_asf.c
rtpdec_dv.c
rtpdec_formats.h
rtpdec_g726.c
rtpdec_h261.c
rtpdec_h263_rfc2190.c
rtpdec_h263.c
rtpdec_h264.c
rtpdec_hevc.c
rtpdec_ilbc.c
rtpdec_jpeg.c
rtpdec_latm.c
rtpdec_mpa_robust.c
rtpdec_mpeg4.c
rtpdec_mpeg12.c
rtpdec_mpegts.c
rtpdec_qcelp.c
rtpdec_qdm2.c
rtpdec_qt.c	avformat/rtpdec: Constify RTPDynamicProtocolHandlers	2021-01-24 11:28:53 +01:00
rtpdec_rfc4175.c
rtpdec_svq3.c
rtpdec_vc2hq.c
rtpdec_vp8.c
rtpdec_vp9.c
rtpdec_xiph.c
rtpdec.c	avformat/rtpdec: Avoid allocations of small dynamic buffers	2021-01-31 21:26:44 +01:00
rtpdec.h	avformat/rtpdec: Remove next pointer from Protocol Handlers	2021-01-24 11:19:10 +01:00
rtpenc_aac.c
rtpenc_amr.c
rtpenc_chain.c
rtpenc_chain.h
rtpenc_h261.c
rtpenc_h263_rfc2190.c
rtpenc_h263.c
rtpenc_h264_hevc.c
rtpenc_jpeg.c
rtpenc_latm.c
rtpenc_mpegts.c
rtpenc_mpv.c
rtpenc_vc2hq.c
rtpenc_vp8.c
rtpenc_vp9.c
rtpenc_xiph.c
rtpenc.c
rtpenc.h
rtpproto.c
rtpproto.h
rtsp.c	avformat/rtsp: Fix build failure when RTP demuxers are disabled	2021-02-03 21:36:47 +01:00
rtsp.h	avformat/rtsp: add satip_raw flag to receive raw mpegts stream	2020-12-28 14:08:44 -08:00
rtspcodes.h
rtspdec.c	avformat/rtsp: add support for satip://	2020-12-28 14:08:44 -08:00
rtspenc.c	avformat/rtsp: prefer to use MAX_URL_SIZE for url and command buffer	2020-12-05 09:00:53 +08:00
s337m.c
samidec.c	avformat/samidec: Sanity check pts	2021-02-10 12:28:30 +01:00
sapdec.c
sapenc.c
sauce.c
sauce.h
sbcdec.c
sbgdec.c	avformat/sbgdec: Use av_sat_add64() in str_to_time()	2021-02-01 19:03:53 +01:00
sccdec.c	avformat/sccdec: Use larger intermediate for ts/next_ts computation	2021-02-02 13:12:12 +01:00
sccenc.c
sctp.c
sdp.c
sdr2.c
sdsdec.c
sdxdec.c
segafilm.c
segafilmenc.c
segment.c
serdec.c
shortendec.c
sierravmd.c
siff.c
smacker.c	avformat/smacker: Check for too small pts_inc	2021-02-02 13:12:12 +01:00
smjpeg.c
smjpeg.h
smjpegdec.c
smjpegenc.c
smoothstreamingenc.c
smush.c
sol.c
sox.h
soxdec.c	avformat/soxdec: Check channels to be positive	2021-02-02 13:12:12 +01:00
soxenc.c
spdif.c
spdif.h
spdifdec.c
spdifenc.c
srtdec.c
srtenc.c
srtp.c
srtp.h
srtpproto.c
stldec.c
subfile.c
subtitles.c
subtitles.h
subviewer1dec.c
subviewerdec.c
supdec.c
supenc.c
svag.c
svs.c
swf.c	avformat/swf: add support for reading and writing VP6A and Flash Screen Video codecs	2021-01-23 20:10:05 +01:00
swf.h
swfdec.c	avformat/swf: add support for reading and writing VP6A and Flash Screen Video codecs	2021-01-23 20:10:05 +01:00
swfenc.c	avformat/swf: add support for reading and writing VP6A and Flash Screen Video codecs	2021-01-23 20:10:05 +01:00
takdec.c
tcp.c
tedcaptionsdec.c	avformat/tedcaptionsdec: Check for overflow in parse_int()	2021-01-29 19:36:46 +01:00
tee_common.c
tee_common.h
tee.c	avformat/tee: allow packets with negative timestamps	2020-12-07 13:34:06 +02:00
teeproto.c
thp.c
tiertexseq.c
tls_gnutls.c
tls_libtls.c
tls_mbedtls.c
tls_openssl.c
tls_schannel.c
tls_securetransport.c	All: update names in copyright headers	2021-01-20 01:02:56 -06:00
tls.c
tls.h
tmv.c
tta.c	avformat/tta: Use 64bit intermediate for index	2021-02-02 13:12:12 +01:00
ttaenc.c
tty.c
txd.c
ty.c
udp.c	avformat/udp: add memory alloc checks	2021-01-16 08:51:31 +08:00
uncodedframecrcenc.c
unix.c
url.c	avformat/url: Change () position in ff_make_absolute_url()	2020-12-16 22:45:28 +01:00
url.h	avformat/avio: Remove ffurl_open	2021-02-02 23:53:29 +01:00
urldecode.c
urldecode.h
utils.c	avformat/utils: Add av_assert1 to preclude NULL + len, len != 0	2021-02-15 16:50:55 +01:00
v210.c
vag.c
vapoursynth.c
vc1dec.c
vc1test.c
vc1testenc.c
version.h	avformat: add xbm_pipe demuxer	2021-02-05 15:36:19 +01:00
vividas.c	avformat/vividas: Check number of audio channels	2021-01-05 02:00:05 +01:00
vivo.c
voc_packet.c
voc.c
voc.h
vocdec.c
vocenc.c
vorbiscomment.c
vorbiscomment.h
vpcc.c
vpcc.h
vpk.c
vplayerdec.c
vqf.c	avformat/vqf: Check len for COMM chunks	2020-12-05 00:08:33 +01:00
w64.c
w64.h
wavdec.c	avformat/wavdec: Consider AV_INPUT_BUFFER_PADDING_SIZE in set_spdif()	2021-02-10 21:18:18 +01:00
wavenc.c
wc3movie.c
webm_chunk.c
webmdashenc.c
webpenc.c
webvttdec.c
webvttenc.c
westwood_aud.c
westwood_vqa.c
wsddec.c
wtv_common.c
wtv.h
wtvdec.c	avformat/wtvdec: Check len in parse_chunks() to avoid overflow	2021-02-09 19:37:27 +01:00
wtvenc.c
wv.c
wv.h
wvdec.c
wvedec.c
wvenc.c
xa.c
xmv.c
xvag.c
xwma.c
yop.c
yuv4mpeg.h
yuv4mpegdec.c
yuv4mpegenc.c