Skip to content
Snippets Groups Projects
Select Git revision
  • release/4.2-luma default
  • master
  • release/4.2
  • release/2.8
  • release/3.4
  • release/4.0
  • release/4.1
  • release/3.2
  • release/3.3
  • release/3.1
  • release/3.0
  • release/2.4
  • release/2.7
  • release/2.6
  • release/2.5
  • release/2.0
  • release/2.1
  • release/2.2
  • release/2.3
  • release/1.2
  • n3.4.7
  • n4.0.5
  • n4.2.1
  • n4.3-dev
  • n4.2
  • n4.1.4
  • n3.2.14
  • n4.1.3
  • n3.4.6
  • n4.0.4
  • n4.1.2
  • n4.1.1
  • n3.2.13
  • n3.3.9
  • n4.2-dev
  • n4.1
  • n4.0.3
  • n3.4.5
  • n3.0.12
  • n3.2.12
40 results
Search by author
  • Any Author
  • Dean Dean dean
1 author
  1. Dec 30, 2019
  3. Dec 13, 2019
    • Andreas Rheinhardt's avatar
      avformat/matroskadec: Fix use-after-free when demuxing ProRes · 48ae2358
      Andreas Rheinhardt authored 
      
ProRes in Matroska is supposed to not contain the first atom header
(containing a size field and the tag "icpf") and therefore the Matroska
demuxer has to recreate it; this involves an allocation and copy, of
course. Whether the old buffer (containing the data without the atom
header) needs to be freed or not depends upon whether it is what was
directly read (in which case it is owned by an AVBuffer) or whether it
has been allocated when reversing the track's content compression (e.g.
zlib compression) that Matroska supports.

So there are three pointers involved: The one pointing to the directly
read data (owned by the AVBuffer), the one pointing to the currently
valid data (which coincides with the former if no content compression
needed to be reverted) and the one pointing to the new data with the
first atom header. The check for whether to free the second of these is
simply whether the first two are different.

This works mostly, but there is a complication: Some muxers don't strip
the first atom header away and in this case, it is also not reinserted
and no new buffer is allocated; instead, the second and the third
pointers agree. In this case, one must never free the second buffer.
Yet it is currently done if the track is e.g. zlib compressed.
This commit fixes this.

This is a regression since b8e75a2a.

Signed-off-by: default avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: default avatarJames Almer <jamrial@gmail.com>
(cherry picked from commit af50f0a5)
      48ae2358
    • Andreas Rheinhardt's avatar
      avformat/matroskadec: Fix demuxing ProRes · 2f89f24e
      Andreas Rheinhardt authored 
      
The structure of a ProRes frame in mov/mp4 is that of a typical atom:
First a 32 bit BE size field, then a tag detailling the content. Said
size field includes the eight bytes of the atom header.

This header is actually redundant, as the size of the atom is already
known from the containing atom. It is therefore stripped away when muxed
into Matroska and so the Matroska demuxer has to recreate upon demuxing.
But it did not account for the fact that the size field includes the
size of the header and this can lead to problems when a decoder uses the
in-band size field.

Fixes ticket #8210.

Signed-off-by: default avatarAndreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: default avatarJames Almer <jamrial@gmail.com>
(cherry picked from commit 581419ea)
      2f89f24e
  5. Dec 12, 2019
  7. Dec 07, 2019
  9. Dec 03, 2019
  11. Nov 20, 2019
  13. Nov 19, 2019
  15. Nov 17, 2019
  17. Sep 28, 2019
  19. Sep 26, 2019
  21. Sep 24, 2019
  23. Sep 23, 2019
  25. Sep 06, 2019
  27. Sep 04, 2019