Commit Graph

26251 Commits

Author SHA1 Message Date
James Almer
baee5f5e27 avformat/avformat: also clear FFFormatContext packet queue when closing a muxer
packet_buffer is used in mux.c, and if a muxing process fails at a point where
packets remained in said queue, they will leak.

Fixes ticket #11419

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit c08d300481)
2025-11-19 19:56:49 -03:00
Michael Niedermayer
a218e6a6e5 avformat/rtpdec_rfc4175: Only change PayloadContext on success
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c03e49dd1d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-11-19 12:45:55 +01:00
Michael Niedermayer
f1b3d804db avformat/rtpdec_rfc4175: Check dimensions
Fixes: out of array access
Fixes: zeropath/int_overflow_in_rtpdec_rfc4175

Found-by: Joshua Rogers <joshua@joshua.hu>
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d4e0d5ed48)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-11-19 12:45:54 +01:00
Michael Niedermayer
51b5e19aa5 avformat/rtpdec_rfc4175: Fix memleak of sampling
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit af3dee3132)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-11-19 12:45:54 +01:00
Michael Niedermayer
4e8fb530ef avformat/http: Fix off by 1 error
Fixes: out of array access
Fixes: zeropath/off-by-one-one-byte

Found-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b518c027a0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-11-19 12:45:54 +01:00
Michael Niedermayer
2b2e23ff91 avformat/sctp: Check size in sctp_write()
Fixes: out of array access
No testcase

Found-by: Joshua Rogers <joshua@joshua.hu> with ZeroPath
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b98cea4bf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-11-19 12:45:53 +01:00
Michael Niedermayer
6f179470b2 avformat/rtmpproto: consider command line argument lengths
Fixes: out of array access
Fixes: zeropath/rtmp-2025-10

Found-by: Joshua Rogers <joshua@joshua.hu>
Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 83e0298de2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-11-19 12:45:53 +01:00
Michael Niedermayer
c0bf64e009 avformat/rtmpproto_ Check tcurl and flashver length
Fixes: out of array accesses

Reviewed-by: Joshua Rogers <joshua@joshua.hu>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a64e037429)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-11-19 12:45:53 +01:00
Michael Niedermayer
ceae7a8353 avformat/rtpenc_h264_hevc: Check space for nal_length_size in ff_rtp_send_h264_hevc()
Fixes: memcpy with negative size
Fixes: momo_trip-poc/input

Reported-by: Momoko Shiraishi <shiraishi@os.is.s.u-tokyo.ac.jp>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d03483bd26)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-11-19 12:45:52 +01:00
Andreas Rheinhardt
26115ca03d avformat/aviobuf: Keep checksum_ptr consistent in avio_seek()
Otherwise it might be > buf_ptr in which case ffio_get_checksum()
could segfault (s->buf_ptr - s->checksum_ptr would be negative
which would be converted to something very big when converted
to unsigned for the update_checksum callback).

Fixes ticket #11233.

Reported-by: Du4t
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 987c955cd7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-11-19 12:45:43 +01:00
James Almer
bd4191a567 avformat/demux: pass new extradata to the parser
The parser API doesn't work with packets, only raw data, so in order for it to
be made aware of new extradata propagated through packet side data we need to
pass it in some other form, namely, replacing the main extradata and ensuring
it will be parsed by restarting the parser.

Signed-off-by: James Almer <jamrial@gmail.com>
2025-10-28 11:45:26 -03:00
Michael Niedermayer
32e940a622 avformat/lrcdec: Fix fate-sub-lrc-ms-remux on x86-32
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0243cf89b1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:32 +02:00
Kacper Michajłow
d370b868bc avformat/lrcdec: limit input timestamp range to avoid overflows
Fixes: clusterfuzz-testcase-ffmpeg_dem_LRC_fuzzer-5226140131459072
Found-by: OSS-Fuzz
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit c74bc74398)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:28 +02:00
Kimapr
cb491e8cb3 avformat/libopenmpt: fix seeking weirdness
- proper pts for packets. leaving it blank leaves it up for guessing,
  but the guess doesn't take seeking into account, causing weirdness.

- clamp to 0 when seeking to negative ts. libopenmpt docs are unclear on
  this but not doing this causes an immediate EOF when seeking backwards
  to the beginning in mpv.

- only set song duration and packet pts when they are non-negative and
  in int64 range. NaNs count as out of range. this isn't a fix for any
  specific issue but might be helpful still, and shouldn't break
  anything.

(cherry picked from commit ecef5f9e1f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:21 +02:00
Michael Niedermayer
a44dcc770e avformat/hls: add cmfv/cmfa exceptions
Fixes: Ticket11526

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f3c3a6ecfb)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:21 +02:00
Kacper Michajłow
e8439f41ff avformat/lrcdec: support arbitrary precision timestamp
Apparently files with milliseconds exist in the wild. And since it cost
nothing to support arbitrary number of digits, extend format to support
that.

Depending on number of digits, the time base of fractional part is
changing. Most LRCs use 2 digits and centiseconds base, but subs with 3
digits and miliseconds exist too.

Set internal time base to AV_TIME_BASE, which in parcitice allows to
hold microseconds with 6 digits. Totally artificial, but who knows maybe
someone wants that.

Fixes: #11677

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
(cherry picked from commit bc3cc0a6af)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:20 +02:00
Michael Niedermayer
342ea86330 avformat/dashdec: Allocate space for appended "/"
Fixes: writing 1 byte over the end of the array
Fixes: BIGSLEEP-433502298/test.xml

Found-by: Google Big Sleep

A prettier solution is welcome!
A testcase exists only for the baseurl case

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce0a655f85)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:16 +02:00
Michael Niedermayer
27624d678d avformat/mxg: clear AV_INPUT_BUFFER_PADDING_SIZE
Fixes: use of uninitialized memory
Fixes: 427532813/clusterfuzz-testcase-minimized-ffmpeg_dem_MXG_fuzzer-5661938917113856

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b12e919cf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:16 +02:00
Michael Niedermayer
68fe5db819 avformat/vqf: Ensure that comm_chunk is fully read
Fixes: use of uninitialized memory
Fixes: 412125811/clusterfuzz-testcase-minimized-ffmpeg_dem_VQF_fuzzer-6253774274887680

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 1b7a327b3a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:15 +02:00
Michael Niedermayer
c785b5580e avformat/mov: make sure file_checksum is fully initialized
Fixes: use of uninitialized memory
Fixes: 394990189/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6431722199908352

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8b16e1ddd9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:15 +02:00
Michael Niedermayer
f083c463f1 avformat/asfdec_f: Check amount of value read
Fixes: use of uninitialized memory
Fixes: 403675492/clusterfuzz-testcase-minimized-ffmpeg_dem_ASF_fuzzer-4754281823797248

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fa197924a6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:14 +02:00
Michael Niedermayer
ac8d81266f avformat/concatdec: Clip duration in one more case in get_best_effort_duration()
Fixes: signed integer overflow: 40000 - -9223372036854770000 cannot be represented in type 'long'
Fixes: 427262541/clusterfuzz-testcase-minimized-ffmpeg_dem_CONCAT_fuzzer-4831506940100608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8cdb47e47a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:12 +02:00
Michael Niedermayer
3ece3ded0c avformat/mov: Check that sample_count is allocated in mov_parse_heif_items()
Fixes: NULL pointer dereference
Fixes: 416811958/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5425269114732544

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0ffe97d9b9)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:07 +02:00
Michael Niedermayer
093b349dd6 avformat/iff: Check nb_channels == 0 in CHNL
Fixes: division by 0
Fixes: 418396712/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-6104388018176000
Fixes: 418478219/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4569544410857472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5b1301004b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:06 +02:00
James Almer
a9c5da3261 avformat/movenc: fix writing reserved bits in EC3SpecificBox
As described in section F.6.1 from ETSI TS 102 366.

Found-by: nyanmisaka
Reviewed-by: Baptiste Coudurier <baptiste.coudurier@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 17729aa80c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-09-08 02:13:04 +02:00
James Almer
6400860b9d avformat/iamf_parse: prevent overreads in update_extradata
Fixes: libavcodec/put_bits.h:232:32: runtime error: shift exponent -19 is negative
Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406
Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:50:09 -03:00
James Almer
2c4ca52c8a avformat/iamf_parse: increase PutBytes buffer when writing AAC extradata
We may write up to 43 bits, so 5 bytes is not enough.

Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:406
Fixes: 398527871/clusterfuzz-testcase-minimized-ffmpeg_dem_IAMF_fuzzer-6602025714647040

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
2025-06-24 14:50:08 -03:00
Michael Niedermayer
ebcd40e701 avformat/matroskadec: check that channels fit in signed 32bit int
Fixes: signed integer overflow: -1384566925600903168 * 16 cannot be represented in type 'long'
Fixes: 407069502/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-5159255372267520

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 05f8c8c4c2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:50 +02:00
Michael Niedermayer
f9a3e1ac19 avformat/imf_cpl: fix indention after previous commit
(cherry picked from commit d28bec8c4d)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:49 +02:00
Michael Niedermayer
72d65a3a69 avformat/imf_cpl: do not continue looping forever
Fixes: infinite loop
Fixes: 401658595/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5756875014733824
Regression since: 61fa1e14e4

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 39800d78b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:49 +02:00
Michael Niedermayer
2ac90a049c avformat/mov: reject negative ELST durations
Fixes: multiple integer overflows
Fixes: 401016767/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6242067591790592

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9fc2702f6f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:48 +02:00
Michael Niedermayer
6c0ec7b61d avformat/avidec: Ignore duplicate GAB2
Fixes: memleak
Fixes: 398401912/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-4669849976766464

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 6a47046981)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:48 +02:00
Michael Niedermayer
6fb3c736a6 avformat/iff: Check nb_channels == 0 in MHDR
Fixes: division by 0
Fixes: 395163171/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-542604339373670

Reviewed-by: Peter Ross <pross@xvid.org>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ce1fd73d63)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:46 +02:00
Michael Niedermayer
6153d69335 avformat/hls: Fix flash1.bogulus.cfd support
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 75be669ca1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:45 +02:00
Michael Niedermayer
56e100a799 avformat/hls: Split allowed_segment_extensions off allowed_extensions
This allows the user to set only the one that is needed to ALL or a
specific "wrong" extension like html

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f99f223eb1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:44 +02:00
Michael Niedermayer
b8eb5f0cbd avformat/hls: Fix Youtube AAC
Fixes: Ticket11435
Fixes: yt-dlp -f 234+270 https://www.youtube.com/live/l8PMl7tUDIE

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 48c0dba23b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:44 +02:00
Michael Niedermayer
84e237a58e avformat/hls: add fmp4 to allowed_extensions
Fixes: yt-dlp/issues/12700

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit d82016c730)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:44 +02:00
Michael Niedermayer
f2d135332b avformat/hls: Add ec3 to allowed_extensions
Fixes part of Ticket11435
Fixes: Elisa Viihde (Finnish online recording service)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 68644994fd)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:43 +02:00
Michael Niedermayer
eb922deff1 avformat/hls: Add cmfv and cmfa to allowed_extensions
Fixes: www.nicovideo.jp
Fixes: Ticket11526
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 2352145e41)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:43 +02:00
Michael Niedermayer
937051872d Revert "avformat/mpegts: update stream info when PMT ES stream_type changes"
This fixes mixing up contexts, use of uninitialized data and crashes.
More specifically:

==1001752== Conditional jump or move depends on uninitialised value(s)
==1001752==    at 0xA9ED82: avpriv_h264_has_num_reorder_frames (h264dec.c:64)
==1001752==    by 0x668C7E: has_decode_delay_been_guessed (demux.c:757)
==1001752==    by 0x66AB13: compute_pkt_fields (demux.c:1137)
==1001752==    by 0x66B2E9: parse_packet (demux.c:1265)
==1001752==    by 0x66BD84: read_frame_internal (demux.c:1449)
==1001752==    by 0x67085B: avformat_find_stream_info (demux.c:2692)
==1001752==    by 0x25157C: ifile_open (ffmpeg_demux.c:1814)
==1001752==    by 0x272B15: open_files (ffmpeg_opt.c:1366)
==1001752==    by 0x272D85: ffmpeg_parse_options (ffmpeg_opt.c:1415)
==1001752==    by 0x2925C9: main (ffmpeg.c:991)
==1001752==  Uninitialised value was created by a heap allocation
==1001752==    at 0x483E0F0: memalign (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==1001752==    by 0x483E212: posix_memalign (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==1001752==    by 0x14882CE: av_malloc (mem.c:107)
==1001752==    by 0x1463785: av_buffer_alloc (buffer.c:82)
==1001752==    by 0x146423F: pool_alloc_buffer (buffer.c:369)
==1001752==    by 0x14643C4: av_buffer_pool_get (buffer.c:407)
==1001752==    by 0x752C4B: buffer_pool_get (mpegts.c:1142)
==1001752==    by 0x7538F2: mpegts_push_data (mpegts.c:1407)
==1001752==    by 0x758893: handle_packet (mpegts.c:2909)
==1001752==    by 0x758E90: handle_packets (mpegts.c:3048)
==1001752==    by 0x759B1D: mpegts_read_packet (mpegts.c:3290)
==1001752==    by 0x6687A3: ff_read_packet (demux.c:649)
==1001752==    by 0x66B594: read_frame_internal (demux.c:1346)
==1001752==    by 0x67085B: avformat_find_stream_info (demux.c:2692)
==1001752==    by 0x25157C: ifile_open (ffmpeg_demux.c:1814)
==1001752==    by 0x272B15: open_files (ffmpeg_opt.c:1366)
==1001752==    by 0x272D85: ffmpeg_parse_options (ffmpeg_opt.c:1415)
==1001752==    by 0x2925C9: main (ffmpeg.c:991)

Found-by: Alexander A. Shvedov <shvedov@gmx.com>
CC: Pavel Koshevoy <pkoshevoy@gmail.com>
This reverts commit 0021484d05.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-06-11 17:29:40 +02:00
Andreas Rheinhardt
0f1fe3d153 avformat/matroska: Support JPEG2000 for demuxing
Legal since commit 1cd0a9be4b2d1e7c60184ec68404e00e46e3123e
(Jan 4) in the Cellar Matroska specification git repo.
We still hold out on muxing it due to compatibility with
old demuxers.

Reviewed-by: compn <ff@hawaiiantel.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 8a936b8726)
2025-06-07 09:28:45 +02:00
Andreas Rheinhardt
0755e038ca avformat/matroskadec: Fix VfW extradata size
The structure is padded to an even length with an internal
size field to indicate the real size.
The matroska-matroska-display-metadata test (writing FFV1
in VFW mode) was affected by this.
It should also fix ticket #11613.

Reviewed-by: compn <ff@hawaiiantel.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 92e310eb82)
2025-06-07 09:28:34 +02:00
Pavel Koshevoy
24de8a98cf avformat/mpegts: update stream info when PMT ES stream_type changes
I have several .ts captures where video and audio codec changes even
though the PMT version does not change and the PIDs stay the same.
This happens during transition to/from slate (mpeg2 video and audio)
to network broadcast (hevc video and eac3 audio in private PES).

I've updated fate ts-demux expected results.
2025-05-18 11:26:56 -06:00
Marton Balint
59576ad4c5 avformat/wavdec: increase requested probe score for codec probe
Codec probing was primarily added to the wav demuxer to support DTS-in-wav
files, but DTS probing functions return AVPROBE_SCORE_EXTENSION+1, so we can be
a bit more strict with the required score.

This fixes MP3 misdetections for some wav files.

Fixes ticket #11581.

Signed-off-by: Marton Balint <cus@passwd.hu>
(cherry picked from commit ce01c7fb58)
2025-05-17 21:44:12 +02:00
Zhao Zhili
4991c1ec92 avformat/hls: Fix get key file error
The offset and end_offset options are meant for segment, not for key.

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit bb0c4649fb)
2025-05-12 14:28:09 +08:00
Zhao Zhili
9237125e51 avformat/mov: Reduce seek when interleaved_read is disabled
Don't select sample with small dts when interleaved_read is disabled.

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit ca964ba139)
2025-05-12 11:49:32 +08:00
softworkz
a8a3fc84af avformat/hls: Partially revert "reduce default max reload to 3"
(setting to 100 as a reasonable compromise)

The change has caused regressions for many users and consumers.
Playlist reloads only happen when a playlist doesn't indicate that it
has ended (via #EXT-X-ENDLIST), which means that the addition of future
segments is still expected.
It is well possible that an HLS server is temporarily unable to serve
further segments but resumes after some time, either indicating a
discontinuity or even by fully catching up.
With a segment length of 3s, a max_reload value of 1000 corresponds to
a duration of 50 minutes which appears to be a reasonable default.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ace9f03a6c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-03-02 16:28:23 +01:00
Pavel Koshevoy
71889a8437 avformat/mov: (v4) fix get_eia608_packet
The problem is reproducible with "Test for Quicktime 608 CC file.mov"
from https://samples.ffmpeg.org/MPEG2/subcc/

ffmpeg -i "Test for Quicktime 608 CC file.mov" -map 0 -c copy -y remuxed.mov

See https://trac.ffmpeg.org/ticket/11470
2025-02-26 16:02:09 -07:00
Michael Niedermayer
d392931391 avformat/iff: Check that we have a stream in read_dst_frame()
Fixes: null pointer dereference
Fixes: 385644864/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-4551049565765632

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross <pross@xvid.org>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8668957ef6)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-26 01:26:34 +01:00
Michael Niedermayer
2e7364727c avformat/mlvdec: fix size checks
Fixes: heap-buffer-overflow
Fixes: 391962476/clusterfuzz-testcase-minimized-ffmpeg_dem_MLV_fuzzer-5746746587676672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 251d43aef0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-02-26 01:26:32 +01:00