Merge remote-tracking branch 'cigaes/master'

* cigaes/master:
  lavu/frame: use channels rather than channel_layout.
  lavf: avformat_seek_file(): validate stream_index.
  lavf/concatdec: fix possible leak in case of malloc failure.
  lavfi/buffersink: check av_frame_ref() failure.

Merged-by: Michael Niedermayer <michaelni@gmx.at>

libavfilter/buffersink.c

@@ -137,7 +137,8 @@ int attribute_align_arg av_buffersink_get_frame_flags(AVFilterContext *ctx, AVFr
 
     if (flags & AV_BUFFERSINK_FLAG_PEEK) {
         cur_frame = *((AVFrame **)av_fifo_peek2(buf->fifo, 0));
-        av_frame_ref(frame, cur_frame); /* TODO check failure */
+        if ((ret = av_frame_ref(frame, cur_frame)) < 0)
+            return ret;
     } else {
         av_fifo_generic_read(buf->fifo, &cur_frame, sizeof(cur_frame), NULL);
         av_frame_move_ref(frame, cur_frame);

libavformat/concatdec.c

@@ -82,25 +82,26 @@ static int add_file(AVFormatContext *avf, char *filename, ConcatFile **rfile,
 {
     ConcatContext *cat = avf->priv_data;
     ConcatFile *file;
-    char *url;
+    char *url = NULL;
     size_t url_len;
+    int ret;
 
     if (cat->safe > 0 && !safe_filename(filename)) {
         av_log(avf, AV_LOG_ERROR, "Unsafe file name '%s'\n", filename);
-        return AVERROR(EPERM);
+        FAIL(AVERROR(EPERM));
     }
     url_len = strlen(avf->filename) + strlen(filename) + 16;
     if (!(url = av_malloc(url_len)))
-        return AVERROR(ENOMEM);
+        FAIL(AVERROR(ENOMEM));
     ff_make_absolute_url(url, url_len, avf->filename, filename);
-    av_free(filename);
+    av_freep(&filename);
 
     if (cat->nb_files >= *nb_files_alloc) {
         size_t n = FFMAX(*nb_files_alloc * 2, 16);
         ConcatFile *new_files;
         if (n <= cat->nb_files || n > SIZE_MAX / sizeof(*cat->files) ||
             !(new_files = av_realloc(cat->files, n * sizeof(*cat->files))))
-            return AVERROR(ENOMEM);
+            FAIL(AVERROR(ENOMEM));
         cat->files = new_files;
         *nb_files_alloc = n;
     }
@@ -114,6 +115,11 @@ static int add_file(AVFormatContext *avf, char *filename, ConcatFile **rfile,
     file->duration   = AV_NOPTS_VALUE;
 
     return 0;
+
+fail:
+    av_free(url);
+    av_free(filename);
+    return ret;
 }
 
 static int open_file(AVFormatContext *avf, unsigned fileno)

libavformat/utils.c

@@ -2137,6 +2137,8 @@ int avformat_seek_file(AVFormatContext *s, int stream_index, int64_t min_ts, int
 {
     if(min_ts > ts || max_ts < ts)
         return -1;
+    if (stream_index < -1 || stream_index >= (int)s->nb_streams)
+        return AVERROR(EINVAL);
 
     if(s->seek2any>0)
         flags |= AVSEEK_FLAG_ANY;

libavutil/frame.c

@@ -18,6 +18,7 @@
  */
 
 #include "channel_layout.h"
+#include "avassert.h"
 #include "buffer.h"
 #include "common.h"
 #include "dict.h"
@@ -40,6 +41,11 @@ MAKE_ACCESSORS(AVFrame, frame, AVDictionary *, metadata)
 MAKE_ACCESSORS(AVFrame, frame, int,     decode_error_flags)
 MAKE_ACCESSORS(AVFrame, frame, int,     pkt_size)
 
+#define CHECK_CHANNELS_CONSISTENCY(frame) \
+    av_assert2(!(frame)->channel_layout || \
+               (frame)->channels == \
+               av_get_channel_layout_nb_channels((frame)->channel_layout))
+
 AVDictionary **avpriv_frame_get_metadatap(AVFrame *frame) {return &frame->metadata;};
 
 int av_frame_set_qp_table(AVFrame *f, AVBufferRef *buf, int stride, int qp_type)
@@ -158,11 +164,12 @@ fail:
 
 static int get_audio_buffer(AVFrame *frame, int align)
 {
-    int channels = av_get_channel_layout_nb_channels(frame->channel_layout);
+    int channels = frame->channels;
     int planar   = av_sample_fmt_is_planar(frame->format);
     int planes   = planar ? channels : 1;
     int ret, i;
 
+    CHECK_CHANNELS_CONSISTENCY(frame);
     if (!frame->linesize[0]) {
         ret = av_samples_get_buffer_size(&frame->linesize[0], channels,
                                          frame->nb_samples, frame->format,
@@ -240,7 +247,8 @@ int av_frame_ref(AVFrame *dst, AVFrame *src)
             return ret;
 
         if (src->nb_samples) {
-            int ch = av_get_channel_layout_nb_channels(src->channel_layout);
+            int ch = src->channels;
+            CHECK_CHANNELS_CONSISTENCY(src);
             av_samples_copy(dst->extended_data, src->extended_data, 0, 0,
                             dst->nb_samples, ch, dst->format);
         } else {
@@ -279,12 +287,13 @@ int av_frame_ref(AVFrame *dst, AVFrame *src)
 
     /* duplicate extended data */
     if (src->extended_data != src->data) {
-        int ch = av_get_channel_layout_nb_channels(src->channel_layout);
+        int ch = src->channels;
 
         if (!ch) {
             ret = AVERROR(EINVAL);
             goto fail;
         }
+        CHECK_CHANNELS_CONSISTENCY(src);
 
         dst->extended_data = av_malloc(sizeof(*dst->extended_data) * ch);
         if (!dst->extended_data) {
@@ -388,7 +397,8 @@ int av_frame_make_writable(AVFrame *frame)
         return ret;
 
     if (tmp.nb_samples) {
-        int ch = av_get_channel_layout_nb_channels(tmp.channel_layout);
+        int ch = tmp.channels;
+        CHECK_CHANNELS_CONSISTENCY(&tmp);
         av_samples_copy(tmp.extended_data, frame->extended_data, 0, 0,
                         frame->nb_samples, ch, frame->format);
     } else {
@@ -478,9 +488,10 @@ AVBufferRef *av_frame_get_plane_buffer(AVFrame *frame, int plane)
     int planes, i;
 
     if (frame->nb_samples) {
-        int channels = av_get_channel_layout_nb_channels(frame->channel_layout);
+        int channels = frame->channels;
         if (!channels)
             return NULL;
+        CHECK_CHANNELS_CONSISTENCY(frame);
         planes = av_sample_fmt_is_planar(frame->format) ? channels : 1;
     } else
         planes = 4;