Chiebot-Mirror/FFmpeg - FFmpeg - Gitea: Git with a cup of tea

Author	SHA1	Message	Date
Andreas Rheinhardt	822be43849	avformat/aaxdec: Simplify cleanup after read_header failure by setting the FF_FMT_INIT_CLEANUP flag. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>	4 years ago
Michael Niedermayer	602bbf71f6	avformat/aaxdec: Check avio_seek() in header reading Fixes: Timeout Fixes: 32450/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-4875522262827008 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	4 years ago
Andreas Rheinhardt	bc70684e74	avformat: Constify all muxer/demuxers This is possible now that the next-API is gone. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> Signed-off-by: James Almer <jamrial@gmail.com>	4 years ago
Michael Niedermayer	4e7dbca74c	avformat/aaxdec: Check that segments table has been initialized Fixes: Timeout Fixes: 29766/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-5635887566290944 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	4 years ago
Michael Niedermayer	fcc263caa9	avformat/aaxdec: Check string before strcmp() Fixes: NULL ptr dereference Fixes: 26508/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-5694725249826816 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>	4 years ago
Andreas Rheinhardt	5b33f523d7	avformat/aaxdec: Fix potential integer overflow The AAX demuxer reads a 32bit number containing the amount of entries of an array and stores it in an uint32_t. Yet when iterating over this array, a loop counter of type int is used. This leads to undefined behaviour if the amount of entries is not in the range of int; to avoid this, it is generally good to use the same type for the loop counter as for the variable it is compared to. This is done in one of the two loops affected by this. In the other loop, the undefined behaviour can begin even earlier: Here the loop counter is multiplied by an uint16_t which can overflow as soon as the loop counter is > 2^15. Using an unsigned type would avoid the undefined behaviour, but truncation would still be possible, so use an uint64_t. Also use an uint32_t for a variable containing an index in said array. This fixes Coverity issue #1466767. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>	4 years ago
Paul B Mahol	92396cee60	avformat: add CRI AAX demuxer	4 years ago