Other cases are not supported and lead to inconsistencies which
can lead to out of array writes.
Reported-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This replaces the matroskadec one with the same name.
The advantage is not only easier reuse in other demuxers
but also that we can make the decisions after the parser.
This fixes seeking in files that mark the keyframes incorrectly,
for example the file in track ticket #1003.
The matroska variable is still kept to be able to complain
about such broken files.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
The new values lead to error messages when used
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Instead of allocating over the original, free first. MOVStreamContext
is zero initialized so no double free will occur. Same style as other
fixes for the same problem in this file.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
0-sized packets are used to implement variable fps.
However there seems to be a variation where these are not
even stored in the main file but as 0-size index entries
only.
This fixes the sample in trac issue #957, it now plays both
the same ways as in MPlayer and in a way that looks correct.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
They will only cause us to skip writing the Xing header,
not cause any serious breakage.
Related to trac issue #1027.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Its bad to free things without zeroing them.
This fixes a potential issue when mov_read_close() would be called twice.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
If mov_read_header exits under error, the memory allocated is
not freed.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
During error conditions matroska_parse_block may exit without
freeing the memory allocated for laces.
Found via valgrind: http://pastebin.com/E54k8QFU
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Convert key_off initialize to use the same sc->keyframe_count as
used elsewhere in the function.
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
During error conditions matroska_parse_block may exit without
freeing the memory allocated for laces.
Found via valgrind: http://pastebin.com/E54k8QFU
Signed-off-by: Dale Curtis <dalecurtis@chromium.org>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
Fixes potential out-of-bounds writes.
This is mostly possible when muxing ALS files where from
an extradata size of about 1050 put_bits would write data
outside the buffer.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
For the FATE test sample used, this only avoids a warning
message.
However for other samples like al05_44.mp4 the converted
file can be played only after this fix.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
This will only work for DSEs that are first in a packet, but
that is enough to fix handling of the reference files in
fate-suite/aac (though most of them still have other issues).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Otherwise for muxers like e.g. latmenc that never call
avio_flush (and do not have a write_trailer function)
a part of the data will always be missing.
Also update references for the voc muxer, which was also
buggy before and did not write out all data.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Previously it would just silently write out incorrect data.
This also fixes a potential integer overflow in the allocation.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
"Fix" in so far as at least it will no longer overread and possibly
crash and makes somewhat sense, but no idea whether there is anything
that can play the resulting files (FFmpeg can't).
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Share the formerly internal write_packet with the hinter and move the
fragment flush logic to the user facing one since it is not concerned
about movtrack-only streams.
Fixes bug #263
Signed-off-by: Martin Storsjö <martin@martin.st>
Michael Niedermayer
Nicolas George
Reimar Döffinger
Dale Curtis
Yusuke Nakamura
Luca Barbato
Alex Converse
Diego Biurrun
Asen Lekov
Martin Storsjö