The "pts for a given stream" was nonsensical.

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>

This reduces code size when either piece has been disabled.

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

This makes it easier for receivers to decide what to do if data
is lost.

Refactor calculating the max payload size, to avoid hardcoding the
header size in too many places, reducing the number of lines that
have to be touched if the header is adjusted further.

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

The previous comment about the buffer was wildly inaccurate and
misleading.

Signed-off-by: Martin Storsjö <martin@martin.st>

These stem from back when both the rtp muxer and rtp depacketizing
shared the same struct.

Signed-off-by: Martin Storsjö <martin@martin.st>

This fixes potential buffer overwrites.

Signed-off-by: Martin Storsjö <martin@martin.st>

Avoids trying to read a packet with 0 or negative size.
Avoids a potential infinite loop due to seeking backwards.

Partially based on a patch by Michael Niedermayer.

This comment was added in e309128f, in 2002, and has been brought
along since then more or less unmodified.

The first point of the todo was implemented in dbf30963 in 2006,
the second one is not relevant to rtpdec.c (brought along from
rtp.c in 8eb793c4 in 2008) but would be more relevant to the
rtp muxer, although it isn't a good idea anyway.

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Martin Storsjö <martin@martin.st>

Signed-off-by: Diego Biurrun <diego@biurrun.de>

The values compared here can be more than INT64_MAX apart.  Since the
difference is always positive, converting to uint64_t before subtracting
gives the correct result without overflows.

Signed-off-by: Mans Rullgard <mans@mansr.com>

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

Also remove a duplicate function in the MPEG-TS demuxer.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

Avoids a 2G memory allocation and parsing of random data in
mov_read_dref(). The fuzzed sample sample.mp4_s224424 triggers this.

Fixes an assert in fuzzed sample sample.mp4_s265930.

They share the same code, so building one w/o the other makes no sense.

Also introduce local img_ namespace to simplify debugging.

Also make sure extradata is freed in the case where multiple
NUV_EXTRADATA frame types are found. This may not happen in practice,
but it could happen in a malformed stream, which would lead to a memleak
if not handled.

Original commit, 7b24f9b, says it was added because it is used in libnut.

Fixes curruption of metadata in the INFO chunk.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

fixes Bug 392

Scaling the denominator instead of the numerator if it is too large
loses precision. Fixes an assert caused by a negative frame duration in
the fuzzed sample nasa-8s2.ts_s202310.

CC: libav-stable@libav.org

Signed-off-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>

The table is not used outside the file.

Current code would incorrectly process e.g. 'ff 00 ff 00 ff' to
'ff ff ff', while it should be 'ff ff 00 ff'.

Fixes Bug 395.

CC: libav-stable@libav.org

The following error handling is broken due to signedness.

    int file_size;
    uint32_t tag_bytes;
    int64_t tag_start;
    ...
    tag_start = file_size - tag_bytes - APE_TAG_FOOTER_BYTES;
    if (tag_start < 0) { ... }

Note that tag_bytes is unsigned, which makes the right-hand side of
`tag_start = ...' unsigned, too.  The 32-bit unsigned value is then
zero-extended to 64 bits.  Therefore, tag_start must be non-negative,
and the check (tag_start < 0) is always false, which breaks the error
handling.  This patch fixes the check.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Check the number of index tables before using byte offset based seeking
instead of the index_tables pointer.

Found by Måns Rullgård <mans@mansr.com>.