summaryrefslogtreecommitdiff
path: root/src/demuxers
AgeCommit message (Collapse)Author
2009-01-04Fix for CVE-2008-5243.Matthias Hopf
The real_parse_headers function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input length value to "reindex into an allocated buffer," which allows remote attackers to cause a denial of service (crash) via a crafted value, probably an array index error.
2009-01-04Fix for CVE-2008-5240Matthias Hopf
xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the memory allocation and does not check the result for (1) the MATROSKA_ID_TR_CODECPRIVATE track entry element processed by demux_matroska.c; and (2) PROP_TAG, (3) MDPR_TAG, and (4) CONT_TAG chunks processed by the real_parse_headers function in demux_real.c; which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) or possibly execute arbitrary code via a crafted value.
2009-01-04Fix for CVE-2008-5237Matthias Hopf
Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) crafted width and height values that are not validated by the mymng_process_header function in demux_mng.c before use in an allocation calculation or (2) crafted current_atom_size and string_size values processed by the parse_reference_atom function in demux_qt.c.
2009-01-04Fix for CVE-2008-5236.Matthias Hopf
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted EBML element length processed by the parse_block_group function in demux_matroska.c; (2) a certain combination of sps, w, and h values processed by the real_parse_audio_specific_data and demux_real_send_chunk functions in demux_real.c; and (3) an unspecified combination of three values processed by the open_ra_file function in demux_realaudio.c. NOTE: vector 2 reportedly exists because of an incomplete fix in 1.1.15.
2009-01-04Fix for CVE-2008-5234.Matthias Hopf
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c. NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15. case ( FOURCC_TAG('C', 'O', 'M', 'M') ): _x_meta_info_set_generic(stream, XINE_META_INFO_COMMENT, buf + 1 + 3, id3_encoding[enc]);
2008-09-17Mingw+MSys: NLS support, --enable-stdcall-fixupCarlo Bramini
It was not possible to compile some parts of XINE-LIB with NLS enabled. It's also a good idea to explicitely enable --enable-stdcall-fixup for solving a huge amount of warnings. Attached patch fixes these problems.
2008-12-26Don't store immediately-discarded input read() resultsThomas Viehmann
2008-11-22Add position-based seeking independent from seekpoints.Lorenzo Desole
When it comes to FLAC audio files, seeking relies on seekpoints which are not always present, and even when they are, sometimes it fails. Also, as far as I can see, xine is unable to play a FLAC stream starting at an arbitrary position. Other players (namely mplayer) do not rely on seekpoints when they handle FLAC files and they don't suffer from these problems. With this patch, time-based seeking doesn't change, while position-based seeking is completely independent from seekpoints.
2008-11-20Memory access fixes:František Dvořák
- goom initialization - matroska playing recent files with AAC - replace free() by ffmpeg's av_free() in ff decoders
2008-11-20Some warning fixes: XINE_FORMAT_SCANF, statics in headers, consts, ...František Dvořák
Add warning flags to the DEBUG_CFLAGS too.
2008-11-09Matroska and FLI demuxers warning and valgrind fixesFrantisek Dvorak
2008-11-07Fix resuming video after corrupted pes.Christophe Thommeret
Without this patch, the video freezes. Available corrupted sample: http://hftom.free.fr/video_samples/corrupted_video.m2t --HG-- extra : transplant_source : %86g%9A%B1%AF%12L%7E%3EN%8C%0FT%D2%D8%3B%7Dv%F0%14
2008-11-07Composer meta-tagMaximilian Schwerin
Date: Sat, 28 Jun 2008 17:29:59 +0200 This patch adds this to the FLAC demuxer.
2008-09-03Adding ID3 tag TDRC to replace/complement the deprecated tag TYER.Maximilian Schwerin
2008-09-05Updated FLV demuxer.Claudio Ciccani
- Added support for new formats introduced by Adobe's Video File Format Specification v9 (including H264 and AAC). - Fixed a problem with seeking when movie length is not specified in the headers.
2008-05-28Fix exploitable heap buffer overflow in id3.c.Diego 'Flameeyes' Pettenò
For more information see xine bug #114.
2008-08-13Check for possible buffer overflow attempts in the Real demuxer.Darren Salt
2008-08-13Check for allocation failures.Darren Salt
2008-08-13Use size_t for data length variables.Darren Salt
2008-08-08Fix crash with corrupted WMV files when checking for aspect ratio information.Darren Salt
--HG-- extra : transplant_source : kW%D0IN%9D%8D%D4l%F6%3C%D0%CF%9CT%A9%B2%7D%9E%E9
2008-08-08Fix crash with corrupted AVI files (chunk size).Darren Salt
--HG-- extra : transplant_source : Z%F0%90e%A3%94%D3%7F%D9ROC8%3C%FD%F5FO%BFU
2008-08-07Merge.Darren Salt
2008-08-07Fix a segfault introduced in the Windows Media crash fix.Darren Salt
2008-08-07Fix crashes with fuzzed Ogg files. (CVE-2008-3231)Darren Salt
--HG-- extra : transplant_source : %9F%E8R%D8%94R%9CJ%7F%5E%A7%DB%29%0DK%CD%CA%AD%7F%08
2008-08-06Fix crashes with fuzzed Windows Media files.Darren Salt
--HG-- extra : transplant_source : %92%2C%CB%01S%25N%22%E1%00%FB%19%B0%CE5%1BU%F9%F6%0A
2008-07-12Merge.Darren Salt
2008-07-12Fix a logic error which can cause misidentification as DV.Darren Salt
2008-07-08Rename flag so that NOFILE won't be redefining a system constant.Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : %5B%DAd%7EO%08%09I%B0%95%9B%EDg-%60%CB%252%84%F2
2008-07-07include <malloc.h> if defined to get prototype for alloca() on mingw32mringwal@Macintosh.local
for some unknown reason, alloca is defined in <malloc.h> on mingw32.
2008-07-04Simplify switch_buf return values.Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : v%FE%E4L9%A7x%2B%F41%2B%12P%06%A8%12%DC%ED%3A%84
2008-07-04Cleanup code style, use memmem() to find the start of a frame.Diego 'Flameeyes' Pettenò
Cleanup the code to follow the new code style, and in particuar use memmem() to identify the start of a frame rather than trying to look for it manually byte by byte. --HG-- extra : transplant_source : H%E8-%9D%AA%3A%40%FE%E6%ACE%F0%11G%BA%C6%FA%C4w%96
2008-07-04Use memcmp() instead of manual comparison of bytes when checking signatures.Diego 'Flameeyes' Pettenò
When it make sense, use _x_is_fourcc() too. --HG-- extra : transplant_source : %A7%AA%1D%B1%EE3%BF%2C%BCn%2B%3Dt%2Bi%E6%80%8ERm
2008-07-04Use id3.h functions to check for ID3 tags.Diego 'Flameeyes' Pettenò
Rather than checking for the ID3 signature manually use id3_istag() function. Also use the _X_BE_32_synchsafe function rather than re-implementing it again. Use memcmp() to look for MPC signature. --HG-- extra : transplant_source : %3A%8CE%9B%B6%BC%CBm%DA%A4%26M%A0%CC%C5OV%1C%93%01
2008-07-04Improve header processing and misc cleanups.Diego 'Flameeyes' Pettenò
When processing the header, read the whole 12-bytes block at once, then use _x_is_fourcc() to check for the signatures, and only then try to find the size. --HG-- extra : transplant_source : %B8%90%00%DAJ%7F%3F%E4%00%05%07z%3D%C5%02%03v%A8%B4C
2008-07-04Use the new _x_is_fourcc() function and also memcmp().Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : %F8H%5B%D0%15z%0E%22%CC.%84%E6%ADA/%FF%0F%81%BCS
2008-07-04Cleanup code style and use the new _x_is_fourcc() function.Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : %CB%BE%C4%81%A4%F8%C9.%3E%3B%EFa%2A%3E%1E%5B%B4%B0%25t
2008-07-04Simplify signature checks, especially for OggFLAC files.Diego 'Flameeyes' Pettenò
Use memcmp over the signature rather than checking byte by byte. --HG-- extra : transplant_source : %B3%8B%EE%85%B9%11%B0%10po%D9%17%CD%034%FC%F5%90%95%92
2008-07-04Use the new _x_is_fourcc() funtion to check for FOURCC tags in files.Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : %B5%96xd%99U%EC%7Cr%ABB%A8%26l%08%99L3o%F6
2008-07-03Rewrite demux_real and demux_realaudio for style.Diego 'Flameeyes' Pettenò
Also try to simplify frame buffer allocation. --HG-- extra : transplant_source : %B6%B5o%A8%24%E1%F5B%D2%D8%08%F8%DE%E7%9E%B6%B8C%A4j
2008-06-27Add basic aspect ratio detection for WMV streams.Darren Salt
2008-06-25Merge, and add a changelog entry.Darren Salt
2008-06-25Add comments about (audio track)->type containing the stream no.Darren Salt
2008-06-25Backed out changeset f2086511a349; m->type isn't necessarily 0.Darren Salt
2008-06-05demux_ts: don't OR in buffer types.Darren Salt
2008-05-25Recognise TS descriptor tag 0x80 as MPEG video.Darren Salt
2008-05-25Wherever possible, use enum constants for TS descriptor tags.Darren Salt
2008-05-23Remove MIN/MAX macro definitions on unit.Diego 'Flameeyes' Pettenò
Now that the macro are either imported from the system or defined by configure. don't define them in every source file.
2008-05-23Mark initialisation functions with malloc attribute.Diego 'Flameeyes' Pettenò
All the initialisation functions returning a new object instance that was allocated through malloc() or calloc() can get the malloc attribute so that the compiler can optimise their call.
2008-05-09Avoid 1KB buffer for decoding anxdata headers.Diego 'Flameeyes' Pettenò
Instead of using a 1KB buffer to copy over the Content-Type header value to compare it, get a (pointer, length) pair and use that for comparison. This should also allow the compiler to inline the decode_anxdata_header() function. --HG-- extra : transplant_source : W%EE%5CN%BD%B8%8C%FA%CD%15p%CD%A5%CBQ%1E%893%97S
2008-05-09Don't use t_title array after it got out of the scope.Diego 'Flameeyes' Pettenò
In update_chapter_display() the t_title array, declared on the buffer, is used after it has disappeared from the scope. Instead of doing that, use directly the xine_ui_data_t array. Declare xine_event_t and xine_ui_data_t with their values directly, makes it more explicit that everything disappears at the end of the function. --HG-- extra : transplant_source : %25T%10eEd%CF%ECS%AC%A3%E3%E0%D3J%F6%A5%15%9EE
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-06 20:27:29 +0000