summaryrefslogtreecommitdiff
path: root/src/demuxers
AgeCommit message (Collapse)Author
2008-12-31handle read errors/insufficient data when forwarding asf dataMatthias Hopf
do not forward data if there is not enough
2009-01-01check for buffers smaller than headers in real demuxerThomas Viehmann
check buffer lengths to avoid out of bound access when decoding the header. Based on a patch by Matthias Hopf <mhopf@suse.de>.
2009-01-01Avoid underflow in input size calculation for compressed atomsMatthias Hopf
if the atom size is shorter than the header size, do not try to decompress anything, as this would lead to zlib reading out of bound data.
2008-12-31check size before accessing memory in matroska decodingMatthias Hopf
check the size of allocated buffers to prevent out of bound access
2009-01-01check return value of input->read_block for NULL in yuv_frames demuxingThomas Viehmann
Based on a patch by Matthias Hopf <mhopf@suse.de>.
2008-12-31check return value of input->read_block for NULL in mpeg demuxingMatthias Hopf
2008-12-31abort if buffer for matroska block data cannot be allocatedMatthias Hopf
return error when the allocation function returns NULL Otherwise xine might be induced to segfault by bad user data.
2008-12-31handle read errors when demuxing mpeg dataMatthias Hopf
Some input plugins (e.g. file) return negative error codes from read, this should be treated as no (more) data available.
2009-01-01check for negative/too large return values of get_size when demuxing mod streamsThomas Viehmann
get_size might return -1 (e.g. for streams whose size is unknown), but demux_mod is not able to handle this. This is particularly bad because it is later assigned to unsigned types (demux_mod_t.filesize is size_t). Based on a patch by Matthias Hopf <mhopf@suse.de>.
2008-12-31check for negative return values of read when demuxing mng streamsThomas Viehmann
Some input plugins (e.g. file) return negative error codes from read, this should be treated as no (more) data available. This is particularly bad because the error code is assigned to an unsigned integer variable for use by the caller. Based on a patch by Matthias Hopf <mhopf@suse.de>
2008-12-31check that track's codec_private_len fits in signed variables when decoding ↵Matthias Hopf
matroska while codec_private_len is unsigned, the size is later used to calculate the signed xine_bmiheader.size
2008-12-31handle read errors when forwarding in multiple demuxersMatthias Hopf
Add checks for negative return values in aac,ac3,dts,mpc, nsf,ogg,shn,slave,ts,tta,vox demuxers. Some input plugins (e.g. file) return negative error codes from read, this should be treated as no (more) data available. This is particularly the negative size is then assigned to buf->size, potentially causing overflows elsewhere. The patch also removes the duplication of the (previously) == 0 handler in demux_ac3.
2009-01-04fail to set up codec when fifo is not set upThomas Viehmann
When a track's fifo is not set up (typically because the track type is invalid), do not call init_codec, as all implementations dereference track->fifo, segfaulting if it is NULL.
2009-01-04Fix for CVE-2008-5243.Matthias Hopf
The real_parse_headers function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input length value to "reindex into an allocated buffer," which allows remote attackers to cause a denial of service (crash) via a crafted value, probably an array index error.
2009-01-04Fix for CVE-2008-5240Matthias Hopf
xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the memory allocation and does not check the result for (1) the MATROSKA_ID_TR_CODECPRIVATE track entry element processed by demux_matroska.c; and (2) PROP_TAG, (3) MDPR_TAG, and (4) CONT_TAG chunks processed by the real_parse_headers function in demux_real.c; which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) or possibly execute arbitrary code via a crafted value.
2009-01-04Fix for CVE-2008-5237Matthias Hopf
Multiple integer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) crafted width and height values that are not validated by the mymng_process_header function in demux_mng.c before use in an allocation calculation or (2) crafted current_atom_size and string_size values processed by the parse_reference_atom function in demux_qt.c.
2009-01-04Fix for CVE-2008-5236.Matthias Hopf
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted EBML element length processed by the parse_block_group function in demux_matroska.c; (2) a certain combination of sps, w, and h values processed by the real_parse_audio_specific_data and demux_real_send_chunk functions in demux_real.c; and (3) an unspecified combination of three values processed by the open_ra_file function in demux_realaudio.c. NOTE: vector 2 reportedly exists because of an incomplete fix in 1.1.15.
2009-01-04Fix for CVE-2008-5234.Matthias Hopf
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c. NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15. case ( FOURCC_TAG('C', 'O', 'M', 'M') ): _x_meta_info_set_generic(stream, XINE_META_INFO_COMMENT, buf + 1 + 3, id3_encoding[enc]);
2008-05-28Fix exploitable heap buffer overflow in id3.c.Diego 'Flameeyes' Pettenò
For more information see xine bug #114.
2008-08-13Check for possible buffer overflow attempts in the Real demuxer.Darren Salt
2008-08-13Check for allocation failures.Darren Salt
2008-08-13Use size_t for data length variables.Darren Salt
2008-08-08Fix crash with corrupted WMV files when checking for aspect ratio information.Darren Salt
--HG-- extra : transplant_source : kW%D0IN%9D%8D%D4l%F6%3C%D0%CF%9CT%A9%B2%7D%9E%E9
2008-08-08Fix crash with corrupted AVI files (chunk size).Darren Salt
--HG-- extra : transplant_source : Z%F0%90e%A3%94%D3%7F%D9ROC8%3C%FD%F5FO%BFU
2008-08-07Merge.Darren Salt
2008-08-07Fix a segfault introduced in the Windows Media crash fix.Darren Salt
2008-08-07Fix crashes with fuzzed Ogg files. (CVE-2008-3231)Darren Salt
--HG-- extra : transplant_source : %9F%E8R%D8%94R%9CJ%7F%5E%A7%DB%29%0DK%CD%CA%AD%7F%08
2008-08-06Fix crashes with fuzzed Windows Media files.Darren Salt
--HG-- extra : transplant_source : %92%2C%CB%01S%25N%22%E1%00%FB%19%B0%CE5%1BU%F9%F6%0A
2008-07-12Merge.Darren Salt
2008-07-12Fix a logic error which can cause misidentification as DV.Darren Salt
2008-07-08Rename flag so that NOFILE won't be redefining a system constant.Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : %5B%DAd%7EO%08%09I%B0%95%9B%EDg-%60%CB%252%84%F2
2008-07-07include <malloc.h> if defined to get prototype for alloca() on mingw32mringwal@Macintosh.local
for some unknown reason, alloca is defined in <malloc.h> on mingw32.
2008-07-04Simplify switch_buf return values.Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : v%FE%E4L9%A7x%2B%F41%2B%12P%06%A8%12%DC%ED%3A%84
2008-07-04Cleanup code style, use memmem() to find the start of a frame.Diego 'Flameeyes' Pettenò
Cleanup the code to follow the new code style, and in particuar use memmem() to identify the start of a frame rather than trying to look for it manually byte by byte. --HG-- extra : transplant_source : H%E8-%9D%AA%3A%40%FE%E6%ACE%F0%11G%BA%C6%FA%C4w%96
2008-07-04Use memcmp() instead of manual comparison of bytes when checking signatures.Diego 'Flameeyes' Pettenò
When it make sense, use _x_is_fourcc() too. --HG-- extra : transplant_source : %A7%AA%1D%B1%EE3%BF%2C%BCn%2B%3Dt%2Bi%E6%80%8ERm
2008-07-04Use id3.h functions to check for ID3 tags.Diego 'Flameeyes' Pettenò
Rather than checking for the ID3 signature manually use id3_istag() function. Also use the _X_BE_32_synchsafe function rather than re-implementing it again. Use memcmp() to look for MPC signature. --HG-- extra : transplant_source : %3A%8CE%9B%B6%BC%CBm%DA%A4%26M%A0%CC%C5OV%1C%93%01
2008-07-04Improve header processing and misc cleanups.Diego 'Flameeyes' Pettenò
When processing the header, read the whole 12-bytes block at once, then use _x_is_fourcc() to check for the signatures, and only then try to find the size. --HG-- extra : transplant_source : %B8%90%00%DAJ%7F%3F%E4%00%05%07z%3D%C5%02%03v%A8%B4C
2008-07-04Use the new _x_is_fourcc() function and also memcmp().Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : %F8H%5B%D0%15z%0E%22%CC.%84%E6%ADA/%FF%0F%81%BCS
2008-07-04Cleanup code style and use the new _x_is_fourcc() function.Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : %CB%BE%C4%81%A4%F8%C9.%3E%3B%EFa%2A%3E%1E%5B%B4%B0%25t
2008-07-04Simplify signature checks, especially for OggFLAC files.Diego 'Flameeyes' Pettenò
Use memcmp over the signature rather than checking byte by byte. --HG-- extra : transplant_source : %B3%8B%EE%85%B9%11%B0%10po%D9%17%CD%034%FC%F5%90%95%92
2008-07-04Use the new _x_is_fourcc() funtion to check for FOURCC tags in files.Diego 'Flameeyes' Pettenò
--HG-- extra : transplant_source : %B5%96xd%99U%EC%7Cr%ABB%A8%26l%08%99L3o%F6
2008-07-03Rewrite demux_real and demux_realaudio for style.Diego 'Flameeyes' Pettenò
Also try to simplify frame buffer allocation. --HG-- extra : transplant_source : %B6%B5o%A8%24%E1%F5B%D2%D8%08%F8%DE%E7%9E%B6%B8C%A4j
2008-06-27Add basic aspect ratio detection for WMV streams.Darren Salt
2008-06-25Merge, and add a changelog entry.Darren Salt
2008-06-25Add comments about (audio track)->type containing the stream no.Darren Salt
2008-06-25Backed out changeset f2086511a349; m->type isn't necessarily 0.Darren Salt
2008-06-05demux_ts: don't OR in buffer types.Darren Salt
2008-05-25Recognise TS descriptor tag 0x80 as MPEG video.Darren Salt
2008-05-25Wherever possible, use enum constants for TS descriptor tags.Darren Salt
2008-05-23Remove MIN/MAX macro definitions on unit.Diego 'Flameeyes' Pettenò
Now that the macro are either imported from the system or defined by configure. don't define them in every source file.
generated by cgit v1.2.3 (git 2.25.1) at 2025-11-13 05:28:09 +0000