Packman Build Service PMBS

avidemux3.changes Changed

avidemux3.spec Changed

avidemux2-2.8.2.git20260702.tar.xz/avidemux_core/ADM_coreUtils/include/ADM_videoInfoExtractor.h -> avidemux2-2.8.2.git20260718.tar.xz/avidemux_core/ADM_coreUtils/include/ADM_videoInfoExtractor.h Changed

avidemux2-2.8.2.git20260702.tar.xz/avidemux_core/ADM_coreUtils/src/ADM_infoExtractorH264.cpp -> avidemux2-2.8.2.git20260718.tar.xz/avidemux_core/ADM_coreUtils/src/ADM_infoExtractorH264.cpp Changed

@@ -36,6 +36,7 @@
 #include "ADM_videoInfoExtractor.h"
 #include "ADM_h264_tag.h"
 
+#include <climits>
 
 //#define ANNEX_B_DEBUG
 
@@ -64,7 +65,7 @@
                                     uint32_t *outLen, uint8_t *outData)
 {
     int p;
-    if(dataLen>200)
+    if(dataLen > MAX_H264_SPS_SIZE /* just for consistency, probably far too much, was 200 */)
     {
         ADM_warning("SPS TOO LONG\n");
         return false;
@@ -155,39 +156,42 @@
 */
 uint32_t ADM_unescapeH264 (uint32_t len, uint8_t * in, uint8_t * out)
 {
-  if (len < 3)
-    return 0;
-  uint8_t *offset = in;
-  uint8_t *firstOut=out;
-  uint32_t outlen = 0;
-  uint8_t *tail = in + len;
-  uint8_t *border=tail-3;
+    if (len < 3)
+        return 0;
 
-  while (in < border)
-  {
+    uint32_t outlen = 0;
+    uint8_t *offset = in;
+    uint8_t *end = offset + len;
+    uint8_t *border = end - 3;
+
+    while (in < border)
+    {
         if(in1) // cannot be 00 00 nor the next one
         {
-          in += 2;
-          continue;
+            in += 2;
+            continue;
         }
         if(!in0 && !in1 && in2 == 3)
         {
-          uint32_t copy = in - offset + 2;
-          memcpy(out, offset, copy);
-          out += copy;
-          in += 3;
-          offset = in;
-          continue;
+            uint32_t copy = in - offset + 2;
+            if (out)
+            {
+                memcpy(out, offset, copy);
+                out += copy;
+            }
+            in += 3;
+            offset = in;
+            outlen += copy;
+            continue;
         }
         in++;
-  }
-  outlen=(int)(out-firstOut);
-  // copy last bytes
-  uint32_t left = tail - offset;
-  memcpy (out, offset, left);
-  outlen += left;
-  return outlen;
-
+    }
+    // copy last bytes
+    uint32_t left = end - offset;
+    if (out)
+        memcpy (out, offset, left);
+    outlen += left;
+    return outlen;
 }
 /**
     \fn hrd
@@ -491,22 +495,32 @@
     ADM_H264_SEI_TYPE_RECOVERY_POINT = 2
 };
 
-static int getInfoFromSei(uint32_t nalSize, uint8_t *org, uint32_t *recoveryLength, uint32_t *unregistered)
+static int getInfoFromSei(uint32_t nalUnitSize, uint8_t *src, uint32_t *recoveryLength, uint32_t *unregistered)
 {
-    int originalNalSize=nalSize+16;
-    uint8_t *payloadBuffer=(uint8_t *)malloc(originalNalSize+AV_INPUT_BUFFER_PADDING_SIZE);
-    memset(payloadBuffer,0,originalNalSize+AV_INPUT_BUFFER_PADDING_SIZE);
-    uint8_t *payload=payloadBuffer;
-    int r=ADM_H264_SEI_TYPE_OTHER;
-    nalSize=ADM_unescapeH264(nalSize,org,payload);
-    if(nalSize>originalNalSize)
+    int r = ADM_H264_SEI_TYPE_OTHER;
+
+    // Sanity check
+    if (nalUnitSize > MAX_H264_SEI_SIZE)
     {
-        ADM_warning("NAL is way too big : %d, while we expected %d at most\n",nalSize,originalNalSize);
-        free(payloadBuffer);
+        seiprintf("Unplausibly large SEI NALU size %" PRIu32", max. supported: %" PRIu32"\n", nalUnitSize, MAX_H264_SEI_SIZE);
         return r;
     }
 
-    uint8_t *tail=payload+nalSize;
+    // Query the buffer size we need to allocate for given escaped bitstream
+    uint32_t rawBitstreamSize = ADM_unescapeH264(nalUnitSize, src, NULL);
+    ADM_assert(rawBitstreamSize <= UINT32_MAX - AV_INPUT_BUFFER_PADDING_SIZE);
+
+    uint8_t *payloadBuffer = (uint8_t *)malloc(rawBitstreamSize + AV_INPUT_BUFFER_PADDING_SIZE);
+    if (!payloadBuffer)
+        return r;
+
+    uint8_t *payload = payloadBuffer;
+    memset(payload + rawBitstreamSize, 0, AV_INPUT_BUFFER_PADDING_SIZE);
+
+    // Now unescape it for real
+    ADM_unescapeH264(nalUnitSize, src, payload);
+
+    uint8_t *tail = payload + rawBitstreamSize;
 
     while(payload+2<tail)
     {
@@ -562,6 +576,8 @@
                 {
                     ADM_info("Unregistered user data doesn't match the one expected for x264\n");
                     mixDump((uint8_t *)udata,sei_size);
+                    free(udata);
+                    udata = NULL;
                     break;
                 }
                 free(udata);
@@ -595,16 +611,21 @@
 }
 /**
     \fn getNalType
-    \brief Return the slice type. The stream is escaped by the function. If recovery==0
+    \brief Return the slice type for given escaped stream. If recovery==0
            or frame_num==0 I is considered IDR else as P.
 */
-static bool getNalType (uint8_t *head, uint8_t *tail, uint32_t *flags, ADM_SPSInfo *sps, int *poc_lsb, int recovery)
+static bool getNalType (uint8_t *src, uint32_t len, uint32_t *flags, ADM_SPSInfo *sps, int *poc_lsb, int recovery)
 {
-    if(tail<=head)
+    uint32_t size = ADM_unescapeH264(len, src, NULL);
+    if (size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE)
+        return false;
+
+    uint8_t *out = (uint8_t *)malloc(size + AV_INPUT_BUFFER_PADDING_SIZE);
+    if (!out)
         return false;
-    uint8_t *out=(uint8_t *)malloc(tail-head+AV_INPUT_BUFFER_PADDING_SIZE);
-    memset(out,0,tail-head+AV_INPUT_BUFFER_PADDING_SIZE);
-    int size=ADM_unescapeH264(tail-head,head,out);
+
+    memset(out + size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
+    ADM_unescapeH264(len, src, out);
 
     getBits bits(size,out);
     uint32_t sliceType;
@@ -721,7 +742,9 @@
         {
             case NAL_SEI:
                 {
-                    int sei=getInfoFromSei(length-1, head+1, &recovery, NULL);
+                    int sei = ADM_H264_SEI_TYPE_OTHER;
+                    if (length > 1)
+                        sei = getInfoFromSei(length-1, head+1, &recovery, NULL);
                     if(extRecovery)
                     {
                         if(sei & ADM_H264_SEI_TYPE_RECOVERY_POINT)
@@ -738,7 +761,7 @@
                 break;
             case NAL_IDR:
                 *flags = AVI_KEY_FRAME + AVI_IDR_FRAME;
-                if(!getNalType(head+1,head+length,flags,sps,&p,recovery))
+                if(!getNalType(head+1,length,flags,sps,&p,recovery))
                     return 0;
                 if(sps && !(*flags & AVI_IDR_FRAME))
                 {
@@ -750,7 +773,7 @@
                     *pocLsb=p;
                 return 1;
             case NAL_NON_IDR:
-                if(!getNalType(head+1,head+length,flags,sps,&p,recovery))
+                if(!getNalType(head+1,length,flags,sps,&p,recovery))
                     return 0;
                 if(!ref && (*flags & AVI_B_FRAME))
                     *flags |= AVI_NON_REF_FRAME;
@@ -834,7 +857,7 @@
             case NAL_SPS: case NAL_PPS: case NAL_FILLER: case NAL_AU_DELIMITER: break;
             case NAL_IDR:
                 *flags = AVI_KEY_FRAME + AVI_IDR_FRAME;
-                if(!getNalType(buffer, buffer+length, flags, sps, &p, recovery))
+                if(!getNalType(buffer, length, flags, sps, &p, recovery))
                     return 0;
                 if(sps && !(*flags & AVI_IDR_FRAME))
                 {
@@ -846,7 +869,7 @@
                     *pocLsb=p;
                 return 1;
             case NAL_NON_IDR:
-                if(!getNalType(buffer, buffer+length, flags, sps, &p, recovery))
+                if(!getNalType(buffer, length, flags, sps, &p, recovery))
                     return 0;
                 if(!ref && (*flags & AVI_B_FRAME))
                     *flags |= AVI_NON_REF_FRAME;
@@ -938,6 +961,9 @@
 {
     bool r=false;
 
+    if (len > MAX_H2645_SLICE_SIZE)
+        return r;
+
     // duplicate
     int myLen=len+AV_INPUT_BUFFER_PADDING_SIZE;
     uint8_t *myData=new uint8_tmyLen;
@@ -1158,6 +1184,12 @@
 */
 bool extractSPSInfoFromData(uint8_t *data, uint32_t length, ADM_SPSInfo *spsinfo)
 {
+    if (length > MAX_H264_SPS_SIZE)
+    {
+        ADM_warning("Data length %u exceeds max. supported.\n", length);
+        return false;
+    }
+
     uint32_t myExtraLen=length+8;
     uint8_t *myExtra=new uint8_tmyExtraLen;
     memset(myExtra,0,myExtraLen);
@@ -1195,7 +1227,7 @@
     ADM_info("converted SPS info\n");
 
     uint32_t converted;
-    uint8_t buffer256;
+    uint8_t bufferMAX_H264_SPS_SIZE;
     if(! ADM_SPSannexBToMP4(len,data,&converted,buffer))
     {
         ADM_warning("Cannot convert SPS\n");

avidemux2-2.8.2.git20260702.tar.xz/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4.cpp -> avidemux2-2.8.2.git20260718.tar.xz/avidemux_plugins/ADM_demuxers/Mp4/ADM_mp4.cpp Changed

@@ -556,7 +556,6 @@
                     uint32_t nalSize = ADM_getNalSizeH264(VDEO.extraData,VDEO.extraDataSize);
                     uint32_t prevSpsLen=0;
                     uint8_t *prevSps=NULL, *curSps=NULL;
-#define MAX_SPS_SIZE 1024
 #define MAX_FRAME_LENGTH (1920*1080*3) // ~7 MiB, should be enough even for 4K
                     uint8_t *bfer=new uint8_tMAX_FRAME_LENGTH;
                     ADMCompressedImage img;
@@ -582,9 +581,9 @@
                         {
                             // Check for presence of SPS in the stream. If it changes on-the-fly, we are in trouble.
                             if(!curSps)
-                                curSps=new uint8_tMAX_SPS_SIZE;
-                            memset(curSps,0,MAX_SPS_SIZE);
-                            uint32_t curSpsLen = getRawH264SPS(img.data, img.dataLength, nalSize, curSps, MAX_SPS_SIZE);
+                                curSps = new uint8_tMAX_H264_SPS_SIZE;
+                            memset(curSps,0,MAX_H264_SPS_SIZE);
+                            uint32_t curSpsLen = getRawH264SPS(img.data, img.dataLength, nalSize, curSps, MAX_H264_SPS_SIZE);
                             bool match=true;
                             if(curSpsLen)
                             {
@@ -594,7 +593,7 @@
                                         match=!memcmp(prevSps,curSps,(prevSpsLen>curSpsLen)? curSpsLen : prevSpsLen);
                                 }else
                                 {
-                                    prevSps=new uint8_tMAX_SPS_SIZE;
+                                    prevSps = new uint8_tMAX_H264_SPS_SIZE;
                                 }
                                 if(!match)
                                 {
@@ -605,7 +604,7 @@
                                     mixDump(curSps,curSpsLen);
                                 }
                                 prevSpsLen=curSpsLen;
-                                memset(prevSps,0,MAX_SPS_SIZE);
+                                memset(prevSps,0,MAX_H264_SPS_SIZE);
                                 memcpy(prevSps,curSps,prevSpsLen);
                             }
                             if(!match && curSps)

Changes of Revision 19