Sync upstream/master to fork #2
Conversation
* commit 'f9b214042e9a867ba3d234014a3616b78ed775c8': ignore xcode file fix gcc warnings add docker file bump version works with python3
…ypt_fix_skip_bytes Ap4StreamCipher: fix skip bytes calculation.
Use dolby_digital_plus_info for ec-3
Use dolby_digital_plus_info for ec-3
Fuzzer had caught a number of large malloc and these large malloc were caused by overflow of AP4_UI32 causing the validation logic to be skipped.
Fuzzer caught another large malloc. This is caused by lack of boundary check resulting in the next atom (children atom) to artificially large "size" due to the underflow in bytes_available.
Fix overflow issues found by fuzzer
Fix eac3 smooth
Partially revert track label support for Smooth Streaming [4916daf] trackName in server manifest and part of the client manifest StreamIndex URL should match. Also using arbitrary UTF-8 in language_name as part of the URL should be avoided
Fuzzer caught another large malloc. This is caused by lack of boundary check in Ap4OdheAtom causing underflow.
Earlier boundary checks were insufficient to prevent certain potential payloads. This adds more boundary checks to prevent underflow of remains. I have also remove the usage of GetHeaderSize in constructor as it is a virtual method.
Fuzzer caught another large malloc. This is caused by lack of boundary check in Ap4SbgpAtom causing underflow.
Fuzzer caught another large malloc in Ap4SbgpAtom. It is caused by overflow in boundary check
The lack of boundary checks in Ap4ContainerAtom leads to an underflow in size which then leads to existing validation checks to fail and hence allow large malloc.
Same problem as before, underflow of bytes_available results in some potential attack
More fixes for issues caught by fuzzer
Fix Smooth Streaming Client Manifest URLs
Fix Level and BitDepth in AV1 Codec String
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| <script src="shaka-player.uncompiled.js"></script> | ||
| <!-- <script src="third_party/closure/goog/base.js"></script> --> | ||
| <!-- <script src="dist/deps.js"></script> --> | ||
| <script src="//cdnjs.cloudflare.com/ajax/libs/shaka-player/2.0.5/shaka-player.compiled.debug.js"></script> |
Check warning
Code scanning / CodeQL
Inclusion of functionality from an untrusted source Medium
| def usage(errMsg): | ||
| try: | ||
| print 'Error: %s' % (errMsg) | ||
| except NameError: |
Check notice
Code scanning / CodeQL
Empty except Note
| file_lines = open(filename).readlines() | ||
| file_out = open(filename, "wb") | ||
| file_out = open(filename, "w") |
Check warning
Code scanning / CodeQL
File is not always closed Warning
| file_lines = open(filename).readlines() | ||
| file_out = open(filename, "wb") | ||
| file_out = open(filename, "w") |
Check warning
Code scanning / CodeQL
File is not always closed Warning
|
|
||
| filename = os.path.join(BENTO4_HOME, "Build", "Docker", "Dockerfile") | ||
| print("Patching", filename) | ||
| file_lines = open(filename).readlines() |
Check warning
Code scanning / CodeQL
File is not always closed Warning
| filename = os.path.join(BENTO4_HOME, "Build", "Docker", "Dockerfile") | ||
| print("Patching", filename) | ||
| file_lines = open(filename).readlines() | ||
| file_out = open(filename, "w") |
Check warning
Code scanning / CodeQL
File is not always closed Warning
|
|
||
| // create the output stream | ||
| char fragment_output_filename[MP4_ENCRYPT_MAX_FILENAME_LENGTH + 1]; | ||
| snprintf(fragment_output_filename, sizeof(fragment_output_filename), output_filename, fragment_input_filename); |
Check failure
Code scanning / CodeQL
Non-constant format string Critical
|
|
||
| // create the output stream | ||
| char fragment_output_filename[MP4_ENCRYPT_MAX_FILENAME_LENGTH + 1]; | ||
| snprintf(fragment_output_filename, sizeof(fragment_output_filename), output_filename, fragment_input_filename); |
Check failure
Code scanning / CodeQL
Uncontrolled format string Critical
| } | ||
|
|
||
| AP4_ByteStream* input1 = NULL; | ||
| AP4_Result result = AP4_FileByteStream::Create(filename1, |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| } | ||
|
|
||
| AP4_ByteStream* input2 = NULL; | ||
| result = AP4_FileByteStream::Create(filename2, |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| if (is_uuid) { | ||
| // open the payload | ||
| AP4_ByteStream* payload = NULL; | ||
| AP4_Result result = AP4_FileByteStream::Create(file_path, AP4_FileByteStream::STREAM_MODE_READ, payload); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| } else { | ||
| // read the atom to insert | ||
| AP4_ByteStream* input = NULL; | ||
| AP4_Result result = AP4_FileByteStream::Create(file_path, AP4_FileByteStream::STREAM_MODE_READ, input); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| fprintf(stderr, "ERROR: cannot open input file (%s)\n", input_filename); | ||
| return 1; | ||
| if (!multi) { | ||
| result = AP4_FileByteStream::Create(input_filename, AP4_FileByteStream::STREAM_MODE_READ, input); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| fprintf(stderr, "ERROR: cannot open output file (%s)\n", output_filename); | ||
| return 1; | ||
| if (!multi) { | ||
| result = AP4_FileByteStream::Create(output_filename, AP4_FileByteStream::STREAM_MODE_WRITE, output); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| // create the output stream | ||
| char fragment_output_filename[MP4_ENCRYPT_MAX_FILENAME_LENGTH + 1]; | ||
| snprintf(fragment_output_filename, sizeof(fragment_output_filename), output_filename, fragment_input_filename); | ||
| result = AP4_FileByteStream::Create(fragment_output_filename, |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
| | CreateProcessor | ||
| +---------------------------------------------------------------------*/ | ||
| static AP4_Processor* | ||
| CreateProcessor(enum Method method, |
Check warning
Code scanning / CodeQL
Poorly documented large function Warning
No description provided.