[FFmpeg-cvslog] avformat/webmdashenc: fix on-demand profile string

[James Almer]

ffmpeg | branch: release/4.1 | James Almer  | Thu Apr  7 
21:57:42 2022 -0300| [ad26796f4e24ee49eba17852c12f1941dd82bfd3] | committer: 
James Almer

avformat/webmdashenc: fix on-demand profile string

Fixes ticket #9596

Signed-off-by: James Almer 
(cherry picked from commit 487b49d8f2e1e81dce86230fc957ca2ee9de00ee)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ad26796f4e24ee49eba17852c12f1941dd82bfd3
---

 libavformat/webmdashenc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index 542410f26b..3a2504795e 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -104,7 +104,7 @@ static int write_header(AVFormatContext *s)
 }
 avio_printf(s->pb, "  minBufferTime=\"PT%gS\"\n", min_buffer_time);
 avio_printf(s->pb, "  profiles=\"%s\"%s",
-w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:webm:dash:profile:webm-on-demand:2012",
+w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:mpeg:dash:profile:webm-on-demand:2012",
 w->is_live ? "\n" : ">\n");
 if (w->is_live) {
 time_t local_time = time(NULL);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/webmdashenc: fix on-demand profile string

[James Almer]

ffmpeg | branch: release/4.2 | James Almer  | Thu Apr  7 
21:57:42 2022 -0300| [d36f0ff69ac2d27b97ed1e75faa88a2a3b4cfa40] | committer: 
James Almer

avformat/webmdashenc: fix on-demand profile string

Fixes ticket #9596

Signed-off-by: James Almer 
(cherry picked from commit 487b49d8f2e1e81dce86230fc957ca2ee9de00ee)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d36f0ff69ac2d27b97ed1e75faa88a2a3b4cfa40
---

 libavformat/webmdashenc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index 542410f26b..3a2504795e 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -104,7 +104,7 @@ static int write_header(AVFormatContext *s)
 }
 avio_printf(s->pb, "  minBufferTime=\"PT%gS\"\n", min_buffer_time);
 avio_printf(s->pb, "  profiles=\"%s\"%s",
-w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:webm:dash:profile:webm-on-demand:2012",
+w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:mpeg:dash:profile:webm-on-demand:2012",
 w->is_live ? "\n" : ">\n");
 if (w->is_live) {
 time_t local_time = time(NULL);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/webmdashenc: fix on-demand profile string

[James Almer]

ffmpeg | branch: release/4.3 | James Almer  | Thu Apr  7 
21:57:42 2022 -0300| [497c32486c1b5f4d03b540a01e08528aa9990216] | committer: 
James Almer

avformat/webmdashenc: fix on-demand profile string

Fixes ticket #9596

Signed-off-by: James Almer 
(cherry picked from commit 487b49d8f2e1e81dce86230fc957ca2ee9de00ee)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=497c32486c1b5f4d03b540a01e08528aa9990216
---

 libavformat/webmdashenc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index a9edcf73b8..10ae63ae25 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -92,7 +92,7 @@ static int write_header(AVFormatContext *s)
 }
 avio_printf(s->pb, "  minBufferTime=\"PT%gS\"\n", min_buffer_time);
 avio_printf(s->pb, "  profiles=\"%s\"%s",
-w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:webm:dash:profile:webm-on-demand:2012",
+w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:mpeg:dash:profile:webm-on-demand:2012",
 w->is_live ? "\n" : ">\n");
 if (w->is_live) {
 time_t local_time = time(NULL);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/webmdashenc: fix on-demand profile string

[James Almer]

ffmpeg | branch: release/4.4 | James Almer  | Thu Apr  7 
21:57:42 2022 -0300| [472af5873f639a6fe72fa7360aac323104784cb3] | committer: 
James Almer

avformat/webmdashenc: fix on-demand profile string

Fixes ticket #9596

Signed-off-by: James Almer 
(cherry picked from commit 487b49d8f2e1e81dce86230fc957ca2ee9de00ee)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=472af5873f639a6fe72fa7360aac323104784cb3
---

 libavformat/webmdashenc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index 1304c1a8c3..181ae9db69 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -93,7 +93,7 @@ static int write_header(AVFormatContext *s)
 }
 avio_printf(pb, "  minBufferTime=\"PT%gS\"\n", min_buffer_time);
 avio_printf(pb, "  profiles=\"%s\"%s",
-w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:webm:dash:profile:webm-on-demand:2012",
+w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:mpeg:dash:profile:webm-on-demand:2012",
 w->is_live ? "\n" : ">\n");
 if (w->is_live) {
 time_t local_time = time(NULL);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/webmdashenc: fix on-demand profile string

[James Almer]

ffmpeg | branch: release/5.0 | James Almer  | Thu Apr  7 
21:57:42 2022 -0300| [2db2bdabbd94c3c28492c554a4291e0542660693] | committer: 
James Almer

avformat/webmdashenc: fix on-demand profile string

Fixes ticket #9596

Signed-off-by: James Almer 
(cherry picked from commit 487b49d8f2e1e81dce86230fc957ca2ee9de00ee)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2db2bdabbd94c3c28492c554a4291e0542660693
---

 libavformat/webmdashenc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index cf69bd35b1..384318708e 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -93,7 +93,7 @@ static int write_header(AVFormatContext *s)
 }
 avio_printf(pb, "  minBufferTime=\"PT%gS\"\n", min_buffer_time);
 avio_printf(pb, "  profiles=\"%s\"%s",
-w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:webm:dash:profile:webm-on-demand:2012",
+w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:mpeg:dash:profile:webm-on-demand:2012",
 w->is_live ? "\n" : ">\n");
 if (w->is_live) {
 time_t local_time = time(NULL);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/webmdashenc: fix on-demand profile string

[James Almer]

ffmpeg | branch: master | James Almer  | Thu Apr  7 21:57:42 
2022 -0300| [487b49d8f2e1e81dce86230fc957ca2ee9de00ee] | committer: James Almer

avformat/webmdashenc: fix on-demand profile string

Fixes ticket #9596

Signed-off-by: James Almer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=487b49d8f2e1e81dce86230fc957ca2ee9de00ee
---

 libavformat/webmdashenc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/webmdashenc.c b/libavformat/webmdashenc.c
index a942c484e9..f8f2274556 100644
--- a/libavformat/webmdashenc.c
+++ b/libavformat/webmdashenc.c
@@ -95,7 +95,7 @@ static int write_header(AVFormatContext *s)
 }
 avio_printf(pb, "  minBufferTime=\"PT%gS\"\n", min_buffer_time);
 avio_printf(pb, "  profiles=\"%s\"%s",
-w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:webm:dash:profile:webm-on-demand:2012",
+w->is_live ? "urn:mpeg:dash:profile:isoff-live:2011" : 
"urn:mpeg:dash:profile:webm-on-demand:2012",
 w->is_live ? "\n" : ">\n");
 if (w->is_live) {
 time_t local_time = time(NULL);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/diracdec: avoid signed integer overflow in global mv

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Mon Mar 21 20:51:47 2022 +0100| [9576ed4e48929aea96afdc5ee9901d77bface500] | 
committer: Michael Niedermayer

avcodec/diracdec: avoid signed integer overflow in global mv

Fixes: signed integer overflow: -128275513086 * -76056576 cannot be represented 
in type 'long'
Fixes: 
45818/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DIRAC_fuzzer-5129799149944832

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7f1279684e8e1e33c78577b7f0265c062e4e6232)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9576ed4e48929aea96afdc5ee9901d77bface500
---

 libavcodec/diracdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index 22ec913bf7..15831459a3 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -1435,8 +1435,8 @@ static void global_mv(DiracContext *s, DiracBlock *block, 
int x, int y, int ref)
 int *c  = s->globalmc[ref].perspective;
 
 int64_t m   = (1> (ez+ep);
 block->u.mv[ref][1] = (my + (1<<(ez+ep))) >> (ez+ep);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] Update for 4.2.6

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Thu Apr  7 16:28:15 2022 +0200| [550a7137914a6df028bbde9444f2a35ca2e35137] | 
committer: Michael Niedermayer

Update for 4.2.6

Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=550a7137914a6df028bbde9444f2a35ca2e35137
---

 Changelog| 57 +
 RELEASE  |  2 +-
 doc/Doxyfile |  2 +-
 3 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/Changelog b/Changelog
index cf950a7521..c8c856d5c1 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,63 @@
 Entries are sorted chronologically from oldest to youngest within each release,
 releases are sorted from youngest to oldest.
 
+version 4.2.6
+ avcodec/diracdec: avoid signed integer overflow in global mv
+ avcodec/takdsp: Fix integer overflow in decorrelate_sf()
+ avcodec/apedec: fix a integer overflow in long_filter_high_3800()
+ avfilter/vf_subtitles: pass storage size to libass
+ avformat/aqtitledec: Skip unrepresentable durations
+ avformat/cafdec: Do not store empty keys in read_info_chunk()
+ avformat/hls: Check target_duration
+ avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()
+ avformat/matroskadec: Check pre_ns
+ avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior
+ avformat/matroskadec: Use rounded down duration in get_cue_desc() check
+ avformat/avidec: Check height
+ avformat/rmdec: Better duplicate tags check
+ avformat/mov: Disallow empty sidx
+ avformat/matroskadec: Check duration
+ avformat/mov: Corner case encryption error cleanup in mov_read_senc()
+ avcodec/jpeglsdec: Fix if( code style
+ avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error
+ avcodec/motion_est: fix indention of ff_get_best_fcode()
+ avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()
+ avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using 
unsigned
+ avformat/matroskadec: Check desc_bytes
+ avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()
+ avformat/matroskadec: Fix infinite loop with bz decompression
+ avformat/mov: Check size before subtraction
+ avcodec/apedec: Fix integer overflows in predictor_update_3930()
+ avcodec/apedec: fix integer overflow in 8bit samples
+ avformat/flvdec: timestamps cannot use the full int64 range
+ avcodec/vqavideo: reset accounting on error
+ avcodec/alacdsp: fix integer overflow in decorrelate_stereo()
+ avformat/4xm: Check for duplicate track ids
+ avformat/4xm: Consider max_streams on reallocating tracks array
+ avformat/mov: Check next offset in mov_read_dref()
+ avformat/vivo: Favor setting fps from explicit fractions
+ avformat/vivo: Do not use the general expression evaluator for parsing a 
floating point value
+ avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()
+ avcodec/apedec: Change avg to uint32_t
+ avformat/mov: Disallow duplicate smdm
+ avformat/mov: Check for EOF in mov_read_glbl()
+ avcodec/vp3: Check version in all cases when VP4 code is not built
+ avformat/mov: Check channels for mov_parse_stsd_audio()
+ avformat/avidec: Check read_odml_index() for failure
+ avformat/aiffdec: Use av_rescale() for bitrate
+ avformat/aiffdec: sanity check block_align
+ avformat/aiffdec: Check sample_rate
+ avfilter/vf_gblur: fix heap-buffer overflow
+ avfilter/vf_lenscorrection: fix division by zero
+ avformat/latmenc: abort if no extradata is available
+ avformat/movenc: Fix segfault when remuxing rtp hint stream
+ avformat/tty: add probe function
+ avfilter/vf_neighbor: check if width is 1
+ avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE
+ avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()
+ avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results
+ configure: Add missing libshine->mpegaudioheader dependency
+
 version 4.2.5
  configure: update copyright year
  avformat/matroskadec: Reset state also on failure in matroska_reset_status()
diff --git a/RELEASE b/RELEASE
index df0228dfae..d6f85abf68 100644
--- a/RELEASE
+++ b/RELEASE
@@ -1 +1 @@
-4.2.5
+4.2.6
diff --git a/doc/Doxyfile b/doc/Doxyfile
index 63ce95c4a2..ddbb20b869 100644
--- a/doc/Doxyfile
+++ b/doc/Doxyfile
@@ -38,7 +38,7 @@ PROJECT_NAME   = FFmpeg
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER = 4.2.5
+PROJECT_NUMBER = 4.2.6
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/takdsp: Fix integer overflow in decorrelate_sf()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Mon Mar 28 00:26:06 2022 +0200| [c684fc5b9faecd5359eca716bd2ac0159c72] | 
committer: Michael Niedermayer

avcodec/takdsp: Fix integer overflow in decorrelate_sf()

Fixes: signed integer overflow: -101 * 71041254 cannot be represented in type 
'int'
Fixes: 
45938/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-4687974320701440

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 01d8c887f63bcb1f870034ed441504b3daffc645)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c684fc5b9faecd5359eca716bd2ac0159c72
---

 libavcodec/takdsp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/takdsp.c b/libavcodec/takdsp.c
index 9cb8052596..a8f9dba342 100644
--- a/libavcodec/takdsp.c
+++ b/libavcodec/takdsp.c
@@ -65,7 +65,7 @@ static void decorrelate_sf(int32_t *p1, int32_t *p2, int 
length, int dshift, int
 for (i = 0; i < length; i++) {
 int32_t a = p1[i];
 int32_t b = p2[i];
-b = (unsigned)(dfactor * (b >> dshift) + 128 >> 8) << dshift;
+b = (unsigned)((int)(dfactor * (unsigned)(b >> dshift) + 128) 
>> 8) << dshift;
 p1[i] = b - a;
 }
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avfilter/vf_lenscorrection: make width/height int

[Paul B Mahol]

ffmpeg | branch: release/4.2 | Paul B Mahol  | Mon Oct 14 
20:14:03 2019 +0200| [6ac6df4e1f219d4720a45ab8ea85524223eb360b] | committer: 
Michael Niedermayer

avfilter/vf_lenscorrection: make width/height int

Somehow previous correct fix broke usage.

(cherry picked from commit 79522411fa53b68743302d16d28156db95466a21)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6ac6df4e1f219d4720a45ab8ea85524223eb360b
---

 libavfilter/vf_lenscorrection.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_lenscorrection.c b/libavfilter/vf_lenscorrection.c
index 43f3c1b7d0..754b8f5ada 100644
--- a/libavfilter/vf_lenscorrection.c
+++ b/libavfilter/vf_lenscorrection.c
@@ -36,8 +36,8 @@
 
 typedef struct LenscorrectionCtx {
 const AVClass *av_class;
-unsigned int width;
-unsigned int height;
+int width;
+int height;
 int hsub, vsub;
 int nb_planes;
 double cx, cy, k1, k2;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/apedec: fix a integer overflow in long_filter_high_3800()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Mon Mar 28 00:12:17 2022 +0200| [0c68e3455b2e3d73cc2f93e9e5ea0854d84154f1] | 
committer: Michael Niedermayer

avcodec/apedec: fix a integer overflow in long_filter_high_3800()

Fixes: signed integer overflow: -2146549696 - 3923884 cannot be represented in 
type 'int'
Fixes: 
45907/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5992380584558592

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit b085b400becb93ccc68d786ab738b1fc50408b89)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0c68e3455b2e3d73cc2f93e9e5ea0854d84154f1
---

 libavcodec/apedec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c
index 87d704e600..035fa9a434 100644
--- a/libavcodec/apedec.c
+++ b/libavcodec/apedec.c
@@ -905,7 +905,7 @@ static void long_filter_high_3800(int32_t *buffer, int 
order, int shift, int len
 dotprod += delay[j] * (unsigned)coeffs[j];
 coeffs[j] += ((delay[j] >> 31) | 1) * sign;
 }
-buffer[i] -= dotprod >> shift;
+buffer[i] -= (unsigned)(dotprod >> shift);
 for (j = 0; j < order - 1; j++)
 delay[j] = delay[j + 1];
 delay[order - 1] = buffer[i];

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avfilter/vf_subtitles: pass storage size to libass

[Oneric]

ffmpeg | branch: release/4.2 | Oneric  | Wed Mar 23 20:43:54 
2022 +0100| [4641d71fb05618cf967e215d6c06d53f30a47a03] | committer: Michael 
Niedermayer

avfilter/vf_subtitles: pass storage size to libass

Due to a quirk of the ASS format some tags depend on the exact storage
resolution of the video, so tell libass via ass_set_storage_size.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4641d71fb05618cf967e215d6c06d53f30a47a03
---

 libavfilter/vf_subtitles.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libavfilter/vf_subtitles.c b/libavfilter/vf_subtitles.c
index a7b02461f2..2f0608ad90 100644
--- a/libavfilter/vf_subtitles.c
+++ b/libavfilter/vf_subtitles.c
@@ -145,9 +145,16 @@ static int config_input(AVFilterLink *inlink)
 ff_draw_init(>draw, inlink->format, ass->alpha ? 
FF_DRAW_PROCESS_ALPHA : 0);
 
 ass_set_frame_size  (ass->renderer, inlink->w, inlink->h);
-if (ass->original_w && ass->original_h)
+if (ass->original_w && ass->original_h) {
 ass_set_aspect_ratio(ass->renderer, (double)inlink->w / inlink->h,
  (double)ass->original_w / ass->original_h);
+#if LIBASS_VERSION > 0x0101
+ass_set_storage_size(ass->renderer, ass->original_w, ass->original_h);
+} else {
+ass_set_storage_size(ass->renderer, inlink->w, inlink->h);
+#endif
+}
+
 if (ass->shaping != -1)
 ass_set_shaper(ass->renderer, ass->shaping);
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/aqtitledec: Skip unrepresentable durations

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Mar 20 00:07:50 2022 +0100| [7b9ee6a49e8b4441a92612dabe9d13b461741696] | 
committer: Michael Niedermayer

avformat/aqtitledec: Skip unrepresentable durations

Fixes: signed integer overflow: -5 - 9223372036854775807 cannot be represented 
in type 'long'
Fixes: 
45665/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-475618463934054

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit c2d1597a8a6470045a8da241d4f65c81f26c3107)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7b9ee6a49e8b4441a92612dabe9d13b461741696
---

 libavformat/aqtitledec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/aqtitledec.c b/libavformat/aqtitledec.c
index 81630d73b0..960a5d8ef5 100644
--- a/libavformat/aqtitledec.c
+++ b/libavformat/aqtitledec.c
@@ -74,7 +74,8 @@ static int aqt_read_header(AVFormatContext *s)
 new_event = 1;
 pos = avio_tell(s->pb);
 if (sub) {
-sub->duration = frame - sub->pts;
+if (frame >= sub->pts && (uint64_t)frame - sub->pts < 
INT64_MAX)
+sub->duration = frame - sub->pts;
 sub = NULL;
 }
 } else if (*line) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/cafdec: Do not store empty keys in read_info_chunk()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sat Mar 19 23:36:22 2022 +0100| [64a756b8f5abfb819674e6268321dae9d324df26] | 
committer: Michael Niedermayer

avformat/cafdec: Do not store empty keys in read_info_chunk()

Fixes: Timeout
Fixes: 
45543/clusterfuzz-testcase-minimized-ffmpeg_dem_CAF_fuzzer-5684953164152832

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7ec28e1d4cef723485f50f7a08859752b79b570c)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=64a756b8f5abfb819674e6268321dae9d324df26
---

 libavformat/cafdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/cafdec.c b/libavformat/cafdec.c
index b9260c9074..f0fd326fb6 100644
--- a/libavformat/cafdec.c
+++ b/libavformat/cafdec.c
@@ -243,6 +243,8 @@ static void read_info_chunk(AVFormatContext *s, int64_t 
size)
 char value[1024];
 avio_get_str(pb, INT_MAX, key, sizeof(key));
 avio_get_str(pb, INT_MAX, value, sizeof(value));
+if (!*key)
+continue;
 av_dict_set(>metadata, key, value, 0);
 }
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/hls: Check target_duration

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Mar 20 22:54:31 2022 +0100| [a882801bc3b1f7b57b6e129510af3a6e92866772] | 
committer: Michael Niedermayer

avformat/hls: Check target_duration

Fixes: signed integer overflow: 77 * 100 cannot be represented 
in type 'long long'
Fixes: 
45545/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-6438101247983616

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Steven Liu 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit a8fd3f7fab83e1beea1c441e1a2e538e7aa431a5)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a882801bc3b1f7b57b6e129510af3a6e92866772
---

 libavformat/hls.c | 8 +++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/libavformat/hls.c b/libavformat/hls.c
index 48d133b87a..994f7222cd 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -791,10 +791,16 @@ static int parse_playlist(HLSContext *c, const char *url,
);
 new_rendition(c, , url);
 } else if (av_strstart(line, "#EXT-X-TARGETDURATION:", )) {
+int64_t t;
 ret = ensure_playlist(c, , url);
 if (ret < 0)
 goto fail;
-pls->target_duration = strtoll(ptr, NULL, 10) * AV_TIME_BASE;
+t = strtoll(ptr, NULL, 10);
+if (t < 0 || t >= INT64_MAX / AV_TIME_BASE) {
+ret = AVERROR_INVALIDDATA;
+goto fail;
+}
+pls->target_duration = t * AV_TIME_BASE;
 } else if (av_strstart(line, "#EXT-X-MEDIA-SEQUENCE:", )) {
 ret = ensure_playlist(c, , url);
 if (ret < 0)

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Mon Oct 26 21:30:19 2020 +0100| [4a7f3467d800c096951a78a38088fdbf35ffcd83] | 
committer: Michael Niedermayer

avcodec/pixlet: Avoid signed integer overflow in scaling in filterfn()

Fixes: signed integer overflow: 11494 * 107374182400 cannot be represented 
in type 'long'
Fixes: 
26586/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_PIXLET_fuzzer-5752633970917376

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 0c1f20c6c858b753effda274b58ef635d1924915)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4a7f3467d800c096951a78a38088fdbf35ffcd83
---

 libavcodec/pixlet.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/pixlet.c b/libavcodec/pixlet.c
index 6cb6516227..937076b126 100644
--- a/libavcodec/pixlet.c
+++ b/libavcodec/pixlet.c
@@ -404,7 +404,7 @@ static void filterfn(int16_t *dest, int16_t *tmp, unsigned 
size, int64_t scale)
 (int64_t) low [i - 1] * -INT64_C(325392907)  +
 (int64_t) high[i + 0] *  INT64_C(1518500249) +
 (int64_t) high[i - 1] *  INT64_C(1518500249);
-dest[i * 2] = av_clip_int16(((value >> 32) * scale) >> 32);
+dest[i * 2] = av_clip_int16(((value >> 32) * (uint64_t)scale) >> 32);
 }
 
 for (i = 0; i < hsize; i++) {
@@ -415,7 +415,7 @@ static void filterfn(int16_t *dest, int16_t *tmp, unsigned 
size, int64_t scale)
 (int64_t) high[i + 1] *  INT64_C(303700064)  +
 (int64_t) high[i + 0] * -INT64_C(3644400640) +
 (int64_t) high[i - 1] *  INT64_C(303700064);
-dest[i * 2 + 1] = av_clip_int16(((value >> 32) * scale) >> 32);
+dest[i * 2 + 1] = av_clip_int16(((value >> 32) * (uint64_t)scale) >> 
32);
 }
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/matroskadec: Check pre_ns

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Feb 13 15:20:02 2022 +0100| [f79f5a97bdc563c629c1a9a64e5ac00cf53f0ca9] | 
committer: Michael Niedermayer

avformat/matroskadec: Check pre_ns

Fixes: division by 0
Fixes: 
44615/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6681108677263360

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 710e51677a6f3a5c2b37dc31a597957a22a5e531)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f79f5a97bdc563c629c1a9a64e5ac00cf53f0ca9
---

 libavformat/matroskadec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index a6c22b0483..cd168faa29 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -4064,6 +4064,8 @@ static int64_t 
webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t
 // prebuffered.
 pre_bytes = desc_end.end_offset - desc_end.start_offset;
 pre_ns = desc_end.end_time_ns - desc_end.start_time_ns;
+if (pre_ns <= 0)
+return -1;
 pre_sec = pre_ns / nano_seconds_per_second;
 prebuffer_bytes +=
 pre_bytes * ((temp_prebuffer_ns / nano_seconds_per_second) / 
pre_sec);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Tue Feb  8 00:43:56 2022 +0100| [93445cbbf40e84c16851005ff602c170d14f844d] | 
committer: Michael Niedermayer

avcodec/sonic: Use unsigned for predictor_k to avoid undefined behavior

Fixes: signed integer overflow: -1094995529 * 24 cannot be represented in type 
'int'
Fixes: 
44436/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-4874459459223552

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 28008bf95ed9b2ab5945ae6658358ad7c7f1df35)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=93445cbbf40e84c16851005ff602c170d14f844d
---

 libavcodec/sonic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/sonic.c b/libavcodec/sonic.c
index 0a3b84163e..b6bb1c3a84 100644
--- a/libavcodec/sonic.c
+++ b/libavcodec/sonic.c
@@ -1018,7 +1018,7 @@ static int sonic_decode_frame(AVCodecContext *avctx,
 
 // dequantize
 for (i = 0; i < s->num_taps; i++)
-s->predictor_k[i] *= s->tap_quant[i];
+s->predictor_k[i] *= (unsigned) s->tap_quant[i];
 
 if (s->lossless)
 quant = 1;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/matroskadec: Use rounded down duration in get_cue_desc() check

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Thu Mar 10 23:24:49 2022 +0100| [a0fa20bae4eedd716486b15be92c089d7a0a522b] | 
committer: Michael Niedermayer

avformat/matroskadec: Use rounded down duration in get_cue_desc() check

Floating point is evil, it would be better if duration was not a double

Fixes: Infinite loop
Fixes: 
45123/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6725052291219456

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit bd3a03db9aef72ee36a7cc964171e9f52967f4bc)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a0fa20bae4eedd716486b15be92c089d7a0a522b
---

 libavformat/matroskadec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 565df66b49..a6c22b0483 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -3873,7 +3873,9 @@ static CueDesc get_cue_desc(AVFormatContext *s, int64_t 
ts, int64_t cues_start)
 int i;
 int nb_index_entries = s->streams[0]->nb_index_entries;
 AVIndexEntry *index_entries = s->streams[0]->index_entries;
-if (ts >= matroska->duration * matroska->time_scale) return (CueDesc) {-1, 
-1, -1, -1};
+
+if (ts >= (int64_t)(matroska->duration * matroska->time_scale))
+return (CueDesc) {-1, -1, -1, -1};
 for (i = 1; i < nb_index_entries; i++) {
 if (index_entries[i - 1].timestamp * matroska->time_scale <= ts &&
 index_entries[i].timestamp * matroska->time_scale > ts) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/avidec: Check height

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Feb 27 21:44:29 2022 +0100| [78707ae0255d892b26b3b85976775a0514f4f94d] | 
committer: Michael Niedermayer

avformat/avidec: Check height

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an 
unsigned type to negate this value to itself
Fixes: Ticket8486

Signed-off-by: Michael Niedermayer 
(cherry picked from commit ec8ff659f57786c4cb089b07dfeab7e5cbab8d52)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=78707ae0255d892b26b3b85976775a0514f4f94d
---

 libavformat/avidec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index ebf3a3d9c6..2635bbac28 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -846,6 +846,8 @@ FF_ENABLE_DEPRECATION_WARNINGS
 memcpy(st->codecpar->extradata + 
st->codecpar->extradata_size - 9,
"BottomUp", 9);
 }
+if (st->codecpar->height == INT_MIN)
+return AVERROR_INVALIDDATA;
 st->codecpar->height = FFABS(st->codecpar->height);
 
 //avio_skip(pb, size - 5 * 4);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/rmdec: Better duplicate tags check

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Thu Feb 24 00:26:08 2022 +0100| [27ed2b5bd83cce8f4e1215241f0f2f128201ceab] | 
committer: Michael Niedermayer

avformat/rmdec: Better duplicate tags check

Fixes: memleaks
Fixes: 
44810/clusterfuzz-testcase-minimized-ffmpeg_dem_IVR_fuzzer-5619494647627776

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 15a646e5018078a0954918f510f819a5599f0445)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=27ed2b5bd83cce8f4e1215241f0f2f128201ceab
---

 libavformat/rmdec.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index a8360816b0..098e299e6c 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -127,10 +127,6 @@ static int rm_read_audio_stream_info(AVFormatContext *s, 
AVIOContext *pb,
 uint32_t version;
 int ret;
 
-// Duplicate tags
-if (st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO)
-return AVERROR_INVALIDDATA;
-
 /* ra type header */
 version = avio_rb16(pb); /* version */
 if (version == 3) {
@@ -330,6 +326,11 @@ int ff_rm_read_mdpr_codecdata(AVFormatContext *s, 
AVIOContext *pb,
 if (codec_data_size == 0)
 return 0;
 
+// Duplicate tags
+if (   st->codecpar->codec_type != AVMEDIA_TYPE_UNKNOWN
+&& st->codecpar->codec_type != AVMEDIA_TYPE_DATA)
+return AVERROR_INVALIDDATA;
+
 avpriv_set_pts_info(st, 64, 1, 1000);
 codec_pos = avio_tell(pb);
 v = avio_rb32(pb);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mov: Disallow empty sidx

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Wed Mar  2 13:01:53 2022 +0100| [a09bc161b065427f018a350386260fcc2edad1c6] | 
committer: Michael Niedermayer

avformat/mov: Disallow empty sidx

It appears this is not allowed "Each Segment Index box documents how a 
(sub)segment is divided into one or more subsegments
(which may themselves be further subdivided using Segment Index boxes)."
Fixes: Null pointer dereference
Fixes: Ticket9517

Reviewed-by: Paul B Mahol 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 4419433d77278cb742944c4514be5f72a04103c0)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a09bc161b065427f018a350386260fcc2edad1c6
---

 libavformat/mov.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 93263c2d9e..8698b85e92 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5039,6 +5039,8 @@ static int mov_read_sidx(MOVContext *c, AVIOContext *pb, 
MOVAtom atom)
 avio_rb16(pb); // reserved
 
 item_count = avio_rb16(pb);
+if (item_count == 0)
+return AVERROR_INVALIDDATA;
 
 for (i = 0; i < item_count; i++) {
 int index;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/jpeglsdec: Fix if( code style

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Tue Feb 15 21:01:06 2022 +0100| [51bc51032775059f7b7eac7cfc589a839061a4aa] | 
committer: Michael Niedermayer

avcodec/jpeglsdec: Fix if( code style

Signed-off-by: Michael Niedermayer 
(cherry picked from commit f306b8e80ab04cfd8f6cd577a4484cb791d6e765)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=51bc51032775059f7b7eac7cfc589a839061a4aa
---

 libavcodec/jpeglsdec.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c
index 11b2ff71a8..615c9e5068 100644
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@@ -67,7 +67,7 @@ int ff_jpegls_decode_lse(MJpegDecodeContext *s)
 s->t3 = get_bits(>gb, 16);
 s->reset  = get_bits(>gb, 16);
 
-if(s->avctx->debug & FF_DEBUG_PICT_INFO) {
+if (s->avctx->debug & FF_DEBUG_PICT_INFO) {
 av_log(s->avctx, AV_LOG_DEBUG, "Coding parameters maxval:%d T1:%d 
T2:%d T3:%d reset:%d\n",
s->maxval, s->t1, s->t2, s->t3, s->reset);
 }
@@ -96,7 +96,7 @@ int ff_jpegls_decode_lse(MJpegDecodeContext *s)
 else
 maxtab = 65530/wt - 1;
 
-if(s->avctx->debug & FF_DEBUG_PICT_INFO) {
+if (s->avctx->debug & FF_DEBUG_PICT_INFO) {
 av_log(s->avctx, AV_LOG_DEBUG, "LSE palette %d tid:%d wt:%d 
maxtab:%d\n", id, tid, wt, maxtab);
 }
 if (maxtab >= 256) {
@@ -211,7 +211,7 @@ static inline int ls_get_code_runterm(GetBitContext *gb, 
JLSState *state,
 ret = ret >> 1;
 }
 
-if(FFABS(ret) > 0x)
+if (FFABS(ret) > 0x)
 return -0x1;
 /* update state */
 state->A[Q] += FFABS(ret) - RItype;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/matroskadec: Check duration

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Mon Feb 14 20:01:35 2022 +0100| [084b4f82a37d0f065f98701214ede7d3cdff87f2] | 
committer: Michael Niedermayer

avformat/matroskadec: Check duration

Fixes: -nan is outside the range of representable values of type 'long'
Fixes: 
44614/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-6216204841254912

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 36680078ca3302496d9b0b8a8d7168ce9eabb2bc)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=084b4f82a37d0f065f98701214ede7d3cdff87f2
---

 libavformat/matroskadec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 1607f94d48..565df66b49 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -2892,6 +2892,8 @@ static int matroska_read_header(AVFormatContext *s)
 
 if (!matroska->time_scale)
 matroska->time_scale = 100;
+if (isnan(matroska->duration))
+matroska->duration = 0;
 if (matroska->duration)
 matroska->ctx->duration = matroska->duration * matroska->time_scale *
   1000 / AV_TIME_BASE;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sat Feb 12 22:02:13 2022 +0100| [bf1df4368123accdb1d633c663db2712b2e35121] | 
committer: Michael Niedermayer

avcodec/jpeglsdec: Check get_ur_golomb_jpegls() for error

Fixes: Timeout
Fixes: Invalid shift
Fixes: 
44548/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-556487680891289
Fixes: 
44569/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AMV_fuzzer-6302543246917632
Fixes: 
44570/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-4550196556595200
Fixes: 
44592/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-5651610385121280
Fixes: 
44571/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5094698987945984
Fixes: 
44607/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TIFF_fuzzer-5341352013987840

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 151f83584eeb1912c8bdcd0c1ab1296e8664a0de)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bf1df4368123accdb1d633c663db2712b2e35121
---

 libavcodec/jpeglsdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c
index 0cb40cc0f1..11b2ff71a8 100644
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@@ -195,6 +195,8 @@ static inline int ls_get_code_runterm(GetBitContext *gb, 
JLSState *state,
 #endif
 ret = get_ur_golomb_jpegls(gb, k, state->limit - limit_add - 1,
state->qbpp);
+if (ret < 0)
+return -0x1;
 
 /* decode mapped error */
 map = 0;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/motion_est: fix indention of ff_get_best_fcode()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Wed Feb  9 10:31:34 2022 +0100| [05067fe680c268985b9aa013efd75648dfb10fe0] | 
committer: Michael Niedermayer

avcodec/motion_est: fix indention of ff_get_best_fcode()

Signed-off-by: Michael Niedermayer 
(cherry picked from commit ce43e1c581b4ed539ab366cc3df458779e8a44b8)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=05067fe680c268985b9aa013efd75648dfb10fe0
---

 libavcodec/motion_est.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c
index 08e6eabe28..a174d89120 100644
--- a/libavcodec/motion_est.c
+++ b/libavcodec/motion_est.c
@@ -1622,9 +1622,9 @@ int ff_get_best_fcode(MpegEncContext * s, int16_t 
(*mv_table)[2], int type)
  fcode_tab[my + MAX_MV]);
 int j;
 
-if(mx >= range || mx < -range ||
-   my >= range || my < -range)
-continue;
+if (mx >= range || mx < -range ||
+my >= range || my < -range)
+continue;
 
 for(j=0; jpict_type==AV_PICTURE_TYPE_B || 
s->current_picture.mc_mb_var[xy] < s->current_picture.mb_var[xy])

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mov: Corner case encryption error cleanup in mov_read_senc()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Wed Feb  9 22:01:03 2022 +0100| [bc56a270949c1ce214c4fe1126b1ef85f0e42b29] | 
committer: Michael Niedermayer

avformat/mov: Corner case encryption error cleanup in mov_read_senc()

Fixes: memleak
Fixes: 
42341/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4566632823914496

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 8ee0e4abcb8af36cae4eb24d4d6229461c1e)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=bc56a270949c1ce214c4fe1126b1ef85f0e42b29
---

 libavformat/mov.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index f7951f3f7d..93263c2d9e 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -6043,6 +6043,8 @@ static int mov_read_senc(MOVContext *c, AVIOContext *pb, 
MOVAtom atom)
 }
 if (pb->eof_reached) {
 av_log(c->fc, AV_LOG_ERROR, "Hit EOF while reading senc\n");
+if (ret >= 0)
+
av_encryption_info_free(encryption_index->encrypted_samples[i]);
 ret = AVERROR_INVALIDDATA;
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Tue Feb  8 21:38:50 2022 +0100| [8c5f441a0db43f4fc288b333455d1f75665dcc1c] | 
committer: Michael Niedermayer

avcodec/motion_est: Fix xy indexing on range violation in ff_get_best_fcode()

This codepath seems untested, no testcases change

Found-by: 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 634312a70f4d5afd40058c52b4d8eade1da07a70)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8c5f441a0db43f4fc288b333455d1f75665dcc1c
---

 libavcodec/motion_est.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c
index 759eea479d..08e6eabe28 100644
--- a/libavcodec/motion_est.c
+++ b/libavcodec/motion_est.c
@@ -1614,7 +1614,7 @@ int ff_get_best_fcode(MpegEncContext * s, int16_t 
(*mv_table)[2], int type)
 for(y=0; ymb_height; y++){
 int x;
 int xy= y*s->mb_stride;
-for(x=0; xmb_width; x++){
+for(x=0; xmb_width; x++, xy++){
 if(s->mb_type[xy] & type){
 int mx= mv_table[xy][0];
 int my= mv_table[xy][1];
@@ -1631,7 +1631,6 @@ int ff_get_best_fcode(MpegEncContext * s, int16_t 
(*mv_table)[2], int type)
 score[j]-= 170;
 }
 }
-xy++;
 }
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using unsigned

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sat Feb  5 20:41:08 2022 +0100| [e13aba00237b42be3b99f0a638a0b8fc37d22e0b] | 
committer: Michael Niedermayer

avcodec/jpeglsdec: Increase range for N in ls_get_code_runterm() by using 
unsigned

Fixes: left shift of 32768 by 16 places cannot be represented in type 'int'
Fixes: Timeout
Fixes: 
44219/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4679455379947520
Fixes: 
44088/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-4885976600674304

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 6ee283d7d001cfcfec94a023e172bca731e96514)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e13aba00237b42be3b99f0a638a0b8fc37d22e0b
---

 libavcodec/jpeglsdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c
index a8d9eaa18a..0cb40cc0f1 100644
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@@ -186,7 +186,7 @@ static inline int ls_get_code_runterm(GetBitContext *gb, 
JLSState *state,
 if (RItype)
 temp += state->N[Q] >> 1;
 
-for (k = 0; (state->N[Q] << k) < temp; k++)
+for (k = 0; ((unsigned)state->N[Q] << k) < temp; k++)
 ;
 
 #ifdef JLS_BROKEN

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/matroskadec: Check desc_bytes

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sat Feb  5 20:37:22 2022 +0100| [fd062924b8df47b8d6af81e0745c52282aee19e1] | 
committer: Michael Niedermayer

avformat/matroskadec: Check desc_bytes

Fixes: Division by 0
Fixes: 
44035/clusterfuzz-testcase-minimized-ffmpeg_dem_WEBM_DASH_MANIFEST_fuzzer-4826721386364928

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 5038933977d06d1048b41d71e0ada4d1ac536ddc)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fd062924b8df47b8d6af81e0745c52282aee19e1
---

 libavformat/matroskadec.c | 12 
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index 60f2e767a6..1607f94d48 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -4071,12 +4071,16 @@ static int64_t 
webm_dash_manifest_compute_bandwidth(AVFormatContext *s, int64_t
 do {
 int64_t desc_bytes = desc_end.end_offset - 
desc_beg.start_offset;
 int64_t desc_ns = desc_end.end_time_ns - 
desc_beg.start_time_ns;
-double desc_sec = desc_ns / nano_seconds_per_second;
-double calc_bits_per_second = (desc_bytes * 8) / desc_sec;
+double desc_sec, calc_bits_per_second, percent, 
mod_bits_per_second;
+if (desc_bytes <= 0)
+return -1;
+
+desc_sec = desc_ns / nano_seconds_per_second;
+calc_bits_per_second = (desc_bytes * 8) / desc_sec;
 
 // Drop the bps by the percentage of bytes buffered.
-double percent = (desc_bytes - prebuffer_bytes) / desc_bytes;
-double mod_bits_per_second = calc_bits_per_second * percent;
+percent = (desc_bytes - prebuffer_bytes) / desc_bytes;
+mod_bits_per_second = calc_bits_per_second * percent;
 
 if (prebuffer < desc_sec) {
 double search_sec =

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Fri Feb  4 00:44:32 2022 +0100| [c6c36aa97a1e5bf890c55fb4e083699958079940] | 
committer: Michael Niedermayer

avformat/utils: Fix invalid NULL pointer operation in ff_parse_key_value()

Fixes: pointer index expression with base 0x overflowed to 
0x
Fixes: 
44012/clusterfuzz-testcase-minimized-ffmpeg_dem_HLS_fuzzer-5670607746891776

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 59328aabd2c789ae053e18a62a20a7addfd4d069)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c6c36aa97a1e5bf890c55fb4e083699958079940
---

 libavformat/utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/utils.c b/libavformat/utils.c
index bc07000e15..4067d55fa1 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -4962,7 +4962,7 @@ void ff_parse_key_value(const char *str, 
ff_parse_key_val_cb callback_get_buf,
 key_len = ptr - key;
 
 callback_get_buf(context, key, key_len, , _len);
-dest_end = dest + dest_len - 1;
+dest_end = dest ? dest + dest_len - 1 : NULL;
 
 if (*ptr == '\"') {
 ptr++;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/matroskadec: Fix infinite loop with bz decompression

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Thu Feb  3 22:46:55 2022 +0100| [94fc589f8e59680a99fa62df025d1473ecf03b2d] | 
committer: Michael Niedermayer

avformat/matroskadec: Fix infinite loop with bz decompression

The same check is added to zlib too, it seems not needed there though

Fixes: Infinite loop
Fixes: 
43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 9c3d2cbb510674226b0c8fa6b146bf891f83786c)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=94fc589f8e59680a99fa62df025d1473ecf03b2d
---

 libavformat/matroskadec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index e316dbd0a2..60f2e767a6 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1633,7 +1633,7 @@ static int matroska_decode_buffer(uint8_t **buf, int 
*buf_size,
 case MATROSKA_TRACK_ENCODING_COMP_ZLIB:
 {
 z_stream zstream = { 0 };
-if (inflateInit() != Z_OK)
+if (!pkt_size || inflateInit() != Z_OK)
 return -1;
 zstream.next_in  = data;
 zstream.avail_in = isize;
@@ -1666,7 +1666,7 @@ static int matroska_decode_buffer(uint8_t **buf, int 
*buf_size,
 case MATROSKA_TRACK_ENCODING_COMP_BZLIB:
 {
 bz_stream bzstream = { 0 };
-if (BZ2_bzDecompressInit(, 0, 0) != BZ_OK)
+if (!pkt_size || BZ2_bzDecompressInit(, 0, 0) != BZ_OK)
 return -1;
 bzstream.next_in  = data;
 bzstream.avail_in = isize;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mov: Check size before subtraction

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Mon Jan 17 14:26:05 2022 +0100| [b8492ff76d6e7705204c3779916553fa62209c3a] | 
committer: Michael Niedermayer

avformat/mov: Check size before subtraction

Fixes: signed integer overflow: -9223372036854775808 - 8 cannot be represented 
in type 'long'
Fixes: 
43542/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5237670148702208

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit d8d9d506a3de976b647bcbb8f76c7b8d30eff576)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b8492ff76d6e7705204c3779916553fa62209c3a
---

 libavformat/mov.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 91f2ed1bcb..f7951f3f7d 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -6891,6 +6891,8 @@ static int mov_read_default(MOVContext *c, AVIOContext 
*pb, MOVAtom atom)
 if (a.size == 0) {
 a.size = atom.size - total_size + 8;
 }
+if (a.size < 0)
+break;
 a.size -= 8;
 if (a.size < 0)
 break;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/apedec: Fix integer overflows in predictor_update_3930()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Mon Jan  3 19:15:18 2022 +0100| [7a9dfc503dd2933395cb747852d3a7fc4535d216] | 
committer: Michael Niedermayer

avcodec/apedec: Fix integer overflows in predictor_update_3930()

Fixes: signed integer overflow: 1074134419 - -1075212485 cannot be represented 
in type 'int'
Fixes: 
43273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-4706880883130368

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 0c9c9bbd01bd82c35b6a908592d9dd6d9f4bd4a0)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7a9dfc503dd2933395cb747852d3a7fc4535d216
---

 libavcodec/apedec.c | 16 
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c
index 8a54c750b5..87d704e600 100644
--- a/libavcodec/apedec.c
+++ b/libavcodec/apedec.c
@@ -1038,13 +1038,13 @@ static av_always_inline int 
predictor_update_3930(APEPredictor *p,
   const int delayA)
 {
 int32_t predictionA, sign;
-int32_t d0, d1, d2, d3;
+uint32_t d0, d1, d2, d3;
 
 p->buf[delayA] = p->lastA[filter];
 d0 = p->buf[delayA];
-d1 = p->buf[delayA] - p->buf[delayA - 1];
-d2 = p->buf[delayA - 1] - p->buf[delayA - 2];
-d3 = p->buf[delayA - 2] - p->buf[delayA - 3];
+d1 = p->buf[delayA] - (unsigned)p->buf[delayA - 1];
+d2 = p->buf[delayA - 1] - (unsigned)p->buf[delayA - 2];
+d3 = p->buf[delayA - 2] - (unsigned)p->buf[delayA - 3];
 
 predictionA = d0 * p->coeffsA[filter][0] +
   d1 * p->coeffsA[filter][1] +
@@ -1055,10 +1055,10 @@ static av_always_inline int 
predictor_update_3930(APEPredictor *p,
 p->filterA[filter] = p->lastA[filter] + ((int)(p->filterA[filter] * 31U) 
>> 5);
 
 sign = APESIGN(decoded);
-p->coeffsA[filter][0] += ((d0 < 0) * 2 - 1) * sign;
-p->coeffsA[filter][1] += ((d1 < 0) * 2 - 1) * sign;
-p->coeffsA[filter][2] += ((d2 < 0) * 2 - 1) * sign;
-p->coeffsA[filter][3] += ((d3 < 0) * 2 - 1) * sign;
+p->coeffsA[filter][0] += (((int32_t)d0 < 0) * 2 - 1) * sign;
+p->coeffsA[filter][1] += (((int32_t)d1 < 0) * 2 - 1) * sign;
+p->coeffsA[filter][2] += (((int32_t)d2 < 0) * 2 - 1) * sign;
+p->coeffsA[filter][3] += (((int32_t)d3 < 0) * 2 - 1) * sign;
 
 return p->filterA[filter];
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/apedec: fix integer overflow in 8bit samples

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Thu Dec 23 20:39:14 2021 +0100| [770e373ca2d53e6dd3082536acca518ddb1f5148] | 
committer: Michael Niedermayer

avcodec/apedec: fix integer overflow in 8bit samples

Fixes: signed integer overflow: 2147483542 + 128 cannot be represented in type 
'int'
Fixes: 
42812/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6344057861832704

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7cee3b37187dbf61dbebff023f07ceedfc0129bb)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=770e373ca2d53e6dd3082536acca518ddb1f5148
---

 libavcodec/apedec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c
index 9e3756fc32..8a54c750b5 100644
--- a/libavcodec/apedec.c
+++ b/libavcodec/apedec.c
@@ -1529,7 +1529,7 @@ static int ape_decode_frame(AVCodecContext *avctx, void 
*data,
 for (ch = 0; ch < s->channels; ch++) {
 sample8 = (uint8_t *)frame->data[ch];
 for (i = 0; i < blockstodecode; i++)
-*sample8++ = (s->decoded[ch][i] + 0x80) & 0xff;
+*sample8++ = (s->decoded[ch][i] + 0x80U) & 0xff;
 }
 break;
 case 16:

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/flvdec: timestamps cannot use the full int64 range

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Thu Dec 23 20:36:16 2021 +0100| [f8bbc2ced33669cbd70428b5ecca2536dff9eb16] | 
committer: Michael Niedermayer

avformat/flvdec: timestamps cannot use the full int64 range

We do not support this as we multiply by 1000
Fixes: signed integer overflow: -45318575073853696 * 1000 cannot be represented 
in type 'long'
Fixes: 
42804/clusterfuzz-testcase-minimized-ffmpeg_dem_LIVE_FLV_fuzzer-4630325425209344

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit c217ca7718c8e24905d7ba9ede719ae040899476)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f8bbc2ced33669cbd70428b5ecca2536dff9eb16
---

 libavformat/flvdec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
index 3ccb89475e..ce706da03c 100644
--- a/libavformat/flvdec.c
+++ b/libavformat/flvdec.c
@@ -460,6 +460,8 @@ static int parse_keyframes_index(AVFormatContext *s, 
AVIOContext *ioc, int64_t m
 d = av_int2double(avio_rb64(ioc));
 if (isnan(d) || d < INT64_MIN || d > INT64_MAX)
 goto invalid;
+if (current_array ==  && (d <= INT64_MIN / 1000 || d >= 
INT64_MAX / 1000))
+goto invalid;
 current_array[0][i] = d;
 }
 if (times && filepositions) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/vqavideo: reset accounting on error

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Dec 19 22:26:00 2021 +0100| [c202ffefaa55087dc1e7d995861fe71f63a814c5] | 
committer: Michael Niedermayer

avcodec/vqavideo: reset accounting on error

Fixes: Timeout (same growing chunk is decoded to failure repeatedly)
Fixes: 
42582/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VQA_fuzzer-6531195591065600

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit d8ea7a67ba62f5d4520e75e56b9954d80e7ff223)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c202ffefaa55087dc1e7d995861fe71f63a814c5
---

 libavcodec/vqavideo.c | 7 ---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/libavcodec/vqavideo.c b/libavcodec/vqavideo.c
index b9743abda9..8df3ab3c2b 100644
--- a/libavcodec/vqavideo.c
+++ b/libavcodec/vqavideo.c
@@ -588,13 +588,14 @@ static int vqa_decode_chunk(VqaContext *s, AVFrame *frame)
 if (s->partial_countdown <= 0) {
 bytestream2_init(>gb, s->next_codebook_buffer, 
s->next_codebook_buffer_index);
 /* decompress codebook */
-if ((res = decode_format80(s, s->next_codebook_buffer_index,
-   s->codebook, s->codebook_size, 0)) < 0)
-return res;
+res = decode_format80(s, s->next_codebook_buffer_index,
+  s->codebook, s->codebook_size, 0);
 
 /* reset accounting */
 s->next_codebook_buffer_index = 0;
 s->partial_countdown = s->partial_count;
+if (res < 0)
+return res;
 }
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/alacdsp: fix integer overflow in decorrelate_stereo()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Thu Jul 23 23:34:15 2020 +0200| [fd854bced14e26d2a2d78699f2a92e864949f222] | 
committer: Michael Niedermayer

avcodec/alacdsp: fix integer overflow in decorrelate_stereo()

Fixes: signed integer overflow: -16777216 * 131 cannot be represented in type 
'int'
Fixes: 
23835/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5669943160078336
Fixes: 
41101/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-4636330705944576

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 68457c1e85122ffcadb0c909070dd210095fd2cd)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fd854bced14e26d2a2d78699f2a92e864949f222
---

 libavcodec/alacdsp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/alacdsp.c b/libavcodec/alacdsp.c
index 9996eb4319..8718d1b6b1 100644
--- a/libavcodec/alacdsp.c
+++ b/libavcodec/alacdsp.c
@@ -34,7 +34,7 @@ static void decorrelate_stereo(int32_t *buffer[2], int 
nb_samples,
 a = buffer[0][i];
 b = buffer[1][i];
 
-a -= (b * decorr_left_weight) >> decorr_shift;
+a -= (int)(b * (unsigned)decorr_left_weight) >> decorr_shift;
 b += a;
 
 buffer[0][i] = b;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/4xm: Check for duplicate track ids

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Tue Dec  7 09:14:09 2021 +0100| [fccff20bdd3b704e335c53193f959372dea27aad] | 
committer: Michael Niedermayer

avformat/4xm: Check for duplicate track ids

Signed-off-by: Michael Niedermayer 
(cherry picked from commit dd949124793c722ed55dead9da245574ace81968)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fccff20bdd3b704e335c53193f959372dea27aad
---

 libavformat/4xm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index c0c8cda713..e3a3432428 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -149,6 +149,9 @@ static int parse_strk(AVFormatContext *s,
 memset(>tracks[fourxm->track_count], 0,
sizeof(AudioTrack) * (track + 1 - fourxm->track_count));
 fourxm->track_count = track + 1;
+} else {
+if (fourxm->tracks[track].bits)
+return AVERROR_INVALIDDATA;
 }
 fourxm->tracks[track].adpcm   = AV_RL32(buf + 12);
 fourxm->tracks[track].channels= AV_RL32(buf + 36);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mov: Check next offset in mov_read_dref()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sat Dec  4 20:48:54 2021 +0100| [2aefb4b7ac39a1f9707fb50502364093e4117895] | 
committer: Michael Niedermayer

avformat/mov: Check next offset in mov_read_dref()

Fixes: signed integer overflow: 9223372036200463215 + 1109914409 cannot be 
represented in type 'long'
Fixes: 
41480/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6553086177443840

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 562021e2fd4d74589905d9c566c686394d2b0526)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2aefb4b7ac39a1f9707fb50502364093e4117895
---

 libavformat/mov.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index b52a72fe30..91f2ed1bcb 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -603,11 +603,13 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, 
MOVAtom atom)
 for (i = 0; i < entries; i++) {
 MOVDref *dref = >drefs[i];
 uint32_t size = avio_rb32(pb);
-int64_t next = avio_tell(pb) + size - 4;
+int64_t next = avio_tell(pb);
 
-if (size < 12)
+if (size < 12 || next < 0 || next > INT64_MAX - size)
 return AVERROR_INVALIDDATA;
 
+next += size - 4;
+
 dref->type = avio_rl32(pb);
 avio_rb32(pb); // version + flags
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/vivo: Favor setting fps from explicit fractions

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Mon Dec  6 11:38:39 2021 +0100| [a962cda7fd5da6e95e10f6b53eac0d28dc079e34] | 
committer: Michael Niedermayer

avformat/vivo: Favor setting fps from explicit fractions

Signed-off-by: Michael Niedermayer 
(cherry picked from commit bf1e93bdc9aaa4fd5c231030b5368aae0df018ee)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a962cda7fd5da6e95e10f6b53eac0d28dc079e34
---

 libavformat/vivo.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavformat/vivo.c b/libavformat/vivo.c
index 09b593feb4..6119e52de8 100644
--- a/libavformat/vivo.c
+++ b/libavformat/vivo.c
@@ -119,7 +119,7 @@ static int vivo_get_packet_header(AVFormatContext *s)
 static int vivo_read_header(AVFormatContext *s)
 {
 VivoContext *vivo = s->priv_data;
-AVRational fps = { 1, 25};
+AVRational fps = { 0 };
 AVStream *ast, *vst;
 unsigned char *line, *line_end, *key, *value;
 long value_int;
@@ -210,13 +210,16 @@ static int vivo_read_header(AVFormatContext *s)
 return AVERROR_INVALIDDATA;
 
 value_used = 1;
-fps = av_inv_q(av_d2q(d, 1));
+if (!fps.num && !fps.den)
+fps = av_inv_q(av_d2q(d, 1));
 }
 
 if (!value_used)
 av_dict_set(>metadata, key, value, 0);
 }
 }
+if (!fps.num || !fps.den)
+fps = (AVRational){ 1, 25 };
 
 avpriv_set_pts_info(ast, 64, 1, ast->codecpar->sample_rate);
 avpriv_set_pts_info(vst, 64, fps.num, fps.den);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/4xm: Consider max_streams on reallocating tracks array

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Tue Dec  7 09:14:08 2021 +0100| [f34273703b6a83bdb1471615e12abfcb14fca08a] | 
committer: Michael Niedermayer

avformat/4xm: Consider max_streams on reallocating tracks array

Fixes: OOM
Fixes: 
41595/clusterfuzz-testcase-minimized-ffmpeg_dem_FOURXM_fuzzer-6355979363549184

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 0dcd95ef8a2e16ed930296567ab1044e33602a34)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f34273703b6a83bdb1471615e12abfcb14fca08a
---

 libavformat/4xm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index bce99ad32f..c0c8cda713 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -137,7 +137,8 @@ static int parse_strk(AVFormatContext *s,
 return AVERROR_INVALIDDATA;
 
 track = AV_RL32(buf + 8);
-if ((unsigned)track >= UINT_MAX / sizeof(AudioTrack) - 1) {
+if ((unsigned)track >= UINT_MAX / sizeof(AudioTrack) - 1 ||
+track >= s->max_streams) {
 av_log(s, AV_LOG_ERROR, "current_track too large\n");
 return AVERROR_INVALIDDATA;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/vivo: Do not use the general expression evaluator for parsing a floating point value

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Dec  5 18:40:03 2021 +0100| [6cbacf1818ef11996845e644cbf69dbfe02be097] | 
committer: Michael Niedermayer

avformat/vivo: Do not use the general expression evaluator for parsing a 
floating point value

Fixes: Timeout
Fixes: 
41564/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-6309014024093696

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 7b24615565fd488e7e3a435102979a5ea85fe2fe)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6cbacf1818ef11996845e644cbf69dbfe02be097
---

 libavformat/vivo.c | 8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavformat/vivo.c b/libavformat/vivo.c
index 9a07c43849..09b593feb4 100644
--- a/libavformat/vivo.c
+++ b/libavformat/vivo.c
@@ -26,6 +26,7 @@
  * @sa http://wiki.multimedia.cx/index.php?title=Vivo
  */
 
+#include "libavutil/avstring.h"
 #include "libavutil/parseutils.h"
 #include "avformat.h"
 #include "internal.h"
@@ -204,11 +205,12 @@ static int vivo_read_header(AVFormatContext *s)
 return AVERROR_INVALIDDATA;
 value_used = 1;
 } else if (!strcmp(key, "FPS")) {
-AVRational tmp;
+double d;
+if (av_sscanf(value, "%f", ) != 1)
+return AVERROR_INVALIDDATA;
 
 value_used = 1;
-if (!av_parse_ratio(, value, 1, AV_LOG_WARNING, s))
-fps = av_inv_q(tmp);
+fps = av_inv_q(av_d2q(d, 1));
 }
 
 if (!value_used)

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Dec  5 22:19:05 2021 +0100| [e94ae6c679bffbddcb5662ae27903cc3555cdc31] | 
committer: Michael Niedermayer

avformat/mxfdec: Check for duplicate mxf_read_index_entry_array()

Fixes: memleak
Fixes: 
41596/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-6439060204290048

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Tomas Härdin 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 4f44a218e53cd92e64ba10a935bc1e7583c3e218)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e94ae6c679bffbddcb5662ae27903cc3555cdc31
---

 libavformat/mxfdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 182b122650..7e6cbdbe39 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1067,6 +1067,9 @@ static int mxf_read_index_entry_array(AVIOContext *pb, 
MXFIndexTableSegment *seg
 {
 int i, length;
 
+if (segment->temporal_offset_entries)
+return AVERROR_INVALIDDATA;
+
 segment->nb_index_entries = avio_rb32(pb);
 
 length = avio_rb32(pb);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/apedec: Change avg to uint32_t

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Fri Dec  3 17:58:50 2021 +0100| [24f5e3a1915f150cac4b3eaab63b309d4d54b833] | 
committer: Michael Niedermayer

avcodec/apedec: Change avg to uint32_t

Fixes: Integer overflow
Fixes: 
40973/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-6739312704618496

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Anton Khirnov 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 0ec75723a484405eb2f2ec2f9e58161b168ed8b0)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=24f5e3a1915f150cac4b3eaab63b309d4d54b833
---

 libavcodec/apedec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c
index d05aa741ef..9e3756fc32 100644
--- a/libavcodec/apedec.c
+++ b/libavcodec/apedec.c
@@ -101,7 +101,7 @@ typedef struct APEFilter {
 int16_t *historybuffer; ///< filter memory
 int16_t *delay; ///< filtered values
 
-int avg;
+uint32_t avg;
 } APEFilter;
 
 typedef struct APERice {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mov: Disallow duplicate smdm

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Fri Dec  3 17:42:22 2021 +0100| [1f62d58dae20489c37558f327d9bed47e58870d4] | 
committer: Michael Niedermayer

avformat/mov: Disallow duplicate smdm

Fixes: memleak
Fixes: 
39879/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5327819907923968

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit b5ba74053c1ef9f38d9e7b3a036675f06d2b2714)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1f62d58dae20489c37558f327d9bed47e58870d4
---

 libavformat/mov.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 987b0c0496..b52a72fe30 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5341,6 +5341,9 @@ static int mov_read_smdm(MOVContext *c, AVIOContext *pb, 
MOVAtom atom)
 av_log(c->fc, AV_LOG_WARNING, "Unsupported Mastering Display Metadata 
box version %d\n", version);
 return 0;
 }
+if (sc->mastering)
+return AVERROR_INVALIDDATA;
+
 avio_skip(pb, 3); /* flags */
 
 sc->mastering = av_mastering_display_metadata_alloc();

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mov: Check for EOF in mov_read_glbl()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sat Dec  4 20:11:35 2021 +0100| [6711c16e6356369ba34cfd487a7fff194ab09d1c] | 
committer: Michael Niedermayer

avformat/mov: Check for EOF in mov_read_glbl()

Fixes: Infinite loop
Fixes: 
41351/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-5433895854669824

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 59b4e7cbd87889c0bac710ac7f62782b637419a1)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6711c16e6356369ba34cfd487a7fff194ab09d1c
---

 libavformat/mov.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 6c72c52fdb..987b0c0496 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -1903,6 +1903,8 @@ static int mov_read_glbl(MOVContext *c, AVIOContext *pb, 
MOVAtom atom)
 // wrap a whole fiel atom inside of a glbl atom.
 unsigned size = avio_rb32(pb);
 unsigned type = avio_rl32(pb);
+if (avio_feof(pb))
+return AVERROR_INVALIDDATA;
 avio_seek(pb, -8, SEEK_CUR);
 if (type == MKTAG('f','i','e','l') && size == atom.size)
 return mov_read_default(c, pb, atom);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/vp3: Check version in all cases when VP4 code is not built

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Tue Nov 30 19:46:17 2021 +0100| [a8e6ddb5df5e3188aaac0ea9f4d4fd2b0beceb59] | 
committer: Michael Niedermayer

avcodec/vp3: Check version in all cases when VP4 code is not built

Fixes: out of array read
Fixes: 
40284/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP3_fuzzer-4599568176644096

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Peter Ross 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 96caa01f130526cb420d0706a40fb63695153128)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a8e6ddb5df5e3188aaac0ea9f4d4fd2b0beceb59
---

 libavcodec/vp3.c | 9 -
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 0611632d6d..a7fadadf49 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -2748,7 +2748,14 @@ static int vp3_decode_frame(AVCodecContext *avctx,
 skip_bits(, 4); /* width code */
 skip_bits(, 4); /* height code */
 if (s->version) {
-s->version = get_bits(, 5);
+int version = get_bits(, 5);
+#if !CONFIG_VP4_DECODER
+if (version >= 2) {
+av_log(avctx, AV_LOG_ERROR, "This build does not support 
decoding VP4.\n");
+return AVERROR_DECODER_NOT_FOUND;
+}
+#endif
+s->version = version;
 if (avctx->frame_number == 0)
 av_log(s->avctx, AV_LOG_DEBUG,
"VP version: %d\n", s->version);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/mov: Check channels for mov_parse_stsd_audio()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Nov  7 13:48:24 2021 +0100| [498a365d6d5d994e33e7d4d0d052d0905e749b23] | 
committer: Michael Niedermayer

avformat/mov: Check channels for mov_parse_stsd_audio()

Fixes: signed integer overflow: -776522110086937600 * 16 cannot be represented 
in type 'long'
Fixes: 
40563/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-6644829447127040

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 3a64a4c58255d45e05eff80c9464ad3bdc2d6463)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=498a365d6d5d994e33e7d4d0d052d0905e749b23
---

 libavformat/mov.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/libavformat/mov.c b/libavformat/mov.c
index 0962eda774..6c72c52fdb 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -2525,6 +2525,10 @@ int ff_mov_read_stsd_entries(MOVContext *c, AVIOContext 
*pb, int entries)
 av_log(c->fc, AV_LOG_ERROR, "Invalid sample rate %d\n", 
st->codecpar->sample_rate);
 return AVERROR_INVALIDDATA;
 }
+if (st->codecpar->channels < 0) {
+av_log(c->fc, AV_LOG_ERROR, "Invalid channels %d\n", 
st->codecpar->channels);
+return AVERROR_INVALIDDATA;
+}
 } else if (st->codecpar->codec_type==AVMEDIA_TYPE_SUBTITLE){
 mov_parse_stsd_subtitle(c, pb, st, sc,
 size - (avio_tell(pb) - start_pos));

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/avidec: Check read_odml_index() for failure

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Nov 14 18:23:24 2021 +0100| [208434c1640a0d069f5d804a35c5c38e66e88d64] | 
committer: Michael Niedermayer

avformat/avidec: Check read_odml_index() for failure

Fixes: Timeout
Fixes: 
40950/clusterfuzz-testcase-minimized-ffmpeg_dem_AVI_fuzzer-6478873068437504

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 57adb26d058490daf2c5d6ddd3cf0cf2d2212256)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=208434c1640a0d069f5d804a35c5c38e66e88d64
---

 libavformat/avidec.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index 7200b76e68..ebf3a3d9c6 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -232,6 +232,8 @@ static int read_odml_index(AVFormatContext *s, int64_t 
frame_num)
 } else {
 int64_t offset, pos;
 int duration;
+int ret;
+
 offset = avio_rl64(pb);
 avio_rl32(pb);   /* size */
 duration = avio_rl32(pb);
@@ -249,7 +251,7 @@ static int read_odml_index(AVFormatContext *s, int64_t 
frame_num)
 if (avio_seek(pb, offset + 8, SEEK_SET) < 0)
 return -1;
 avi->odml_depth++;
-read_odml_index(s, frame_num);
+ret = read_odml_index(s, frame_num);
 avi->odml_depth--;
 frame_num += duration;
 
@@ -257,7 +259,8 @@ static int read_odml_index(AVFormatContext *s, int64_t 
frame_num)
 av_log(s, AV_LOG_ERROR, "Failed to restore position after 
reading index\n");
 return -1;
 }
-
+if (ret < 0)
+return ret;
 }
 }
 avi->index_loaded = 2;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/aiffdec: Use av_rescale() for bitrate

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Oct 31 00:11:23 2021 +0200| [d2d817eaf2d32e0f2fd1479e949289bf4125d562] | 
committer: Michael Niedermayer

avformat/aiffdec: Use av_rescale() for bitrate

Fixes: integer overflow
Fixes: 
40313/clusterfuzz-testcase-minimized-ffmpeg_dem_AIFF_fuzzer-4814761406103552

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 905588df975071c03c00b2e923c311b4de65a8f4)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d2d817eaf2d32e0f2fd1479e949289bf4125d562
---

 libavformat/aiffdec.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
index 12469f5105..68961c447a 100644
--- a/libavformat/aiffdec.c
+++ b/libavformat/aiffdec.c
@@ -186,8 +186,10 @@ static int get_aiff_header(AVFormatContext *s, int size,
 par->block_align = (av_get_bits_per_sample(par->codec_id) * 
par->channels) >> 3;
 
 if (aiff->block_duration) {
-par->bit_rate = (int64_t)par->sample_rate * (par->block_align << 3) /
-aiff->block_duration;
+par->bit_rate = av_rescale(par->sample_rate, par->block_align * 8LL,
+   aiff->block_duration);
+if (par->bit_rate < 0)
+par->bit_rate = 0;
 }
 
 /* Chunk is over */

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/aiffdec: Check sample_rate

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Oct 31 00:02:04 2021 +0200| [f2a206309e00200de0e75bb351be56571c2f6e70] | 
committer: Michael Niedermayer

avformat/aiffdec: Check sample_rate

Reviewed-by: Paul B Mahol 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 1b04836dff9958e8bfdbed2746b8c40b1e119ecc)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f2a206309e00200de0e75bb351be56571c2f6e70
---

 libavformat/aiffdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
index 833ab30643..2f27baf46f 100644
--- a/libavformat/aiffdec.c
+++ b/libavformat/aiffdec.c
@@ -121,6 +121,9 @@ static int get_aiff_header(AVFormatContext *s, int size,
 sample_rate = val << exp;
 else
 sample_rate = (val + (1ULL<<(-exp-1))) >> -exp;
+if (sample_rate <= 0)
+return AVERROR_INVALIDDATA;
+
 par->sample_rate = sample_rate;
 if (size < 18)
 return AVERROR_INVALIDDATA;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/aiffdec: sanity check block_align

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Sun Oct 31 00:10:39 2021 +0200| [ed968f5290bb0fb2f679bfed0b7da6613b1d090e] | 
committer: Michael Niedermayer

avformat/aiffdec: sanity check block_align

Reviewed-by: Paul B Mahol 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit 93f7776921ed8c5219732210067016c3457e864d)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ed968f5290bb0fb2f679bfed0b7da6613b1d090e
---

 libavformat/aiffdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/aiffdec.c b/libavformat/aiffdec.c
index 2f27baf46f..12469f5105 100644
--- a/libavformat/aiffdec.c
+++ b/libavformat/aiffdec.c
@@ -362,7 +362,7 @@ got_sound:
 if (!st->codecpar->block_align && st->codecpar->codec_id == 
AV_CODEC_ID_QCELP) {
 av_log(s, AV_LOG_WARNING, "qcelp without wave chunk, assuming full 
rate\n");
 st->codecpar->block_align = 35;
-} else if (!st->codecpar->block_align) {
+} else if (st->codecpar->block_align <= 0) {
 av_log(s, AV_LOG_ERROR, "could not find COMM tag or invalid 
block_align value\n");
 return -1;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avfilter/vf_lenscorrection: fix division by zero

[Paul B Mahol]

ffmpeg | branch: release/4.2 | Paul B Mahol  | Sun Oct 13 
23:28:16 2019 +0200| [15900ff8e68f38404bd6d392d474d99f65cdbbf9] | committer: 
Michael Niedermayer

avfilter/vf_lenscorrection: fix division by zero

Fixes #8265

(cherry picked from commit 19587c9332f5be4f6bc6d7b2b8ef3fd21dfeaa01)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=15900ff8e68f38404bd6d392d474d99f65cdbbf9
---

 libavfilter/vf_lenscorrection.c | 6 ++
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/libavfilter/vf_lenscorrection.c b/libavfilter/vf_lenscorrection.c
index 239fe195bd..43f3c1b7d0 100644
--- a/libavfilter/vf_lenscorrection.c
+++ b/libavfilter/vf_lenscorrection.c
@@ -155,10 +155,8 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
 for (plane = 0; plane < rect->nb_planes; ++plane) {
 int hsub = plane == 1 || plane == 2 ? rect->hsub : 0;
 int vsub = plane == 1 || plane == 2 ? rect->vsub : 0;
-int hdiv = 1 << hsub;
-int vdiv = 1 << vsub;
-int w = rect->width / hdiv;
-int h = rect->height / vdiv;
+int w = AV_CEIL_RSHIFT(rect->width, hsub);
+int h = AV_CEIL_RSHIFT(rect->height, vsub);
 int xcenter = rect->cx * w;
 int ycenter = rect->cy * h;
 int k1 = rect->k1 * (1<<24);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/latmenc: abort if no extradata is available

[James Almer]

ffmpeg | branch: release/4.2 | James Almer  | Tue Oct 15 
11:38:23 2019 -0300| [c4629d8abe270ec5e5d79f7d18cd0b12cd5fd797] | committer: 
Michael Niedermayer

avformat/latmenc: abort if no extradata is available

Fixes ticket #8273.

Reviewed-by: Paul B Mahol 
Signed-off-by: James Almer 
(cherry picked from commit dd01947397b98e94c3f2a79d5820aaf4594f4d3b)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c4629d8abe270ec5e5d79f7d18cd0b12cd5fd797
---

 libavformat/latmenc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavformat/latmenc.c b/libavformat/latmenc.c
index 8eb219f8ae..0ccf401b35 100644
--- a/libavformat/latmenc.c
+++ b/libavformat/latmenc.c
@@ -176,7 +176,8 @@ static int latm_write_packet(AVFormatContext *s, AVPacket 
*pkt)
 if (ret < 0)
 return ret;
 memcpy(par->extradata, side_data, side_data_size);
-}
+} else
+return AVERROR_INVALIDDATA;
 }
 }
 

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/movenc: Fix segfault when remuxing rtp hint stream

[Andreas Rheinhardt]

ffmpeg | branch: release/4.2 | Andreas Rheinhardt 
 | Tue Sep 29 10:21:34 2020 +0200| 
[c55cf1d0ccf4c92219021804c9b0463c242ae47d] | committer: Michael Niedermayer

avformat/movenc: Fix segfault when remuxing rtp hint stream

When remuxing an rtp hint stream (or any stream with the tag "rtp "),
the mov muxer treats this as one of the rtp hint tracks it creates
internally when ordered to do so; yet this track lacks the
AVFormatContext for the hinting rtp muxer, leading to segfaults in
mov_write_udta_sdp() if a "trak" atom is written for this stream; if not,
the stream's codecpar is freed by mov_free() as if the mov muxer owned
it (it does for the internally created "rtp " tracks), but without
resetting st->codecpar, leading to double-frees lateron. This commit
therefore ignores said tag which makes rtp hint streams unremuxable.

This fixes tickets #8181 and #8186.

Signed-off-by: Andreas Rheinhardt 
(cherry picked from commit 22c3cd176079dd104ec7610ead697235b04396f1)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c55cf1d0ccf4c92219021804c9b0463c242ae47d
---

 libavformat/movenc.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index 781095112e..2a69e36ef5 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -1552,6 +1552,10 @@ static unsigned int mov_get_codec_tag(AVFormatContext 
*s, MOVTrack *track)
 {
 unsigned int tag = track->par->codec_tag;
 
+// "rtp " is used to distinguish internally created RTP-hint tracks
+// (with rtp_ctx) from other tracks.
+if (tag == MKTAG('r','t','p',' '))
+tag = 0;
 if (!tag || (s->strict_std_compliance >= FF_COMPLIANCE_NORMAL &&
  (track->par->codec_id == AV_CODEC_ID_DVVIDEO ||
   track->par->codec_id == AV_CODEC_ID_RAWVIDEO ||

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avfilter/vf_gblur: fix heap-buffer overflow

[Paul B Mahol]

ffmpeg | branch: release/4.2 | Paul B Mahol  | Wed Oct 16 
12:13:04 2019 +0200| [84fdfdf8595150c04b86febd1ef2eae3878c84b8] | committer: 
Michael Niedermayer

avfilter/vf_gblur: fix heap-buffer overflow

Fixes #8282

(cherry picked from commit 64a805883d7223c868a683f0030837d859edd2ab)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=84fdfdf8595150c04b86febd1ef2eae3878c84b8
---

 libavfilter/vf_gblur.c   | 2 +-
 libavfilter/x86/vf_gblur.asm | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavfilter/vf_gblur.c b/libavfilter/vf_gblur.c
index e71b33da80..f0d861852f 100644
--- a/libavfilter/vf_gblur.c
+++ b/libavfilter/vf_gblur.c
@@ -236,7 +236,7 @@ static int config_input(AVFilterLink *inlink)
 
 s->nb_planes = av_pix_fmt_count_planes(inlink->format);
 
-s->buffer = av_malloc_array(inlink->w, inlink->h * sizeof(*s->buffer));
+s->buffer = av_malloc_array(FFALIGN(inlink->w, 16), FFALIGN(inlink->h, 16) 
* sizeof(*s->buffer));
 if (!s->buffer)
 return AVERROR(ENOMEM);
 
diff --git a/libavfilter/x86/vf_gblur.asm b/libavfilter/x86/vf_gblur.asm
index 762c953c85..a25b1659f5 100644
--- a/libavfilter/x86/vf_gblur.asm
+++ b/libavfilter/x86/vf_gblur.asm
@@ -100,7 +100,7 @@ cglobal horiz_slice, 4, 9, 9, ptr, width, height, steps, 
nu, bscale, x, y, step,
 
 add widthq, remainq
 cmp xq, widthq
-je .end_scalar
+jge .end_scalar
 
 .loop_scalar:
 ; ptr[x] += nu * ptr[x-1]
@@ -148,7 +148,7 @@ cglobal horiz_slice, 4, 9, 9, ptr, width, height, steps, 
nu, bscale, x, y, step,
 jg .loop_x_back
 
 cmp xq, 0
-je .end_scalar_back
+jle .end_scalar_back
 
 .loop_scalar_back:
 ; ptr[x-1] += nu * ptr[x]

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avformat/tty: add probe function

[Paul B Mahol]

ffmpeg | branch: release/4.2 | Paul B Mahol  | Mon Jan 27 
21:53:08 2020 +0100| [f126288f23443675c40e9017a725d5458a47c9f7] | committer: 
Michael Niedermayer

avformat/tty: add probe function

(cherry picked from commit 3bce9e9b3ea35c54ba793d7da99ea5157532)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f126288f23443675c40e9017a725d5458a47c9f7
---

 libavformat/tty.c | 21 -
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/libavformat/tty.c b/libavformat/tty.c
index 8d48f2c45c..60f7e9f87e 100644
--- a/libavformat/tty.c
+++ b/libavformat/tty.c
@@ -34,6 +34,13 @@
 #include "internal.h"
 #include "sauce.h"
 
+static int isansicode(int x)
+{
+return x == 0x1B || x == 0x0A || x == 0x0D || (x >= 0x20 && x < 0x7f);
+}
+
+static const char tty_extensions[31] = "ans,art,asc,diz,ice,nfo,txt,vt";
+
 typedef struct TtyDemuxContext {
 AVClass *class;
 int chars_per_frame;
@@ -42,6 +49,17 @@ typedef struct TtyDemuxContext {
 AVRational framerate; /**< Set by a private option. */
 } TtyDemuxContext;
 
+static int read_probe(const AVProbeData *p)
+{
+int cnt = 0;
+
+for (int i = 0; i < p->buf_size; i++)
+cnt += !!isansicode(p->buf[i]);
+
+return (cnt * 100LL / p->buf_size) * (cnt > 400) *
+!!av_match_ext(p->filename, tty_extensions);
+}
+
 /**
  * Parse EFI header
  */
@@ -153,8 +171,9 @@ AVInputFormat ff_tty_demuxer = {
 .name   = "tty",
 .long_name  = NULL_IF_CONFIG_SMALL("Tele-typewriter"),
 .priv_data_size = sizeof(TtyDemuxContext),
+.read_probe = read_probe,
 .read_header= read_header,
 .read_packet= read_packet,
-.extensions = "ans,art,asc,diz,ice,nfo,txt,vt",
+.extensions = tty_extensions,
 .priv_class = _demuxer_class,
 };

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avfilter/vf_neighbor: check if width is 1

[Paul B Mahol]

ffmpeg | branch: release/4.2 | Paul B Mahol  | Fri Oct 11 
11:18:10 2019 +0200| [98981312e15ad6bf1c90e660abf666b15924e350] | committer: 
Michael Niedermayer

avfilter/vf_neighbor: check if width is 1

Fixes #8242

(cherry picked from commit e787f8fd7ee99ba0c3e0f086ce2ce59eea7ed86c)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=98981312e15ad6bf1c90e660abf666b15924e350
---

 libavfilter/vf_neighbor.c | 8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavfilter/vf_neighbor.c b/libavfilter/vf_neighbor.c
index e50d4b4ed0..47c6175a12 100644
--- a/libavfilter/vf_neighbor.c
+++ b/libavfilter/vf_neighbor.c
@@ -296,9 +296,11 @@ static int filter_slice(AVFilterContext *ctx, void *arg, 
int jobnr, int nb_jobs)
src + (width - 2) * bpc,
  src + (width - 2) * bpc,
src + (width - 2) * bpc + ph * 
stride, src + (width - 1) * bpc + ph * stride, src + (width - 2) * bpc + ph * 
stride};
 
-s->filter(dst, src, 1, 
threshold, coordinateslb, s->coordinates, s->max);
-s->filter(dst  + 1  * bpc, src  + 1  * bpc, width 
- 2, threshold, coordinates,   s->coordinates, s->max);
-s->filter(dst + (width - 1) * bpc, src + (width - 1) * bpc, 1, 
threshold, coordinatesrb, s->coordinates, s->max);
+s->filter(dst, src, 1, 
threshold, coordinateslb, s->coordinates, s->max);
+if (width > 1) {
+s->filter(dst  + 1  * bpc, src  + 1  * bpc, 
width - 2, threshold, coordinates,   s->coordinates, s->max);
+s->filter(dst + (width - 1) * bpc, src + (width - 1) * bpc, 1, 
threshold, coordinatesrb, s->coordinates, s->max);
+}
 
 src += stride;
 dst += dstride;

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Wed Oct 20 19:51:08 2021 +0200| [ffcba1be9a7c0386c9f8ef6591868dcb7fd0ea19] | 
committer: Michael Niedermayer

avutil/mathematics: Document av_rescale_rnd() behavior on non int64 results

Reviewed-by: Derek Buitenhuis 
Signed-off-by: Michael Niedermayer 
(cherry picked from commit e154353fdb73dc1b3c1519350244d5346f761850)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ffcba1be9a7c0386c9f8ef6591868dcb7fd0ea19
---

 libavutil/mathematics.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavutil/mathematics.h b/libavutil/mathematics.h
index 54901800ba..64d4137a60 100644
--- a/libavutil/mathematics.h
+++ b/libavutil/mathematics.h
@@ -134,6 +134,7 @@ int64_t av_rescale(int64_t a, int64_t b, int64_t c) 
av_const;
  *
  * The operation is mathematically equivalent to `a * b / c`, but writing that
  * directly can overflow, and does not support different rounding methods.
+ * If the result is not representable then INT64_MIN is returned.
  *
  * @see av_rescale(), av_rescale_q(), av_rescale_q_rnd()
  */

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Thu Oct 21 13:25:59 2021 +0200| [d1cdfe78cfc59d8fd0859ed98dc8918bf1dac1a1] | 
committer: Michael Niedermayer

avcodec/flac_parser: Consider AV_INPUT_BUFFER_PADDING_SIZE

Fixes: out if array read
Fixes: 
40109/clusterfuzz-testcase-minimized-ffmpeg_dem_FLAC_fuzzer-4805686811295744

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Mattias Wadman 
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d1cdfe78cfc59d8fd0859ed98dc8918bf1dac1a1
---

 libavcodec/flac_parser.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/flac_parser.c b/libavcodec/flac_parser.c
index fed33087e8..db6765f34c 100644
--- a/libavcodec/flac_parser.c
+++ b/libavcodec/flac_parser.c
@@ -55,6 +55,7 @@
 
 /** largest possible size of flac header */
 #define MAX_FRAME_HEADER_SIZE 16
+#define MAX_FRAME_VERIFY_SIZE (MAX_FRAME_HEADER_SIZE)
 
 typedef struct FLACHeaderMarker {
 int offset;   /**< byte offset from start of FLACParseContext->buffer 
*/
@@ -169,7 +170,7 @@ static int find_headers_search_validate(FLACParseContext 
*fpc, int offset)
 uint8_t *header_buf;
 int size = 0;
 header_buf = flac_fifo_read_wrap(fpc, offset,
- MAX_FRAME_HEADER_SIZE,
+ MAX_FRAME_VERIFY_SIZE + 
AV_INPUT_BUFFER_PADDING_SIZE,
  >wrap_buf,
  >wrap_buf_allocated_size);
 if (frame_header_is_valid(fpc->avctx, header_buf, )) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()

[Michael Niedermayer]

ffmpeg | branch: release/4.2 | Michael Niedermayer  | 
Fri Oct 15 00:04:59 2021 +0200| [77fc0df720f0a3ea21cf4e44bf55518ef62ff5a7] | 
committer: Michael Niedermayer

avcodec/ttadsp: Fix integer overflows in tta_filter_process_c()

Fixes: signed integer overflow: 822841647 + 1647055738 cannot be represented in 
type 'int'
Fixes: 
39935/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-4592657142251520

Found-by: continuous fuzzing process 
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer 
(cherry picked from commit f24028c798397af720acb838357785aa705a8122)
Signed-off-by: Michael Niedermayer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=77fc0df720f0a3ea21cf4e44bf55518ef62ff5a7
---

 libavcodec/ttadsp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/ttadsp.c b/libavcodec/ttadsp.c
index 1d1443aee0..99dd66a0c2 100644
--- a/libavcodec/ttadsp.c
+++ b/libavcodec/ttadsp.c
@@ -47,9 +47,9 @@ static void tta_filter_process_c(int32_t *qmi, int32_t *dx, 
int32_t *dl,
 *error = *in;
 *in += (round >> shift);
 
-dl[4] = -dl[5]; dl[5] = -dl[6];
-dl[6] = *in - dl[7]; dl[7] = *in;
-dl[5] += dl[6]; dl[4] += dl[5];
+dl[4] = -(unsigned)dl[5]; dl[5] = -(unsigned)dl[6];
+dl[6] = *in -(unsigned)dl[7]; dl[7] = *in;
+dl[5] += (unsigned)dl[6]; dl[4] += (unsigned)dl[5];
 }
 
 av_cold void ff_ttadsp_init(TTADSPContext *c)

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/libdav1d: don't depend on the event flags API to init sequence params the first time

[James Almer]

ffmpeg | branch: release/5.0 | James Almer  | Thu Apr  7 
15:27:57 2022 -0300| [0d487be837872df255ef174399b9140eeaa9152a] | committer: 
James Almer

avcodec/libdav1d: don't depend on the event flags API to init sequence params 
the first time

A bug was found in dav1d <= 1.0.0 where the event flag New Sequence Header would
not be signaled for some samples using delayed random access points.
It has since been fixed, but nonetheless it's best to ensure the AVCodecContext
is filled with parameters when parsing the first frame, regardless of what 
events
were signaled.

Fixes ticket #9694.

Signed-off-by: James Almer 
(cherry picked from commit 3e186148ca9ac0c47cec253fdea62b48c9feadd2)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0d487be837872df255ef174399b9140eeaa9152a
---

 libavcodec/libdav1d.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/libdav1d.c b/libavcodec/libdav1d.c
index 872e60e000..765c1a4bc4 100644
--- a/libavcodec/libdav1d.c
+++ b/libavcodec/libdav1d.c
@@ -381,7 +381,8 @@ static int libdav1d_receive_frame(AVCodecContext *c, 
AVFrame *frame)
 
 #if FF_DAV1D_VERSION_AT_LEAST(5,1)
 dav1d_get_event_flags(dav1d->c, _flags);
-if (event_flags & DAV1D_EVENT_FLAG_NEW_SEQUENCE)
+if (c->pix_fmt == AV_PIX_FMT_NONE ||
+(event_flags & DAV1D_EVENT_FLAG_NEW_SEQUENCE))
 #endif
 libdav1d_init_params(c, p->seq_hdr);
 res = ff_decode_frame_props(c, frame);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/libdav1d: don't depend on the event flags API to init sequence params the first time

[James Almer]

ffmpeg | branch: master | James Almer  | Thu Apr  7 15:27:57 
2022 -0300| [3e186148ca9ac0c47cec253fdea62b48c9feadd2] | committer: James Almer

avcodec/libdav1d: don't depend on the event flags API to init sequence params 
the first time

A bug was found in dav1d <= 1.0.0 where the event flag New Sequence Header would
not be signaled for some samples using delayed random access points.
It has since been fixed, but nonetheless it's best to ensure the AVCodecContext
is filled with parameters when parsing the first frame, regardless of what 
events
were signaled.

Fixes ticket #9694.

Signed-off-by: James Almer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3e186148ca9ac0c47cec253fdea62b48c9feadd2
---

 libavcodec/libdav1d.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/libdav1d.c b/libavcodec/libdav1d.c
index 64014123ce..0a46cf2264 100644
--- a/libavcodec/libdav1d.c
+++ b/libavcodec/libdav1d.c
@@ -382,7 +382,8 @@ static int libdav1d_receive_frame(AVCodecContext *c, 
AVFrame *frame)
 
 #if FF_DAV1D_VERSION_AT_LEAST(5,1)
 dav1d_get_event_flags(dav1d->c, _flags);
-if (event_flags & DAV1D_EVENT_FLAG_NEW_SEQUENCE)
+if (c->pix_fmt == AV_PIX_FMT_NONE ||
+event_flags & DAV1D_EVENT_FLAG_NEW_SEQUENCE)
 #endif
 libdav1d_init_params(c, p->seq_hdr);
 res = ff_decode_frame_props(c, frame);

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avcodec/libsvtav1: give svtav1-params priority over avctx values

[James Almer]

ffmpeg | branch: master | James Almer  | Sun Mar 27 20:06:51 
2022 -0300| [e3c4442b249acde1d50e7b0deb3422141c6248d8] | committer: James Almer

avcodec/libsvtav1: give svtav1-params priority over avctx values

If the svt equivalent option to an avctx AVOption is passed by the user
then it should have priority. The exception are fields like dimensions, bitdepth
and pixel format, which must match what lavc will feed the encoder after init.

This addresses libsvt-av1 issue #1858.

Signed-off-by: James Almer 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e3c4442b249acde1d50e7b0deb3422141c6248d8
---

 libavcodec/libsvtav1.c | 69 +-
 1 file changed, 34 insertions(+), 35 deletions(-)

diff --git a/libavcodec/libsvtav1.c b/libavcodec/libsvtav1.c
index 7db789be5e..2e3d96ce37 100644
--- a/libavcodec/libsvtav1.c
+++ b/libavcodec/libsvtav1.c
@@ -178,6 +178,9 @@ static int config_enc_params(EbSvtAv1EncConfiguration 
*param,
 param->rate_control_mode = 1;
 else
 param->rate_control_mode = 2;
+
+param->max_qp_allowed   = avctx->qmax;
+param->min_qp_allowed   = avctx->qmin;
 }
 param->max_bit_rate = avctx->rc_max_rate;
 param->vbv_bufsize  = avctx->rc_buffer_size;
@@ -191,6 +194,37 @@ static int config_enc_params(EbSvtAv1EncConfiguration 
*param,
 param->enable_adaptive_quantization = 0;
 }
 
+desc = av_pix_fmt_desc_get(avctx->pix_fmt);
+param->color_primaries  = avctx->color_primaries;
+param->matrix_coefficients  = (desc->flags & AV_PIX_FMT_FLAG_RGB) ?
+  AVCOL_SPC_RGB : avctx->colorspace;
+param->transfer_characteristics = avctx->color_trc;
+
+if (avctx->color_range != AVCOL_RANGE_UNSPECIFIED)
+param->color_range = avctx->color_range == AVCOL_RANGE_JPEG;
+else
+param->color_range = !!(desc->flags & AV_PIX_FMT_FLAG_RGB);
+
+if (avctx->profile != FF_PROFILE_UNKNOWN)
+param->profile = avctx->profile;
+
+if (avctx->level != FF_LEVEL_UNKNOWN)
+param->level = avctx->level;
+
+if (avctx->gop_size > 0)
+param->intra_period_length  = avctx->gop_size - 1;
+
+if (avctx->framerate.num > 0 && avctx->framerate.den > 0) {
+param->frame_rate_numerator   = avctx->framerate.num;
+param->frame_rate_denominator = avctx->framerate.den;
+} else {
+param->frame_rate_numerator   = avctx->time_base.den;
+param->frame_rate_denominator = avctx->time_base.num * 
avctx->ticks_per_frame;
+}
+
+/* 2 = IDR, closed GOP, 1 = CRA, open GOP */
+param->intra_refresh_type = avctx->flags & AV_CODEC_FLAG_CLOSED_GOP ? 2 : 
1;
+
 #if SVT_AV1_CHECK_VERSION(0, 9, 1)
 while ((en = av_dict_get(svt_enc->svtav1_opts, "", en, 
AV_DICT_IGNORE_SUFFIX))) {
 EbErrorType ret = svt_av1_enc_parse_parameter(param, en->key, 
en->value);
@@ -214,7 +248,6 @@ static int config_enc_params(EbSvtAv1EncConfiguration 
*param,
 param->source_width = avctx->width;
 param->source_height= avctx->height;
 
-desc = av_pix_fmt_desc_get(avctx->pix_fmt);
 param->encoder_bit_depth = desc->comp[0].depth;
 
 if (desc->log2_chroma_w == 1 && desc->log2_chroma_h == 1)
@@ -228,22 +261,6 @@ static int config_enc_params(EbSvtAv1EncConfiguration 
*param,
 return AVERROR(EINVAL);
 }
 
-param->color_primaries  = avctx->color_primaries;
-param->matrix_coefficients  = (desc->flags & AV_PIX_FMT_FLAG_RGB) ?
-  AVCOL_SPC_RGB : avctx->colorspace;
-param->transfer_characteristics = avctx->color_trc;
-
-if (avctx->color_range != AVCOL_RANGE_UNSPECIFIED)
-param->color_range = avctx->color_range == AVCOL_RANGE_JPEG;
-else
-param->color_range = !!(desc->flags & AV_PIX_FMT_FLAG_RGB);
-
-if (avctx->profile != FF_PROFILE_UNKNOWN)
-param->profile = avctx->profile;
-
-if (avctx->level != FF_LEVEL_UNKNOWN)
-param->level = avctx->level;
-
 if ((param->encoder_color_format == EB_YUV422 || param->encoder_bit_depth 
> 10)
  && param->profile != FF_PROFILE_AV1_PROFESSIONAL ) {
 av_log(avctx, AV_LOG_WARNING, "Forcing Professional profile\n");
@@ -253,25 +270,7 @@ static int config_enc_params(EbSvtAv1EncConfiguration 
*param,
 param->profile = FF_PROFILE_AV1_HIGH;
 }
 
-if (avctx->gop_size > 0)
-param->intra_period_length  = avctx->gop_size - 1;
-
-if (avctx->framerate.num > 0 && avctx->framerate.den > 0) {
-param->frame_rate_numerator   = avctx->framerate.num;
-param->frame_rate_denominator = avctx->framerate.den;
-} else {
-param->frame_rate_numerator   = avctx->time_base.den;
-param->frame_rate_denominator = avctx->time_base.num * 
avctx->ticks_per_frame;
-}
-
 avctx->bit_rate = param->target_bit_rate;
-if 

[FFmpeg-cvslog] avfilter/f_ebur128: multiply in integer first, before dividing in float

[Hendrik Leppkes]

ffmpeg | branch: master | Hendrik Leppkes  | Tue Apr  5 
22:37:22 2022 +0200| [cd96211ace4e27d00ed8bf92955e48ebff73] | committer: 
Hendrik Leppkes

avfilter/f_ebur128: multiply in integer first, before dividing in float

Restores the order of operations from before 15a1104, which reduces
errors from floating point calculations, and fixes FATE on mingw64.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cd96211ace4e27d00ed8bf92955e48ebff73
---

 libavfilter/f_ebur128.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavfilter/f_ebur128.c b/libavfilter/f_ebur128.c
index 1b1bcf1bff..a036aa0c86 100644
--- a/libavfilter/f_ebur128.c
+++ b/libavfilter/f_ebur128.c
@@ -768,7 +768,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame 
*insamples)
 
 /* get lower loudness to consider */
 n = 0;
-nb_pow = LRA_LOWER_PRC * 0.01 * nb_powers + 0.5;
+nb_pow = LRA_LOWER_PRC * nb_powers * 0.01 + 0.5;
 for (i = gate_hist_pos; i < HIST_SIZE; i++) {
 n += ebur128->i3000.histogram[i].count;
 if (n >= nb_pow) {
@@ -779,7 +779,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame 
*insamples)
 
 /* get higher loudness to consider */
 n = nb_powers;
-nb_pow = LRA_HIGHER_PRC * 0.01 * nb_powers + 0.5;
+nb_pow = LRA_HIGHER_PRC * nb_powers * 0.01 + 0.5;
 for (i = HIST_SIZE - 1; i >= 0; i--) {
 n -= FFMIN(n, ebur128->i3000.histogram[i].count);
 if (n < nb_pow) {

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] doc/filters: add range/defaults for tile filter options

[Gyan Doshi]

ffmpeg | branch: master | Gyan Doshi  | Thu Apr  7 16:14:43 
2022 +0530| [607ecc27ed9c22c75d063b462b3e78b47e7d742c] | committer: Gyan Doshi

doc/filters: add range/defaults for tile filter options

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=607ecc27ed9c22c75d063b462b3e78b47e7d742c
---

 doc/filters.texi | 13 ++---
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/doc/filters.texi b/doc/filters.texi
index 3fbaebb09c..6a66b0ed11 100644
--- a/doc/filters.texi
+++ b/doc/filters.texi
@@ -21406,9 +21406,8 @@ The filter accepts the following options:
 @table @option
 
 @item layout
-Set the grid size (i.e. the number of lines and columns). For the syntax of
-this option, check the
-@ref{video size syntax,,"Video size" section in the ffmpeg-utils 
manual,ffmpeg-utils}.
+Set the grid size in the form @code{COLUMNSxROWS}. Range is upto UINT_MAX 
cells.
+Default is @code{6x5}.
 
 @item nb_frames
 Set the maximum number of frames to render in the given area. It must be less
@@ -21416,12 +21415,12 @@ than or equal to @var{w}x@var{h}. The default value 
is @code{0}, meaning all
 the area will be used.
 
 @item margin
-Set the outer border margin in pixels.
+Set the outer border margin in pixels. Range is 0 to 1024. Default is @code{0}.
 
 @item padding
 Set the inner border thickness (i.e. the number of pixels between frames). For
 more advanced padding options (such as having different values for the edges),
-refer to the pad video filter.
+refer to the pad video filter. Range is 0 to 1024. Default is @code{0}.
 
 @item color
 Specify the color of the unused area. For the syntax of this option, check the
@@ -21430,12 +21429,12 @@ The default value of @var{color} is "black".
 
 @item overlap
 Set the number of frames to overlap when tiling several successive frames 
together.
-The value must be between @code{0} and @var{nb_frames - 1}.
+The value must be between @code{0} and @var{nb_frames - 1}. Default is 
@code{0}.
 
 @item init_padding
 Set the number of frames to initially be empty before displaying first output 
frame.
 This controls how soon will one get first output frame.
-The value must be between @code{0} and @var{nb_frames - 1}.
+The value must be between @code{0} and @var{nb_frames - 1}. Default is 
@code{0}.
 @end table
 
 @subsection Examples

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".

[FFmpeg-cvslog] avfilter/af_ladspa: fix pts compensation if number of samples per frame is lower than latency

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol  | Thu Apr  7 09:35:57 
2022 +0200| [55d414829c601ec5482be61aa327c22f0f602fe1] | committer: Paul B Mahol

avfilter/af_ladspa: fix pts compensation if number of samples per frame is 
lower than latency

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=55d414829c601ec5482be61aa327c22f0f602fe1
---

 libavfilter/af_ladspa.c | 27 ---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/libavfilter/af_ladspa.c b/libavfilter/af_ladspa.c
index bf51b372ff..1c3ede2ee2 100644
--- a/libavfilter/af_ladspa.c
+++ b/libavfilter/af_ladspa.c
@@ -29,11 +29,17 @@
 #include "libavutil/avassert.h"
 #include "libavutil/avstring.h"
 #include "libavutil/channel_layout.h"
+#include "libavutil/fifo.h"
 #include "libavutil/opt.h"
 #include "audio.h"
 #include "avfilter.h"
 #include "internal.h"
 
+typedef struct MetaItem {
+int64_t pts;
+int nb_samples;
+} MetaItem;
+
 typedef struct LADSPAContext {
 const AVClass *class;
 char *dl_name;
@@ -69,6 +75,8 @@ typedef struct LADSPAContext {
 int in_trim;
 int out_pad;
 int latency;
+
+AVFifo *fifo;
 } LADSPAContext;
 
 #define OFFSET(x) offsetof(LADSPAContext, x)
@@ -169,6 +177,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
 int64_t out_duration;
 int64_t in_duration;
 int64_t in_pts;
+MetaItem meta;
 
 av_assert0(in->ch_layout.nb_channels == (s->nb_inputs * s->nb_handles));
 
@@ -210,8 +219,9 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
 for (i = 0; i < s->nb_outputcontrols; i++)
 print_ctl_info(ctx, AV_LOG_VERBOSE, s, i, s->ocmap, s->octlv, 1);
 
-in_duration = av_rescale_q(in->nb_samples,  inlink->time_base, 
av_make_q(1,  in->sample_rate));
-in_pts = in->pts;
+meta = (MetaItem){ in->pts, in->nb_samples };
+av_fifo_write(s->fifo, , 1);
+
 if (out != in)
 av_frame_free();
 
@@ -235,9 +245,14 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
 out->nb_samples = new_out_samples;
 }
 
+av_fifo_read(s->fifo, , 1);
+
 out_duration = av_rescale_q(out->nb_samples, inlink->time_base, 
av_make_q(1, out->sample_rate));
+in_duration  = av_rescale_q(meta.nb_samples, inlink->time_base, 
av_make_q(1, out->sample_rate));
+in_pts   = meta.pts;
+
 if (s->next_out_pts != AV_NOPTS_VALUE && out->pts != s->next_out_pts &&
-s->next_in_pts  != AV_NOPTS_VALUE && out->pts == s->next_in_pts) {
+s->next_in_pts  != AV_NOPTS_VALUE && in_pts   == s->next_in_pts) {
 out->pts = s->next_out_pts;
 } else {
 out->pts = in_pts;
@@ -676,6 +691,10 @@ static av_cold int init(AVFilterContext *ctx)
 s->next_out_pts = AV_NOPTS_VALUE;
 s->next_in_pts  = AV_NOPTS_VALUE;
 
+s->fifo = av_fifo_alloc2(8, sizeof(MetaItem), AV_FIFO_FLAG_AUTO_GROW);
+if (!s->fifo)
+return AVERROR(ENOMEM);
+
 return 0;
 }
 
@@ -775,6 +794,8 @@ static av_cold void uninit(AVFilterContext *ctx)
 av_freep(>octlv);
 av_freep(>handles);
 av_freep(>ctl_needs_value);
+
+av_fifo_freep2(>fifo);
 }
 
 static int process_command(AVFilterContext *ctx, const char *cmd, const char 
*args,

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".