[FFmpeg-cvslog] configure, cbs_h2645: Remove unneeded golomb dependency
ffmpeg | branch: master | Andreas Rheinhardt | Mon Jul 8 18:38:21 2019 +0200| [f83b46e2181c9eb0360cb61419f29a1e44f04954] | committer: Mark Thompson configure, cbs_h2645: Remove unneeded golomb dependency This has been forgotten in 44cde38c. Signed-off-by: Andreas Rheinhardt > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f83b46e2181c9eb0360cb61419f29a1e44f04954 --- configure | 4 ++-- libavcodec/cbs_h2645.c | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/configure b/configure index 7cea9d4d73..4005987409 100755 --- a/configure +++ b/configure @@ -2586,8 +2586,8 @@ threads_if_any="$THREADS_LIST" # subsystems cbs_av1_select="cbs" -cbs_h264_select="cbs golomb" -cbs_h265_select="cbs golomb" +cbs_h264_select="cbs" +cbs_h265_select="cbs" cbs_jpeg_select="cbs" cbs_mpeg2_select="cbs" cbs_vp9_select="cbs" diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c index b286269913..da4927ca8e 100644 --- a/libavcodec/cbs_h2645.c +++ b/libavcodec/cbs_h2645.c @@ -24,7 +24,6 @@ #include "cbs_internal.h" #include "cbs_h264.h" #include "cbs_h265.h" -#include "golomb.h" #include "h264.h" #include "h264_sei.h" #include "h2645_parse.h" ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] cbs_h264, h264_metadata: Deleting SEI messages never fails
ffmpeg | branch: master | Andreas Rheinhardt |
Mon Jul 8 01:14:02 2019 +0200| [d9418aba66e7f9d32c11d0ee1b8cddaf1e68e1b6] |
committer: Mark Thompson
cbs_h264, h264_metadata: Deleting SEI messages never fails
Given the recent changes to ff_cbs_delete_unit, it is no longer sensible
to use a return value for ff_cbs_h264_delete_sei_message; instead, use
asserts to ensure that the required conditions are met and remove the
callers' checks for the return value. Also, document said conditions.
An assert that is essentially equivalent to the one used in
ff_cbs_delete_unit has been removed, too.
Signed-off-by: Andreas Rheinhardt
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d9418aba66e7f9d32c11d0ee1b8cddaf1e68e1b6
---
libavcodec/cbs_h264.h | 11 +++
libavcodec/cbs_h2645.c | 11 ---
libavcodec/h264_metadata_bsf.c | 21 +
3 files changed, 16 insertions(+), 27 deletions(-)
diff --git a/libavcodec/cbs_h264.h b/libavcodec/cbs_h264.h
index a31be298ba..b39e7480c9 100644
--- a/libavcodec/cbs_h264.h
+++ b/libavcodec/cbs_h264.h
@@ -478,10 +478,13 @@ int ff_cbs_h264_add_sei_message(CodedBitstreamContext
*ctx,
*
* Deletes from nal_unit, which must be an SEI NAL unit. If this is the
* last message in nal_unit, also deletes it from access_unit.
+ *
+ * Requires nal_unit to be a unit in access_unit and position to be >= 0
+ * and < the payload count of the SEI nal_unit.
*/
-int ff_cbs_h264_delete_sei_message(CodedBitstreamContext *ctx,
- CodedBitstreamFragment *access_unit,
- CodedBitstreamUnit *nal_unit,
- int position);
+void ff_cbs_h264_delete_sei_message(CodedBitstreamContext *ctx,
+CodedBitstreamFragment *access_unit,
+CodedBitstreamUnit *nal_unit,
+int position);
#endif /* AVCODEC_CBS_H264_H */
diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
index 484b145852..b286269913 100644
--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -1644,10 +1644,10 @@ int ff_cbs_h264_add_sei_message(CodedBitstreamContext
*ctx,
return 0;
}
-int ff_cbs_h264_delete_sei_message(CodedBitstreamContext *ctx,
- CodedBitstreamFragment *au,
- CodedBitstreamUnit *nal,
- int position)
+void ff_cbs_h264_delete_sei_message(CodedBitstreamContext *ctx,
+CodedBitstreamFragment *au,
+CodedBitstreamUnit *nal,
+int position)
{
H264RawSEI *sei = nal->content;
@@ -1662,7 +1662,6 @@ int ff_cbs_h264_delete_sei_message(CodedBitstreamContext
*ctx,
if (>units[i] == nal)
break;
}
-av_assert0(i < au->nb_units && "NAL unit not in access unit.");
ff_cbs_delete_unit(ctx, au, i);
} else {
@@ -1673,6 +1672,4 @@ int ff_cbs_h264_delete_sei_message(CodedBitstreamContext
*ctx,
sei->payload + position + 1,
(sei->payload_count - position) * sizeof(*sei->payload));
}
-
-return 0;
}
diff --git a/libavcodec/h264_metadata_bsf.c b/libavcodec/h264_metadata_bsf.c
index e40baa3371..1c1c340d8f 100644
--- a/libavcodec/h264_metadata_bsf.c
+++ b/libavcodec/h264_metadata_bsf.c
@@ -437,15 +437,9 @@ static int h264_metadata_filter(AVBSFContext *bsf,
AVPacket *pkt)
for (j = sei->payload_count - 1; j >= 0; j--) {
if (sei->payload[j].payload_type ==
-H264_SEI_TYPE_FILLER_PAYLOAD) {
-err = ff_cbs_h264_delete_sei_message(ctx->cbc, au,
- >units[i], j);
-if (err < 0) {
-av_log(bsf, AV_LOG_ERROR, "Failed to delete "
- "filler SEI message.\n");
-goto fail;
-}
-}
+H264_SEI_TYPE_FILLER_PAYLOAD)
+ff_cbs_h264_delete_sei_message(ctx->cbc, au,
+ >units[i], j);
}
}
}
@@ -469,13 +463,8 @@ static int h264_metadata_filter(AVBSFContext *bsf,
AVPacket *pkt)
if (ctx->display_orientation == REMOVE ||
ctx->display_orientation == INSERT) {
-err = ff_cbs_h264_delete_sei_message(ctx->cbc, au,
- >units[i], j);
-if (err < 0) {
-av_log(bsf, AV_LOG_ERROR, "Failed to delete "
- "display orientation SEI message.\n");
-goto fail;
-
[FFmpeg-cvslog] cbs: ff_cbs_delete_unit: Replace return value with assert
ffmpeg | branch: master | Andreas Rheinhardt |
Mon Jul 8 01:14:01 2019 +0200| [730e5be3aa1118a63132122dd06aa4f3311af07d] |
committer: Mark Thompson
cbs: ff_cbs_delete_unit: Replace return value with assert
ff_cbs_delete_unit never fails if the index of the unit to delete is
valid, as it is with all current callers of the function. So just assert
in ff_cbs_delete_unit that the index is valid and change the return
value to void in order to remove the callers' checks for whether
ff_cbs_delete_unit failed.
Signed-off-by: Andreas Rheinhardt
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=730e5be3aa1118a63132122dd06aa4f3311af07d
---
libavcodec/av1_metadata_bsf.c | 9 ++---
libavcodec/cbs.c| 12 +---
libavcodec/cbs.h| 8 +---
libavcodec/cbs_h2645.c | 6 +++---
libavcodec/h264_metadata_bsf.c | 8 +---
libavcodec/h264_redundant_pps_bsf.c | 4 +---
6 files changed, 17 insertions(+), 30 deletions(-)
diff --git a/libavcodec/av1_metadata_bsf.c b/libavcodec/av1_metadata_bsf.c
index bb2ca2075b..226f7dffa4 100644
--- a/libavcodec/av1_metadata_bsf.c
+++ b/libavcodec/av1_metadata_bsf.c
@@ -167,13 +167,8 @@ static int av1_metadata_filter(AVBSFContext *bsf, AVPacket
*pkt)
if (ctx->delete_padding) {
for (i = frag->nb_units - 1; i >= 0; i--) {
-if (frag->units[i].type == AV1_OBU_PADDING) {
-err = ff_cbs_delete_unit(ctx->cbc, frag, i);
-if (err < 0) {
-av_log(bsf, AV_LOG_ERROR, "Failed to delete Padding
OBU.\n");
-goto fail;
-}
-}
+if (frag->units[i].type == AV1_OBU_PADDING)
+ff_cbs_delete_unit(ctx->cbc, frag, i);
}
}
diff --git a/libavcodec/cbs.c b/libavcodec/cbs.c
index 47679eca1b..2350416501 100644
--- a/libavcodec/cbs.c
+++ b/libavcodec/cbs.c
@@ -737,12 +737,12 @@ int ff_cbs_insert_unit_data(CodedBitstreamContext *ctx,
return 0;
}
-int ff_cbs_delete_unit(CodedBitstreamContext *ctx,
- CodedBitstreamFragment *frag,
- int position)
+void ff_cbs_delete_unit(CodedBitstreamContext *ctx,
+CodedBitstreamFragment *frag,
+int position)
{
-if (position < 0 || position >= frag->nb_units)
-return AVERROR(EINVAL);
+av_assert0(0 <= position && position < frag->nb_units
+ && "Unit to be deleted not in fragment.");
cbs_unit_uninit(ctx, >units[position]);
@@ -752,6 +752,4 @@ int ff_cbs_delete_unit(CodedBitstreamContext *ctx,
memmove(frag->units + position,
frag->units + position + 1,
(frag->nb_units - position) * sizeof(*frag->units));
-
-return 0;
}
diff --git a/libavcodec/cbs.h b/libavcodec/cbs.h
index 5260a39c63..fe57e7b2a5 100644
--- a/libavcodec/cbs.h
+++ b/libavcodec/cbs.h
@@ -380,10 +380,12 @@ int ff_cbs_insert_unit_data(CodedBitstreamContext *ctx,
/**
* Delete a unit from a fragment and free all memory it uses.
+ *
+ * Requires position to be >= 0 and < frag->nb_units.
*/
-int ff_cbs_delete_unit(CodedBitstreamContext *ctx,
- CodedBitstreamFragment *frag,
- int position);
+void ff_cbs_delete_unit(CodedBitstreamContext *ctx,
+CodedBitstreamFragment *frag,
+int position);
#endif /* AVCODEC_CBS_H */
diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
index 0456937710..484b145852 100644
--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -1664,7 +1664,7 @@ int ff_cbs_h264_delete_sei_message(CodedBitstreamContext
*ctx,
}
av_assert0(i < au->nb_units && "NAL unit not in access unit.");
-return ff_cbs_delete_unit(ctx, au, i);
+ff_cbs_delete_unit(ctx, au, i);
} else {
cbs_h264_free_sei_payload(>payload[position]);
@@ -1672,7 +1672,7 @@ int ff_cbs_h264_delete_sei_message(CodedBitstreamContext
*ctx,
memmove(sei->payload + position,
sei->payload + position + 1,
(sei->payload_count - position) * sizeof(*sei->payload));
-
-return 0;
}
+
+return 0;
}
diff --git a/libavcodec/h264_metadata_bsf.c b/libavcodec/h264_metadata_bsf.c
index f7ca1f0f09..e40baa3371 100644
--- a/libavcodec/h264_metadata_bsf.c
+++ b/libavcodec/h264_metadata_bsf.c
@@ -427,13 +427,7 @@ static int h264_metadata_filter(AVBSFContext *bsf,
AVPacket *pkt)
if (ctx->delete_filler) {
for (i = au->nb_units - 1; i >= 0; i--) {
if (au->units[i].type == H264_NAL_FILLER_DATA) {
-// Filler NAL units.
-err = ff_cbs_delete_unit(ctx->cbc, au, i);
-if (err < 0) {
-av_log(bsf, AV_LOG_ERROR, "Failed to delete "
- "filler NAL.\n");
-goto fail;
-
[FFmpeg-cvslog] lavd/avfoundation: Set correct default value 0 for option capture_raw_data.
ffmpeg | branch: master | Thilo Borgmann | Mon Jul 8
19:52:53 2019 +0200| [70a4f46e48da8bc8a547e490f67dde5165227dd8] | committer:
Thilo Borgmann
lavd/avfoundation: Set correct default value 0 for option capture_raw_data.
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=70a4f46e48da8bc8a547e490f67dde5165227dd8
---
libavdevice/avfoundation.m | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavdevice/avfoundation.m b/libavdevice/avfoundation.m
index 9ef6c3cc13..08deecfeea 100644
--- a/libavdevice/avfoundation.m
+++ b/libavdevice/avfoundation.m
@@ -1134,7 +1134,7 @@ static const AVOption options[] = {
{ "video_size", "set video size", offsetof(AVFContext, width),
AV_OPT_TYPE_IMAGE_SIZE, {.str = NULL}, 0, 0, AV_OPT_FLAG_DECODING_PARAM },
{ "capture_cursor", "capture the screen cursor", offsetof(AVFContext,
capture_cursor), AV_OPT_TYPE_BOOL, {.i64=0}, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
{ "capture_mouse_clicks", "capture the screen mouse clicks",
offsetof(AVFContext, capture_mouse_clicks), AV_OPT_TYPE_BOOL, {.i64=0}, 0, 1,
AV_OPT_FLAG_DECODING_PARAM },
-{ "capture_raw_data", "capture the raw data from device connection",
offsetof(AVFContext, capture_raw_data), AV_OPT_TYPE_BOOL, {.i64=1}, 0, 1,
AV_OPT_FLAG_DECODING_PARAM },
+{ "capture_raw_data", "capture the raw data from device connection",
offsetof(AVFContext, capture_raw_data), AV_OPT_TYPE_BOOL, {.i64=0}, 0, 1,
AV_OPT_FLAG_DECODING_PARAM },
{ NULL },
};
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] lavd/avfoundation: Remove useless index increment.
ffmpeg | branch: master | Thilo Borgmann | Sun Jun 30
13:56:08 2019 +0200| [48cf952411527c8c91f7d9c87003258ae80c6c56] | committer:
Thilo Borgmann
lavd/avfoundation: Remove useless index increment.
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=48cf952411527c8c91f7d9c87003258ae80c6c56
---
libavdevice/avfoundation.m | 1 -
1 file changed, 1 deletion(-)
diff --git a/libavdevice/avfoundation.m b/libavdevice/avfoundation.m
index 98552ac29d..88fe050da9 100644
--- a/libavdevice/avfoundation.m
+++ b/libavdevice/avfoundation.m
@@ -690,7 +690,6 @@ static int avf_read_header(AVFormatContext *s)
const char *name = [[device localizedName] UTF8String];
index= [devices indexOfObject:device];
av_log(ctx, AV_LOG_INFO, "[%d] %s\n", index, name);
-index++;
}
#if !TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
if (num_screens > 0) {
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] lavd/avfoundation: Reindent after last commit.
ffmpeg | branch: master | Thilo Borgmann | Mon Jul 8
19:39:35 2019 +0200| [5c2e0e417ac8ff6ae34c98bb982974d65cc35deb] | committer:
Thilo Borgmann
lavd/avfoundation: Reindent after last commit.
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5c2e0e417ac8ff6ae34c98bb982974d65cc35deb
---
libavdevice/avfoundation.m | 108 ++---
1 file changed, 54 insertions(+), 54 deletions(-)
diff --git a/libavdevice/avfoundation.m b/libavdevice/avfoundation.m
index a28dca7448..9ef6c3cc13 100644
--- a/libavdevice/avfoundation.m
+++ b/libavdevice/avfoundation.m
@@ -297,59 +297,59 @@ static int configure_video_device(AVFormatContext *s,
AVCaptureDevice *video_dev
// might raise an exception if no format list is given
// (then fallback to default, no configuration)
@try {
-for (format in [video_device valueForKey:@"formats"]) {
-CMFormatDescriptionRef formatDescription;
-CMVideoDimensions dimensions;
+for (format in [video_device valueForKey:@"formats"]) {
+CMFormatDescriptionRef formatDescription;
+CMVideoDimensions dimensions;
-formatDescription = (CMFormatDescriptionRef) [format
performSelector:@selector(formatDescription)];
-dimensions = CMVideoFormatDescriptionGetDimensions(formatDescription);
+formatDescription = (CMFormatDescriptionRef) [format
performSelector:@selector(formatDescription)];
+dimensions =
CMVideoFormatDescriptionGetDimensions(formatDescription);
-if ((ctx->width == 0 && ctx->height == 0) ||
-(dimensions.width == ctx->width && dimensions.height ==
ctx->height)) {
+if ((ctx->width == 0 && ctx->height == 0) ||
+(dimensions.width == ctx->width && dimensions.height ==
ctx->height)) {
-selected_format = format;
+selected_format = format;
-for (range in [format
valueForKey:@"videoSupportedFrameRateRanges"]) {
-double max_framerate;
+for (range in [format
valueForKey:@"videoSupportedFrameRateRanges"]) {
+double max_framerate;
-[[range valueForKey:@"maxFrameRate"] getValue:_framerate];
-if (fabs (framerate - max_framerate) < 0.01) {
-selected_range = range;
-break;
+[[range valueForKey:@"maxFrameRate"]
getValue:_framerate];
+if (fabs (framerate - max_framerate) < 0.01) {
+selected_range = range;
+break;
+}
}
}
}
-}
-
-if (!selected_format) {
-av_log(s, AV_LOG_ERROR, "Selected video size (%dx%d) is not supported
by the device.\n",
-ctx->width, ctx->height);
-goto unsupported_format;
-}
-if (!selected_range) {
-av_log(s, AV_LOG_ERROR, "Selected framerate (%f) is not supported by
the device.\n",
-framerate);
-if (ctx->video_is_muxed) {
-av_log(s, AV_LOG_ERROR, "Falling back to default.\n");
-} else {
-goto unsupported_format;
+if (!selected_format) {
+av_log(s, AV_LOG_ERROR, "Selected video size (%dx%d) is not
supported by the device.\n",
+ctx->width, ctx->height);
+goto unsupported_format;
}
-}
-if ([video_device lockForConfiguration:NULL] == YES) {
-if (selected_format) {
-[video_device setValue:selected_format forKey:@"activeFormat"];
+if (!selected_range) {
+av_log(s, AV_LOG_ERROR, "Selected framerate (%f) is not supported
by the device.\n",
+framerate);
+if (ctx->video_is_muxed) {
+av_log(s, AV_LOG_ERROR, "Falling back to default.\n");
+} else {
+goto unsupported_format;
+}
}
-if (selected_range) {
-NSValue *min_frame_duration = [selected_range
valueForKey:@"minFrameDuration"];
-[video_device setValue:min_frame_duration
forKey:@"activeVideoMinFrameDuration"];
-[video_device setValue:min_frame_duration
forKey:@"activeVideoMaxFrameDuration"];
+
+if ([video_device lockForConfiguration:NULL] == YES) {
+if (selected_format) {
+[video_device setValue:selected_format forKey:@"activeFormat"];
+}
+if (selected_range) {
+NSValue *min_frame_duration = [selected_range
valueForKey:@"minFrameDuration"];
+[video_device setValue:min_frame_duration
forKey:@"activeVideoMinFrameDuration"];
+[video_device setValue:min_frame_duration
forKey:@"activeVideoMaxFrameDuration"];
+}
+} else {
+av_log(s, AV_LOG_ERROR, "Could not lock device for
configuration.\n");
+return AVERROR(EINVAL);
}
-} else {
-
[FFmpeg-cvslog] lavd/avfoundation: Support muxed type of devices including raw muxed data capture.
ffmpeg | branch: master | Thilo Borgmann | Mon Jul 8
13:33:29 2019 +0200| [02f65678ba9b5958cf53d1e5bc29939d941ad95f] | committer:
Thilo Borgmann
lavd/avfoundation: Support muxed type of devices including raw muxed data
capture.
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=02f65678ba9b5958cf53d1e5bc29939d941ad95f
---
libavdevice/avfoundation.m | 89 +-
1 file changed, 80 insertions(+), 9 deletions(-)
diff --git a/libavdevice/avfoundation.m b/libavdevice/avfoundation.m
index 17fdd253ef..a28dca7448 100644
--- a/libavdevice/avfoundation.m
+++ b/libavdevice/avfoundation.m
@@ -97,6 +97,8 @@ typedef struct
int capture_cursor;
int capture_mouse_clicks;
+int capture_raw_data;
+int video_is_muxed;
int list_devices;
int video_device_index;
@@ -291,6 +293,10 @@ static int configure_video_device(AVFormatContext *s,
AVCaptureDevice *video_dev
NSObject *selected_range = nil;
NSObject *selected_format = nil;
+// try to configure format by formats list
+// might raise an exception if no format list is given
+// (then fallback to default, no configuration)
+@try {
for (format in [video_device valueForKey:@"formats"]) {
CMFormatDescriptionRef formatDescription;
CMVideoDimensions dimensions;
@@ -324,19 +330,29 @@ static int configure_video_device(AVFormatContext *s,
AVCaptureDevice *video_dev
if (!selected_range) {
av_log(s, AV_LOG_ERROR, "Selected framerate (%f) is not supported by
the device.\n",
framerate);
+if (ctx->video_is_muxed) {
+av_log(s, AV_LOG_ERROR, "Falling back to default.\n");
+} else {
goto unsupported_format;
+}
}
if ([video_device lockForConfiguration:NULL] == YES) {
+if (selected_format) {
+[video_device setValue:selected_format forKey:@"activeFormat"];
+}
+if (selected_range) {
NSValue *min_frame_duration = [selected_range
valueForKey:@"minFrameDuration"];
-
-[video_device setValue:selected_format forKey:@"activeFormat"];
[video_device setValue:min_frame_duration
forKey:@"activeVideoMinFrameDuration"];
[video_device setValue:min_frame_duration
forKey:@"activeVideoMaxFrameDuration"];
+}
} else {
av_log(s, AV_LOG_ERROR, "Could not lock device for configuration.\n");
return AVERROR(EINVAL);
}
+} @catch(NSException *e) {
+av_log(ctx, AV_LOG_WARNING, "Configuration of video device failed,
falling back to default.\n");
+}
return 0;
@@ -468,12 +484,18 @@ static int add_video_device(AVFormatContext *s,
AVCaptureDevice *video_device)
}
}
+// set videoSettings to an empty dict for receiving raw data of muxed
devices
+if (ctx->capture_raw_data) {
+ctx->pixel_format = pxl_fmt_spec.ff_id;
+ctx->video_output.videoSettings = @{ };
+} else {
ctx->pixel_format = pxl_fmt_spec.ff_id;
pixel_format = [NSNumber numberWithUnsignedInt:pxl_fmt_spec.avf_id];
capture_dict = [NSDictionary dictionaryWithObject:pixel_format
forKey:(id)kCVPixelBufferPixelFormatTypeKey];
[ctx->video_output setVideoSettings:capture_dict];
+}
[ctx->video_output setAlwaysDiscardsLateVideoFrames:YES];
ctx->avf_delegate = [[AVFFrameReceiver alloc] initWithContext:ctx];
@@ -540,6 +562,7 @@ static int get_video_config(AVFormatContext *s)
{
AVFContext *ctx = (AVFContext*)s->priv_data;
CVImageBufferRef image_buffer;
+CMBlockBufferRef block_buffer;
CGSize image_buffer_size;
AVStream* stream = avformat_new_stream(s, NULL);
@@ -558,14 +581,22 @@ static int get_video_config(AVFormatContext *s)
avpriv_set_pts_info(stream, 64, 1, avf_time_base);
-image_buffer = CMSampleBufferGetImageBuffer(ctx->current_frame);
-image_buffer_size = CVImageBufferGetEncodedSize(image_buffer);
+image_buffer = CMSampleBufferGetImageBuffer(ctx->current_frame);
+block_buffer = CMSampleBufferGetDataBuffer(ctx->current_frame);
+
+if (image_buffer) {
+image_buffer_size = CVImageBufferGetEncodedSize(image_buffer);
stream->codecpar->codec_id = AV_CODEC_ID_RAWVIDEO;
stream->codecpar->codec_type = AVMEDIA_TYPE_VIDEO;
stream->codecpar->width = (int)image_buffer_size.width;
stream->codecpar->height = (int)image_buffer_size.height;
stream->codecpar->format = ctx->pixel_format;
+} else {
+stream->codecpar->codec_id = AV_CODEC_ID_DVVIDEO;
+stream->codecpar->codec_type = AVMEDIA_TYPE_VIDEO;
+stream->codecpar->format = ctx->pixel_format;
+}
CFRelease(ctx->current_frame);
ctx->current_frame = nil;
@@ -670,8 +701,9 @@ static int avf_read_header(AVFormatContext *s)
[FFmpeg-cvslog] doc/indevs: Add new option and example to avfoundation.
ffmpeg | branch: master | Thilo Borgmann | Mon Jul 8 19:52:10 2019 +0200| [d16f2fafae10ae99b16f53a34cf1486aafe93907] | committer: Thilo Borgmann doc/indevs: Add new option and example to avfoundation. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d16f2fafae10ae99b16f53a34cf1486aafe93907 --- doc/indevs.texi | 10 ++ 1 file changed, 10 insertions(+) diff --git a/doc/indevs.texi b/doc/indevs.texi index 89ba4fb406..14595774f3 100644 --- a/doc/indevs.texi +++ b/doc/indevs.texi @@ -178,6 +178,9 @@ Capture the mouse pointer. Default is 0. @item -capture_mouse_clicks Capture the screen mouse clicks. Default is 0. +@item -capture_raw_data +Capture the raw device data. Default is 0. +Using this option may result in receiving the underlying data delivered to the AVFoundation framework. E.g. for muxed devices that sends raw DV data to the framework (like tape-based camcorders), setting this option to false results in extracted video frames captured in the designated pixel format only. Setting this option to true results in receiving the raw DV stream untouched. @end table @subsection Examples @@ -208,6 +211,13 @@ Record video from the system default video device using the pixel format bgr0 an $ ffmpeg -f avfoundation -pixel_format bgr0 -i "default:none" out.avi @end example +@item +Record raw DV data from a suitable input device and write the output into out.dv: +@example +$ ffmpeg -f avfoundation -capture_raw_data true -i "zr100:none" out.dv +@end example + + @end itemize @section bktr ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] lavd/avfoundation: Refine some log messages.
ffmpeg | branch: master | Thilo Borgmann | Mon Jul 8
13:32:22 2019 +0200| [3a5f9ab8146d0350349410498ca613f0ffc14da4] | committer:
Thilo Borgmann
lavd/avfoundation: Refine some log messages.
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3a5f9ab8146d0350349410498ca613f0ffc14da4
---
libavdevice/avfoundation.m | 8
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavdevice/avfoundation.m b/libavdevice/avfoundation.m
index 321acec10f..17fdd253ef 100644
--- a/libavdevice/avfoundation.m
+++ b/libavdevice/avfoundation.m
@@ -316,13 +316,13 @@ static int configure_video_device(AVFormatContext *s,
AVCaptureDevice *video_dev
}
if (!selected_format) {
-av_log(s, AV_LOG_ERROR, "Selected video size (%dx%d) is not supported
by the device\n",
+av_log(s, AV_LOG_ERROR, "Selected video size (%dx%d) is not supported
by the device.\n",
ctx->width, ctx->height);
goto unsupported_format;
}
if (!selected_range) {
-av_log(s, AV_LOG_ERROR, "Selected framerate (%f) is not supported by
the device\n",
+av_log(s, AV_LOG_ERROR, "Selected framerate (%f) is not supported by
the device.\n",
framerate);
goto unsupported_format;
}
@@ -334,7 +334,7 @@ static int configure_video_device(AVFormatContext *s,
AVCaptureDevice *video_dev
[video_device setValue:min_frame_duration
forKey:@"activeVideoMinFrameDuration"];
[video_device setValue:min_frame_duration
forKey:@"activeVideoMaxFrameDuration"];
} else {
-av_log(s, AV_LOG_ERROR, "Could not lock device for configuration");
+av_log(s, AV_LOG_ERROR, "Could not lock device for configuration.\n");
return AVERROR(EINVAL);
}
@@ -908,7 +908,7 @@ static int copy_cvpixelbuffer(AVFormatContext *s,
status = CVPixelBufferLockBaseAddress(image_buffer, 0);
if (status != kCVReturnSuccess) {
-av_log(s, AV_LOG_ERROR, "Could not lock base address: %d\n", status);
+av_log(s, AV_LOG_ERROR, "Could not lock base address: %d (%dx%d)\n",
status, width, height);
return AVERROR_EXTERNAL;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] lavd/avfoundation: Change binary Options to boolean type.
ffmpeg | branch: master | Thilo Borgmann | Mon Jul 8
13:29:40 2019 +0200| [7d4df4b3393904e6a7fc0304a3daa086d8fb44a2] | committer:
Thilo Borgmann
lavd/avfoundation: Change binary Options to boolean type.
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7d4df4b3393904e6a7fc0304a3daa086d8fb44a2
---
libavdevice/avfoundation.m | 8 +++-
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/libavdevice/avfoundation.m b/libavdevice/avfoundation.m
index 88fe050da9..321acec10f 100644
--- a/libavdevice/avfoundation.m
+++ b/libavdevice/avfoundation.m
@@ -1056,16 +1056,14 @@ static int avf_close(AVFormatContext *s)
}
static const AVOption options[] = {
-{ "list_devices", "list available devices", offsetof(AVFContext,
list_devices), AV_OPT_TYPE_INT, {.i64=0}, 0, 1, AV_OPT_FLAG_DECODING_PARAM,
"list_devices" },
-{ "true", "", 0, AV_OPT_TYPE_CONST, {.i64=1}, 0, 0,
AV_OPT_FLAG_DECODING_PARAM, "list_devices" },
-{ "false", "", 0, AV_OPT_TYPE_CONST, {.i64=0}, 0, 0,
AV_OPT_FLAG_DECODING_PARAM, "list_devices" },
+{ "list_devices", "list available devices", offsetof(AVFContext,
list_devices), AV_OPT_TYPE_BOOL, {.i64=0}, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
{ "video_device_index", "select video device by index for devices with
same name (starts at 0)", offsetof(AVFContext, video_device_index),
AV_OPT_TYPE_INT, {.i64 = -1}, -1, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
{ "audio_device_index", "select audio device by index for devices with
same name (starts at 0)", offsetof(AVFContext, audio_device_index),
AV_OPT_TYPE_INT, {.i64 = -1}, -1, INT_MAX, AV_OPT_FLAG_DECODING_PARAM },
{ "pixel_format", "set pixel format", offsetof(AVFContext, pixel_format),
AV_OPT_TYPE_PIXEL_FMT, {.i64 = AV_PIX_FMT_YUV420P}, 0, INT_MAX,
AV_OPT_FLAG_DECODING_PARAM},
{ "framerate", "set frame rate", offsetof(AVFContext, framerate),
AV_OPT_TYPE_VIDEO_RATE, {.str = "ntsc"}, 0, INT_MAX, AV_OPT_FLAG_DECODING_PARAM
},
{ "video_size", "set video size", offsetof(AVFContext, width),
AV_OPT_TYPE_IMAGE_SIZE, {.str = NULL}, 0, 0, AV_OPT_FLAG_DECODING_PARAM },
-{ "capture_cursor", "capture the screen cursor", offsetof(AVFContext,
capture_cursor), AV_OPT_TYPE_INT, {.i64=0}, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
-{ "capture_mouse_clicks", "capture the screen mouse clicks",
offsetof(AVFContext, capture_mouse_clicks), AV_OPT_TYPE_INT, {.i64=0}, 0, 1,
AV_OPT_FLAG_DECODING_PARAM },
+{ "capture_cursor", "capture the screen cursor", offsetof(AVFContext,
capture_cursor), AV_OPT_TYPE_BOOL, {.i64=0}, 0, 1, AV_OPT_FLAG_DECODING_PARAM },
+{ "capture_mouse_clicks", "capture the screen mouse clicks",
offsetof(AVFContext, capture_mouse_clicks), AV_OPT_TYPE_BOOL, {.i64=0}, 0, 1,
AV_OPT_FLAG_DECODING_PARAM },
{ NULL },
};
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] [ffmpeg-web] branch master updated. 6c3cd94 web/download: add 4.1.4
The branch, master has been updated via 6c3cd94aa96cc37e9a2c1e6b512471526d27fde8 (commit) from 3c37e57087d5bfbdf4f4fbd777cadf6121905a01 (commit) - Log - commit 6c3cd94aa96cc37e9a2c1e6b512471526d27fde8 Author: Michael Niedermayer AuthorDate: Mon Jul 8 20:21:21 2019 +0200 Commit: Michael Niedermayer CommitDate: Mon Jul 8 20:21:50 2019 +0200 web/download: add 4.1.4 diff --git a/src/download b/src/download index 9544de2..e72b6bd 100644 --- a/src/download +++ b/src/download @@ -1,10 +1,10 @@ -https://ffmpeg.org/releases/ffmpeg-4.1.3.tar.bz2; class="btn btn-success"> +https://ffmpeg.org/releases/ffmpeg-4.1.4.tar.bz2; class="btn btn-success"> Download - ffmpeg-4.1.3.tar.bz2 + ffmpeg-4.1.4.tar.bz2 More releases @@ -269,10 +269,10 @@ and much faster bug fixes such as additional features and security patches. - FFmpeg 4.1.3 "al-Khwarizmi" + FFmpeg 4.1.4 "al-Khwarizmi" -4.1.3 was released on 2019-04-01. It is the latest stable FFmpeg release +4.1.4 was released on 2019-07-08. It is the latest stable FFmpeg release from the 4.1 release branch, which was cut from master on 2018-11-02. It includes the following library versions: @@ -289,19 +289,19 @@ libpostproc55. 3.100 - Download xz tarball - PGP signature + Download xz tarball + PGP signature - Download bzip2 tarball - PGP signature + Download bzip2 tarball + PGP signature - Download gzip tarball - PGP signature + Download gzip tarball + PGP signature - https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1.3;>Changelog + https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1.4;>Changelog https://git.ffmpeg.org/gitweb/ffmpeg.git/blob/refs/heads/release/4.1:/RELEASE_NOTES;>Release Notes --- Summary of changes: src/download | 22 +++--- 1 file changed, 11 insertions(+), 11 deletions(-) hooks/post-receive -- ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] Tag n4.1.4 : FFmpeg 4.1.4 release
[ffmpeg] [branch: refs/tags/n4.1.4] Tag:8eece4338540f09698b5f99b97f7818e68753e07 > http://git.videolan.org/gitweb.cgi/ffmpeg.git?a=tag;h=8eece4338540f09698b5f99b97f7818e68753e07 Tagger: Michael Niedermayer Date: Mon Jul 8 20:12:31 2019 +0200 FFmpeg 4.1.4 release ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] Changelog: fix typo
ffmpeg | branch: release/4.1 | Michael Niedermayer | Mon Jul 8 20:10:55 2019 +0200| [9d06c1f95ebe4f9c2cc05d041dbfd3de52d2518a] | committer: Michael Niedermayer Changelog: fix typo Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9d06c1f95ebe4f9c2cc05d041dbfd3de52d2518a --- Changelog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Changelog b/Changelog index 959a737033..84b557b1b7 100644 --- a/Changelog +++ b/Changelog @@ -1,7 +1,7 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. -versiob 4.1.4: +version 4.1.4: avcodec/ilbcdec: Simplify use of unsigned and fix more undefined overflows avcodec/golomb: Correct the doxy about get_ue_golomb() and errors avformat/utils: Check timebase before use in estimate_timings() ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] doc/filters: document new readeia608 option
ffmpeg | branch: master | Paul B Mahol | Mon Jul 8 19:30:48
2019 +0200| [43160c7bc476643e3bc0c3a3f045d2c248a25bd2] | committer: Paul B Mahol
doc/filters: document new readeia608 option
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=43160c7bc476643e3bc0c3a3f045d2c248a25bd2
---
doc/filters.texi | 3 +++
1 file changed, 3 insertions(+)
diff --git a/doc/filters.texi b/doc/filters.texi
index b0c49265e2..ccbffab6ae 100644
--- a/doc/filters.texi
+++ b/doc/filters.texi
@@ -14689,6 +14689,9 @@ Set the black color threshold. Default is @code{0.15}.
Allowed range is @code{[0
@item chp
Enable checking the parity bit. In the event of a parity error, the filter
will output
@code{0x00} for that character. Default is false.
+
+@item lp
+Lowpass lines prior further proccessing. Default is disabled.
@end table
@subsection Examples
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avfilter/vf_readeia608: implement lowpass operation prior to processing lines
ffmpeg | branch: master | Paul B Mahol | Mon Jul 8 19:19:52
2019 +0200| [9e78c73d8628202bd232a48127f474887631386c] | committer: Paul B Mahol
avfilter/vf_readeia608: implement lowpass operation prior to processing lines
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9e78c73d8628202bd232a48127f474887631386c
---
libavfilter/vf_readeia608.c | 49 +
1 file changed, 45 insertions(+), 4 deletions(-)
diff --git a/libavfilter/vf_readeia608.c b/libavfilter/vf_readeia608.c
index bc3abe7c4d..27a0c58321 100644
--- a/libavfilter/vf_readeia608.c
+++ b/libavfilter/vf_readeia608.c
@@ -51,6 +51,8 @@ typedef struct ReadEIA608Context {
int black;
float mpd, mhd, msd, mac, spw, bhd, wth, bth;
int chp;
+int lp;
+uint8_t *temp;
} ReadEIA608Context;
#define OFFSET(x) offsetof(ReadEIA608Context, x)
@@ -68,6 +70,7 @@ static const AVOption readeia608_options[] = {
{ "th_w", "set white color threshold",
OFFSET(wth), AV_OPT_TYPE_FLOAT, {.dbl=.35}, 0.1, 1, FLAGS },
{ "th_b", "set black color threshold",
OFFSET(bth), AV_OPT_TYPE_FLOAT, {.dbl=.15}, 0, 0.5, FLAGS },
{ "chp", "check and apply parity bit",
OFFSET(chp), AV_OPT_TYPE_BOOL, {.i64= 0}, 0, 1, FLAGS },
+{ "lp", "lowpass line prior to processing",
OFFSET(lp),AV_OPT_TYPE_BOOL, {.i64= 0}, 0, 1, FLAGS },
{ NULL }
};
@@ -114,6 +117,9 @@ static int config_input(AVFilterLink *inlink)
s->max_start_diff = s->msd * ((1 << depth) - 1);
s->white = s->wth * ((1 << depth) - 1);
s->black = s->bth * ((1 << depth) - 1);
+s->temp = av_calloc(inlink->w, sizeof(*s->temp));
+if (!s->temp)
+return AVERROR(ENOMEM);
return 0;
}
@@ -132,6 +138,25 @@ static void extract_line(AVFilterContext *ctx,
AVFilterLink *inlink, AVFrame *in
int s1, s2, s3, parity;
src = >data[0][line * in->linesize[0]];
+
+if (s->lp) {
+uint8_t *dst = s->temp;
+int w = inlink->w - 1;
+
+for (i = 0; i < inlink->w; i++) {
+int a = FFMAX(i - 3, 0);
+int b = FFMAX(i - 2, 0);
+int c = FFMAX(i - 1, 0);
+int d = FFMIN(i + 3, w);
+int e = FFMIN(i + 2, w);
+int f = FFMIN(i + 1, w);
+
+dst[i] = (src[a] + src[b] + src[c] + src[i] + src[d] + src[e] +
src[f] + 6) / 7;
+}
+
+src = s->temp;
+}
+
for (i = 0; i < sync_width; i++) {
max = FFMAX(max, src[i]);
min = FFMIN(min, src[i]);
@@ -163,14 +188,18 @@ static void extract_line(AVFilterContext *ctx,
AVFilterLink *inlink, AVFrame *in
last = Y;
}
-if (peaks != 7)
+if (peaks != 7) {
+av_log(ctx, AV_LOG_DEBUG, "peaks: %d != 7\n", peaks);
return;
+}
for (i = 1; i < 7; i++)
max_peak_diff = FFMAX(max_peak_diff, FFABS(clock[i][0] -
clock[i-1][0]));
-if (max_peak_diff > s->max_peak_diff)
+if (max_peak_diff > s->max_peak_diff) {
+av_log(ctx, AV_LOG_DEBUG, "mhd: %d > %d\n", max_peak_diff,
s->max_peak_diff);
return;
+}
max = 0; min = INT_MAX;
for (i = 1; i < 7; i++) {
@@ -179,15 +208,19 @@ static void extract_line(AVFilterContext *ctx,
AVFilterLink *inlink, AVFrame *in
}
range = max - min;
-if (range > s->max_period_diff)
+if (range > s->max_period_diff) {
+av_log(ctx, AV_LOG_DEBUG, "mpd: %d > %d\n", range, s->max_period_diff);
return;
+}
s1 = src[sync_width + width_per_bit * 0 + width_per_bit / 2];
s2 = src[sync_width + width_per_bit * 1 + width_per_bit / 2];
s3 = src[sync_width + width_per_bit * 2 + width_per_bit / 2];
-if (FFABS(s1 - s2) > s->max_start_diff || s1 > s->black || s2 > s->black
|| s3 < s->white)
+if (FFABS(s1 - s2) > s->max_start_diff || s1 > s->black || s2 > s->black
|| s3 < s->white) {
+av_log(ctx, AV_LOG_DEBUG, "msd: %d > %d\n", FFABS(s1 - s2),
s->max_start_diff);
return;
+}
for (ch = 0; ch < 2; ch++) {
for (parity = 0, i = 0; i < 8; i++) {
@@ -238,6 +271,13 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
return ff_filter_frame(outlink, in);
}
+static av_cold void uninit(AVFilterContext *ctx)
+{
+ReadEIA608Context *s = ctx->priv;
+
+av_freep(>temp);
+}
+
static const AVFilterPad readeia608_inputs[] = {
{
.name = "default",
@@ -264,5 +304,6 @@ AVFilter ff_vf_readeia608 = {
.query_formats = query_formats,
.inputs= readeia608_inputs,
.outputs = readeia608_outputs,
+.uninit= uninit,
.flags = AVFILTER_FLAG_SUPPORT_TIMELINE_GENERIC,
};
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
[FFmpeg-cvslog] avfilter/vf_tinterlace: re-enable lowpass option
ffmpeg | branch: master | Paul B Mahol | Mon Jul 8 17:57:31
2019 +0200| [dc481105a1d42ef1d15cd2aa8cffcd96fb395456] | committer: Paul B Mahol
avfilter/vf_tinterlace: re-enable lowpass option
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dc481105a1d42ef1d15cd2aa8cffcd96fb395456
---
libavfilter/vf_tinterlace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavfilter/vf_tinterlace.c b/libavfilter/vf_tinterlace.c
index 22746ebfb1..fc5d11e053 100644
--- a/libavfilter/vf_tinterlace.c
+++ b/libavfilter/vf_tinterlace.c
@@ -63,7 +63,7 @@ static const AVOption interlace_options[] = {
{ "scan", "scanning mode", OFFSET(mode), AV_OPT_TYPE_INT,
{.i64 = MODE_TFF}, 0, 1, FLAGS, "mode"},
{ "tff", "top field first", 0,
AV_OPT_TYPE_CONST, {.i64 = MODE_TFF}, INT_MIN, INT_MAX, FLAGS, .unit = "mode"},
{ "bff", "bottom field first", 0,
AV_OPT_TYPE_CONST, {.i64 = MODE_BFF}, INT_MIN, INT_MAX, FLAGS, .unit = "mode"},
- { "lowpass", "set vertical low-pass filter", OFFSET(flags),
AV_OPT_TYPE_FLAGS, {.i64 = TINTERLACE_FLAG_VLPF}, 0, 2, 0, "flags" },
+ { "lowpass", "set vertical low-pass filter", OFFSET(flags),
AV_OPT_TYPE_FLAGS, {.i64 = TINTERLACE_FLAG_VLPF}, 0, 2, FLAGS, "flags" },
{ "off", "disable vertical low-pass filter", 0,
AV_OPT_TYPE_CONST, {.i64 = 0}, INT_MIN, INT_MAX, FLAGS, "flags" },
{ "linear","linear vertical low-pass filter", 0,
AV_OPT_TYPE_CONST, {.i64 = TINTERLACE_FLAG_VLPF}, INT_MIN, INT_MAX, FLAGS,
"flags" },
{ "complex", "complex vertical low-pass filter", 0,
AV_OPT_TYPE_CONST, {.i64 = TINTERLACE_FLAG_CVLPF},INT_MIN, INT_MAX, FLAGS,
"flags" },
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avfilter/af_aiir: implement mix option
ffmpeg | branch: master | Paul B Mahol | Mon Jul 8 16:44:53
2019 +0200| [2a801e8856da46d6ec4a33fce367dbb5a32b08c0] | committer: Paul B Mahol
avfilter/af_aiir: implement mix option
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2a801e8856da46d6ec4a33fce367dbb5a32b08c0
---
doc/filters.texi | 4
libavfilter/af_aiir.c | 6 ++
2 files changed, 10 insertions(+)
diff --git a/doc/filters.texi b/doc/filters.texi
index 502c06a20f..b0c49265e2 100644
--- a/doc/filters.texi
+++ b/doc/filters.texi
@@ -1409,6 +1409,10 @@ single-precision floating-point
16-bit integers
@end table
+@item mix
+How much to use filtered signal in output. Default is 1.
+Range is between 0 and 1.
+
@item response
Show IR frequency response, magnitude and phase in additional video stream.
By default it is disabled.
diff --git a/libavfilter/af_aiir.c b/libavfilter/af_aiir.c
index 20dea98cbb..5a3b9e849d 100644
--- a/libavfilter/af_aiir.c
+++ b/libavfilter/af_aiir.c
@@ -57,6 +57,7 @@ typedef struct AudioIIRContext {
const AVClass *class;
char *a_str, *b_str, *g_str;
double dry_gain, wet_gain;
+double mix;
int format;
int process;
int precision;
@@ -124,6 +125,7 @@ static int iir_ch_## name(AVFilterContext *ctx, void *arg,
int ch, int nb_jobs)
AudioIIRContext *s = ctx->priv; \
const double ig = s->dry_gain; \
const double og = s->wet_gain; \
+const double mix = s->mix; \
ThreadData *td = arg; \
AVFrame *in = td->in, *out = td->out; \
const type *src = (const type *)in->extended_data[ch]; \
@@ -152,6 +154,7 @@ static int iir_ch_## name(AVFilterContext *ctx, void *arg,
int ch, int nb_jobs)
\
oc[0] = sample; \
sample *= og; \
+sample = sample * mix + ic[0] * (1. - mix); \
if (need_clipping && sample < min) {\
(*clippings)++; \
dst[n] = min; \
@@ -177,6 +180,7 @@ static int iir_ch_serial_## name(AVFilterContext *ctx, void
*arg, int ch, int nb
AudioIIRContext *s = ctx->priv; \
const double ig = s->dry_gain; \
const double og = s->wet_gain; \
+const double mix = s->mix; \
ThreadData *td = arg; \
AVFrame *in = td->in, *out = td->out; \
const type *src = (const type *)in->extended_data[ch]; \
@@ -207,6 +211,7 @@ static int iir_ch_serial_## name(AVFilterContext *ctx, void
*arg, int ch, int nb
o1 = o0;\
o0 *= og; \
\
+o0 = o0 * mix + (1. - mix) * sample;\
if (need_clipping && o0 < min) {\
(*clippings)++; \
dst[n] = min; \
@@ -1074,6 +1079,7 @@ static const AVOption aiir_options[] = {
{ "flt", "single-precision floating-point",0,
AV_OPT_TYPE_CONST, {.i64=1}, 0, 0, AF, "precision" },
{ "i32", "32-bit integers",0,
AV_OPT_TYPE_CONST, {.i64=2}, 0, 0, AF, "precision" },
{ "i16", "16-bit integers",0,
AV_OPT_TYPE_CONST, {.i64=3}, 0, 0, AF, "precision" },
+{ "mix", "set mix",OFFSET(mix),
AV_OPT_TYPE_DOUBLE, {.dbl=1}, 0, 1, AF },
{ "response", "show IR frequency response",OFFSET(response),
AV_OPT_TYPE_BOOL, {.i64=0}, 0, 1, VF },
{ "channel", "set IR channel to display frequency response",
OFFSET(ir_channel), AV_OPT_TYPE_INT, {.i64=0}, 0, 1024, VF },
{ "size", "set video size", OFFSET(w),
AV_OPT_TYPE_IMAGE_SIZE, {.str = "hd720"}, 0, 0, VF },
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avfilter/af_biquads: clip gain picked from command to sane values
ffmpeg | branch: master | Paul B Mahol | Mon Jul 8 16:29:15
2019 +0200| [034a9d2507e124c7fd9269afbbbdc8b1b7b70e88] | committer: Paul B Mahol
avfilter/af_biquads: clip gain picked from command to sane values
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=034a9d2507e124c7fd9269afbbbdc8b1b7b70e88
---
libavfilter/af_biquads.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavfilter/af_biquads.c b/libavfilter/af_biquads.c
index 64b7bb39e5..247a47256f 100644
--- a/libavfilter/af_biquads.c
+++ b/libavfilter/af_biquads.c
@@ -538,7 +538,7 @@ static int process_command(AVFilterContext *ctx, const char
*cmd, const char *ar
return AVERROR(EINVAL);
}
-s->gain = gain;
+s->gain = av_clipd(gain, -900, 900);
} else if (!strcmp(cmd, "mix") || !strcmp(cmd, "m")) {
double mix;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avfilter/af_biquads: implement mix option to all filters
ffmpeg | branch: master | Paul B Mahol | Mon Jul 8 16:20:57
2019 +0200| [7b2d39fc275431749a1fbb02887a0612398a0a26] | committer: Paul B Mahol
avfilter/af_biquads: implement mix option to all filters
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7b2d39fc275431749a1fbb02887a0612398a0a26
---
doc/filters.texi | 68
libavfilter/af_biquads.c | 56 ---
2 files changed, 115 insertions(+), 9 deletions(-)
diff --git a/doc/filters.texi b/doc/filters.texi
index ee6a93ffbf..502c06a20f 100644
--- a/doc/filters.texi
+++ b/doc/filters.texi
@@ -1523,6 +1523,10 @@ kHz
@item width, w
Specify the band-width of a filter in width_type units.
+@item mix, m
+How much to use filtered signal in output. Default is 1.
+Range is between 0 and 1.
+
@item channels, c
Specify which channels to filter, by default all available are filtered.
@end table
@@ -1542,6 +1546,10 @@ Syntax for the command is : "@var{width_type}"
@item width, w
Change allpass width.
Syntax for the command is : "@var{width}"
+
+@item mix, m
+Change allpass mix.
+Syntax for the command is : "@var{mix}"
@end table
@section aloop
@@ -2460,6 +2468,10 @@ kHz
@item width, w
Specify the band-width of a filter in width_type units.
+@item mix, m
+How much to use filtered signal in output. Default is 1.
+Range is between 0 and 1.
+
@item channels, c
Specify which channels to filter, by default all available are filtered.
@end table
@@ -2479,6 +2491,10 @@ Syntax for the command is : "@var{width_type}"
@item width, w
Change bandpass width.
Syntax for the command is : "@var{width}"
+
+@item mix, m
+Change bandpass mix.
+Syntax for the command is : "@var{mix}"
@end table
@section bandreject
@@ -2511,6 +2527,10 @@ kHz
@item width, w
Specify the band-width of a filter in width_type units.
+@item mix, m
+How much to use filtered signal in output. Default is 1.
+Range is between 0 and 1.
+
@item channels, c
Specify which channels to filter, by default all available are filtered.
@end table
@@ -2530,6 +2550,10 @@ Syntax for the command is : "@var{width_type}"
@item width, w
Change bandreject width.
Syntax for the command is : "@var{width}"
+
+@item mix, m
+Change bandreject mix.
+Syntax for the command is : "@var{mix}"
@end table
@section bass, lowshelf
@@ -2569,6 +2593,10 @@ kHz
@item width, w
Determine how steep is the filter's shelf transition.
+@item mix, m
+How much to use filtered signal in output. Default is 1.
+Range is between 0 and 1.
+
@item channels, c
Specify which channels to filter, by default all available are filtered.
@end table
@@ -2592,6 +2620,10 @@ Syntax for the command is : "@var{width}"
@item gain, g
Change bass gain.
Syntax for the command is : "@var{gain}"
+
+@item mix, m
+Change bass mix.
+Syntax for the command is : "@var{mix}"
@end table
@section biquad
@@ -2614,6 +2646,10 @@ This filter supports the following commands:
@item b2
Change biquad parameter.
Syntax for the command is : "@var{value}"
+
+@item mix, m
+How much to use filtered signal in output. Default is 1.
+Range is between 0 and 1.
@end table
@section bs2b
@@ -3303,6 +3339,10 @@ Specify the band-width of a filter in width_type units.
Set the required gain or attenuation in dB.
Beware of clipping when using a positive gain.
+@item mix, m
+How much to use filtered signal in output. Default is 1.
+Range is between 0 and 1.
+
@item channels, c
Specify which channels to filter, by default all available are filtered.
@end table
@@ -3341,6 +3381,10 @@ Syntax for the command is : "@var{width}"
@item gain, g
Change equalizer gain.
Syntax for the command is : "@var{gain}"
+
+@item mix, m
+Change equalizer mix.
+Syntax for the command is : "@var{mix}"
@end table
@section extrastereo
@@ -3764,6 +3808,10 @@ Specify the band-width of a filter in width_type units.
Applies only to double-pole filter.
The default is 0.707q and gives a Butterworth response.
+@item mix, m
+How much to use filtered signal in output. Default is 1.
+Range is between 0 and 1.
+
@item channels, c
Specify which channels to filter, by default all available are filtered.
@end table
@@ -3783,6 +3831,10 @@ Syntax for the command is : "@var{width_type}"
@item width, w
Change highpass width.
Syntax for the command is : "@var{width}"
+
+@item mix, m
+Change highpass mix.
+Syntax for the command is : "@var{mix}"
@end table
@section join
@@ -4072,6 +4124,10 @@ Specify the band-width of a filter in width_type units.
Applies only to double-pole filter.
The default is 0.707q and gives a Butterworth response.
+@item mix, m
+How much to use filtered signal in output. Default is 1.
+Range is between 0 and 1.
+
@item channels, c
Specify which channels to filter, by default all available are filtered.
@end table
@@ -4100,6 +4156,10 @@ Syntax for the command is : "@var{width_type}"
@item width, w
Change lowpass width.
Syntax for the command
[FFmpeg-cvslog] avcodec/qdm2: Check checksum_size for 0
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Mon Jun 24 01:01:04 2019 +0200| [2424d0096e303786fdd4eb6663215f76f8e9da87] |
committer: Michael Niedermayer
avcodec/qdm2: Check checksum_size for 0
Fixes: Infinite loop
Fixes:
15337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5757428949319680
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 7b2ebf89a411d957ca999f1e7a919ff617fbfd56)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2424d0096e303786fdd4eb6663215f76f8e9da87
---
libavcodec/qdm2.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 1e91f477e8..eaffb36dcc 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -1704,8 +1704,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
s->group_size = bytestream2_get_be32();
s->fft_size = bytestream2_get_be32();
s->checksum_size = bytestream2_get_be32();
-if (s->checksum_size >= 1U << 28) {
-av_log(avctx, AV_LOG_ERROR, "data block size too large (%u)\n",
s->checksum_size);
+if (s->checksum_size >= 1U << 28 || !s->checksum_size) {
+av_log(avctx, AV_LOG_ERROR, "data block size invalid (%u)\n",
s->checksum_size);
return AVERROR_INVALIDDATA;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/rv10: Fix integer overflow in aspect ratio compare
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Fri Jun 28 19:20:43 2019 +0200| [16f8e50f86ce6c9944f31045dae9639baaadf444] |
committer: Michael Niedermayer
avcodec/rv10: Fix integer overflow in aspect ratio compare
Fixes: signed integer overflow: 2040 * 1187872 cannot be represented in type
'int'
Fixes:
15368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5681657136283648
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 14fcf42958608223a0be6558fb6e323419c9fc27)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=16f8e50f86ce6c9944f31045dae9639baaadf444
---
libavcodec/rv10.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c
index 595e217519..3b9ebbe8fa 100644
--- a/libavcodec/rv10.c
+++ b/libavcodec/rv10.c
@@ -388,9 +388,9 @@ static int rv20_decode_picture_header(RVDecContext *rv)
// attempt to keep aspect during typical resolution switches
if (!old_aspect.num)
old_aspect = (AVRational){1, 1};
-if (2 * new_w * s->height == new_h * s->width)
+if (2 * (int64_t)new_w * s->height == (int64_t)new_h * s->width)
s->avctx->sample_aspect_ratio = av_mul_q(old_aspect,
(AVRational){2, 1});
-if (new_w * s->height == 2 * new_h * s->width)
+if ((int64_t)new_w * s->height == 2 * (int64_t)new_h * s->width)
s->avctx->sample_aspect_ratio = av_mul_q(old_aspect,
(AVRational){1, 2});
ret = ff_set_dimensions(s->avctx, new_w, new_h);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] Changelog: update
ffmpeg | branch: release/4.1 | Michael Niedermayer | Mon Jul 8 11:53:46 2019 +0200| [7d4e9074c6aba80a0e08fc26128e3603714ffaad] | committer: Michael Niedermayer Changelog: update Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7d4e9074c6aba80a0e08fc26128e3603714ffaad --- Changelog | 36 1 file changed, 36 insertions(+) diff --git a/Changelog b/Changelog index 5702f8b264..959a737033 100644 --- a/Changelog +++ b/Changelog @@ -2,6 +2,42 @@ Entries are sorted chronologically from oldest to youngest within each release, releases are sorted from youngest to oldest. versiob 4.1.4: + avcodec/ilbcdec: Simplify use of unsigned and fix more undefined overflows + avcodec/golomb: Correct the doxy about get_ue_golomb() and errors + avformat/utils: Check timebase before use in estimate_timings() + avcodec/hq_hqa: Use ff_set_dimensions() + avcodec/rv10: Fix integer overflow in aspect ratio compare + avcodec/4xm: Fix signed integer overflows in idct() + avcodec/qdm2: Check checksum_size for 0 + avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop + avcodec/qdm2: Do not read out of array in fix_coding_method_array() + avcodec/svq3: Use ff_set_dimension() + avcodec/iff: Check ham vs bpp + avcodec/ffwavesynth: use uint32_t to compute difference, it is enough + avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case + avcodec/ffwavesynth: Fix backward lcg_seek() + avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP() + avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff() + avcodec/alac: Check lpc_quant + avcodec/dxv: Initialize tex_funct to NULL + avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP + avcodec/alsdec: Fix integer overflow with buffer number + avcodec/alsdec: Fixes signed integer overflow in LSB addition + avcodec/alsdec: Check opt_order / sb_length in ra_block handling + avcodec/alsdec: Fix integer overflow with shifting samples + avcodec/alsdec: Fix undefined behavior in decode_rice() + avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT() + avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight + avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns + avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check + avformat/aviobuf: Delay buffer downsizing until asserts are met + avcodec/fitsdec: Check data_min/max + avcodec/m101: Fix off be 2 error + avcodec/qdm2: Move fft_order check up + avcodec/libvorbisdec: Check extradata size + avformat/vqf: Check header_size + avcodec/atrac9dec: Check q_unit_cnt in parse_band_ext() + avcodec/atrac9dec: Check that the reused block has succeeded initilization avcodec/utils: Check bits_per_coded_sample avcodec/videodsp_template: Fix overflow of addition avcodec/alsdec: Fix invalid shift in multiply() ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Mon Jun 24 01:01:03 2019 +0200| [07975e89d32642e588d7713feed5a949e976e50e] |
committer: Michael Niedermayer
avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
Fixes: signed integer overflow: 2147483646 + 2 cannot be represented in type
'int'
Fixes: infinite loop
Fixes:
15396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5116605501014016
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 694be24bd6c4cc9c6f4583260bf79056e4c1)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=07975e89d32642e588d7713feed5a949e976e50e
---
libavcodec/qdm2.c | 4
1 file changed, 4 insertions(+)
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 44ff4fa6c6..1e91f477e8 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -1289,6 +1289,10 @@ static void qdm2_fft_decode_tones(QDM2Context *q, int
duration,
}
offset += (n - 2);
} else {
+if (local_int_10 <= 2) {
+av_log(NULL, AV_LOG_ERROR, "qdm2_fft_decode_tones() stuck\n");
+return;
+}
offset += qdm2_get_vlc(gb, _tab_fft_tone_offset[local_int_8],
1, 2);
while (offset >= (local_int_10 - 1)) {
offset += (1 - (local_int_10 - 1));
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ilbcdec: Simplify use of unsigned and fix more undefined overflows
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Sun Jun 30 23:28:13 2019 +0200| [7654e5aa3b6e57f6cf161531af340ae41929fa70] |
committer: Michael Niedermayer
avcodec/ilbcdec: Simplify use of unsigned and fix more undefined overflows
Fixes: signed integer overflow: 2147475672 + 8192 cannot be represented in type
'int'
Fixes:
15415/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-5712074128228352
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 019d729039aaa164152035864d65d77e53df1c98)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7654e5aa3b6e57f6cf161531af340ae41929fa70
---
libavcodec/ilbcdec.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/ilbcdec.c b/libavcodec/ilbcdec.c
index bba83a5896..a82a27525c 100644
--- a/libavcodec/ilbcdec.c
+++ b/libavcodec/ilbcdec.c
@@ -724,7 +724,7 @@ static void construct_vector (
int16_t cbvec0[SUBL];
int16_t cbvec1[SUBL];
int16_t cbvec2[SUBL];
-int32_t a32;
+unsigned a32;
int16_t *gainPtr;
int j;
@@ -745,9 +745,9 @@ static void construct_vector (
for (j = 0; j < veclen; j++) {
a32 = SPL_MUL_16_16(*gainPtr++, cbvec0[j]);
a32 += SPL_MUL_16_16(*gainPtr++, cbvec1[j]);
-a32 += (unsigned)SPL_MUL_16_16(*gainPtr, cbvec2[j]);
+a32 += SPL_MUL_16_16(*gainPtr, cbvec2[j]);
gainPtr -= 2;
-decvector[j] = (a32 + 8192) >> 14;
+decvector[j] = (int)(a32 + 8192) >> 14;
}
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/utils: Check timebase before use in estimate_timings()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Sat Jun 29 23:23:25 2019 +0200| [a1416c6c8d1234a53b7e52f45d7f5d613ff8cf10] |
committer: Michael Niedermayer
avformat/utils: Check timebase before use in estimate_timings()
Fixes: division by 0
Fixes:
15480/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5746727434321920
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit f57e97dfd9539bc3f4f97a76ebc001f0b055cb88)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a1416c6c8d1234a53b7e52f45d7f5d613ff8cf10
---
libavformat/utils.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 93e588ee1e..8e53bf01c7 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2953,6 +2953,7 @@ static void estimate_timings(AVFormatContext *ic, int64_t
old_offset)
AVStream av_unused *st;
for (i = 0; i < ic->nb_streams; i++) {
st = ic->streams[i];
+if (st->time_base.den)
av_log(ic, AV_LOG_TRACE, "stream %d: start_time: %0.3f duration:
%0.3f\n", i,
(double) st->start_time * av_q2d(st->time_base),
(double) st->duration * av_q2d(st->time_base));
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/qdm2: Do not read out of array in fix_coding_method_array()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Mon Jun 24 01:01:02 2019 +0200| [e5c21ed6e35e1efc89b583c793fd64b8b53f93e3] |
committer: Michael Niedermayer
avcodec/qdm2: Do not read out of array in fix_coding_method_array()
Instead we ask for a sample, its unclear what to do in this case.
Fixes: index 30 out of bounds for type 'int8_t [30][64]'
Fixes:
15339/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5749441484554240
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit ae021c1239ec3bc0a30dc5a4720569071599ece4)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e5c21ed6e35e1efc89b583c793fd64b8b53f93e3
---
libavcodec/qdm2.c | 7 ++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 1397218bdd..44ff4fa6c6 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -408,7 +408,12 @@ static int fix_coding_method_array(int sb, int channels,
}
for (k = 0; k < run; k++) {
if (j + k < 128) {
-if (coding_method[ch][sb + (j + k) / 64][(j + k) % 64] >
coding_method[ch][sb][j]) {
+int sbjk = sb + (j + k) / 64;
+if (sbjk > 29) {
+SAMPLES_NEEDED
+continue;
+}
+if (coding_method[ch][sbjk][(j + k) % 64] >
coding_method[ch][sb][j]) {
if (k > 0) {
SAMPLES_NEEDED
//not debugged, almost never used
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/4xm: Fix signed integer overflows in idct()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Thu Jun 27 00:15:03 2019 +0200| [4db3ec5e7b1ab08abbe08dbcb7c9de37e8b3dfe4] |
committer: Michael Niedermayer
avcodec/4xm: Fix signed integer overflows in idct()
Fixes: signed integer overflow: 20242 * 121095 cannot be represented in type
'int'
Fixes:
15310/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5737051745419264
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 2bbea155bf7c6ce6d5ae53cc41e44798cad2f39c)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4db3ec5e7b1ab08abbe08dbcb7c9de37e8b3dfe4
---
libavcodec/4xm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index 8e05a4c366..7e6a15e49f 100644
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -158,7 +158,7 @@ typedef struct FourXContext {
#define FIX_1_847759065 121095
#define FIX_2_613125930 171254
-#define MULTIPLY(var, const) (((var) * (const)) >> 16)
+#define MULTIPLY(var, const) ((int)((var) * (unsigned)(const)) >> 16)
static void idct(int16_t block[64])
{
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/hq_hqa: Use ff_set_dimensions()
ffmpeg | branch: release/4.1 | Michael Niedermayer | Sat Jun 29 21:53:09 2019 +0200| [3e3db69193809d5c1844b0e49f9f8da181492133] | committer: Michael Niedermayer avcodec/hq_hqa: Use ff_set_dimensions() Fixes: 15530/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5637370344374272 Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int' Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit a6229fcd405d4135848c83df73634871260de59c) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3e3db69193809d5c1844b0e49f9f8da181492133 --- libavcodec/hq_hqa.c | 6 -- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/hq_hqa.c b/libavcodec/hq_hqa.c index 90bafdc72a..eec2e980b3 100644 --- a/libavcodec/hq_hqa.c +++ b/libavcodec/hq_hqa.c @@ -254,10 +254,12 @@ static int hqa_decode_frame(HQContext *ctx, AVFrame *pic, size_t data_size) width = bytestream2_get_be16(>gbc); height = bytestream2_get_be16(>gbc); +ret = ff_set_dimensions(ctx->avctx, width, height); +if (ret < 0) +return ret; + ctx->avctx->coded_width = FFALIGN(width, 16); ctx->avctx->coded_height= FFALIGN(height, 16); -ctx->avctx->width = width; -ctx->avctx->height = height; ctx->avctx->bits_per_raw_sample = 8; ctx->avctx->pix_fmt = AV_PIX_FMT_YUVA422P; ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Fri Jun 21 22:41:25 2019 +0200| [73885bf3e19651b2316eac6690167095039603b2] |
committer: Michael Niedermayer
avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t'
(aka 'long'); cast to an unsigned type to negate this value to itself
Fixes:
15289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5709034499342336
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 8c022099351c04ae21e0b8696ea71a690ed03cd2)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=73885bf3e19651b2316eac6690167095039603b2
---
libavcodec/ffwavesynth.c | 12 +++-
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/libavcodec/ffwavesynth.c b/libavcodec/ffwavesynth.c
index cf8c780f3e..b2cc7c8fc1 100644
--- a/libavcodec/ffwavesynth.c
+++ b/libavcodec/ffwavesynth.c
@@ -113,18 +113,12 @@ static uint32_t lcg_next(uint32_t *s)
return *s;
}
-static void lcg_seek(uint32_t *s, int64_t dt)
+static void lcg_seek(uint32_t *s, uint32_t dt)
{
uint32_t a, c, t = *s;
-if (dt >= 0) {
-a = LCG_A;
-c = LCG_C;
-} else { /* coefficients for a step backward */
-a = LCG_AI;
-c = (uint32_t)(-LCG_AI * LCG_C);
-dt = -dt;
-}
+a = LCG_A;
+c = LCG_C;
while (dt) {
if (dt & 1)
t = a * t + c;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Sun Jun 30 17:54:45 2019 +0200| [6ddb253f79677e2e0594715b1b91720606b0e331] |
committer: Michael Niedermayer
avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
Signed-off-by: Michael Niedermayer
(cherry picked from commit 1bb3b3f11c6960e90bcfe685c0ad1e355a3e787e)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6ddb253f79677e2e0594715b1b91720606b0e331
---
libavcodec/golomb.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h
index 5c25883626..6b11e48793 100644
--- a/libavcodec/golomb.h
+++ b/libavcodec/golomb.h
@@ -49,6 +49,8 @@ extern const uint8_t
ff_interleaved_dirac_golomb_vlc_code[256];
/**
* Read an unsigned Exp-Golomb code in the range 0 to 8190.
+ *
+ * @returns the read value or a negative error code.
*/
static inline int get_ue_golomb(GetBitContext *gb)
{
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/svq3: Use ff_set_dimension()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Tue Jun 25 23:42:43 2019 +0200| [dd59d92e942f0986d87a80ea69b570e804ed7106] |
committer: Michael Niedermayer
avcodec/svq3: Use ff_set_dimension()
Fixes: OOM
Fixes:
15410/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5659464805384192
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 7b114d76878f1a542bcb75456492cc43e6414f8b)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dd59d92e942f0986d87a80ea69b570e804ed7106
---
libavcodec/svq3.c | 36
1 file changed, 20 insertions(+), 16 deletions(-)
diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index 18a4448ffa..9cea9ac840 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -1183,6 +1183,7 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
GetBitContext gb;
int frame_size_code;
int unk0, unk1, unk2, unk3, unk4;
+int w,h;
size = AV_RB32([4]);
if (size > extradata_end - extradata - 8) {
@@ -1195,38 +1196,41 @@ static av_cold int svq3_decode_init(AVCodecContext
*avctx)
frame_size_code = get_bits(, 3);
switch (frame_size_code) {
case 0:
-avctx->width = 160;
-avctx->height = 120;
+w = 160;
+h = 120;
break;
case 1:
-avctx->width = 128;
-avctx->height = 96;
+w = 128;
+h = 96;
break;
case 2:
-avctx->width = 176;
-avctx->height = 144;
+w = 176;
+h = 144;
break;
case 3:
-avctx->width = 352;
-avctx->height = 288;
+w = 352;
+h = 288;
break;
case 4:
-avctx->width = 704;
-avctx->height = 576;
+w = 704;
+h = 576;
break;
case 5:
-avctx->width = 240;
-avctx->height = 180;
+w = 240;
+h = 180;
break;
case 6:
-avctx->width = 320;
-avctx->height = 240;
+w = 320;
+h = 240;
break;
case 7:
-avctx->width = get_bits(, 12);
-avctx->height = get_bits(, 12);
+w = get_bits(, 12);
+h = get_bits(, 12);
break;
}
+ret = ff_set_dimensions(avctx, w, h);
+if (ret < 0)
+goto fail;
s->halfpel_flag = get_bits1();
s->thirdpel_flag = get_bits1();
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/iff: Check ham vs bpp
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Sat Jun 22 19:21:50 2019 +0200| [d534cb834564f440c6368b5c6597c67e1f97635d] |
committer: Michael Niedermayer
avcodec/iff: Check ham vs bpp
This checks the ham value much stricter and avoids hitting cases which cannot
be reached
with data from the libavformat demuxer.
Fixes: out of array access
Fixes:
15320/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5080476840099840
Fixes:
15423/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5630765833912320
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit f76d7352e05526fde7c607b9a9db536a5760af29)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d534cb834564f440c6368b5c6597c67e1f97635d
---
libavcodec/iff.c | 13 ++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index 4099d118e4..c6e2359b00 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -280,6 +280,16 @@ static int extract_header(AVCodecContext *const avctx,
for (i = 0; i < 16; i++)
s->tvdc[i] = bytestream_get_be16();
+if (s->ham) {
+if (s->bpp > 8) {
+av_log(avctx, AV_LOG_ERROR, "Invalid number of hold bits for
HAM: %u\n", s->ham);
+return AVERROR_INVALIDDATA;
+} if (s->ham != (s->bpp > 6 ? 6 : 4)) {
+av_log(avctx, AV_LOG_ERROR, "Invalid number of hold bits for
HAM: %u, BPP: %u\n", s->ham, s->bpp);
+return AVERROR_INVALIDDATA;
+}
+}
+
if (s->masking == MASK_HAS_MASK) {
if (s->bpp >= 8 && !s->ham) {
avctx->pix_fmt = AV_PIX_FMT_RGB32;
@@ -307,9 +317,6 @@ static int extract_header(AVCodecContext *const avctx,
if (!s->bpp || s->bpp > 32) {
av_log(avctx, AV_LOG_ERROR, "Invalid number of bitplanes: %u\n",
s->bpp);
return AVERROR_INVALIDDATA;
-} else if (s->ham >= 8) {
-av_log(avctx, AV_LOG_ERROR, "Invalid number of hold bits for HAM:
%u\n", s->ham);
-return AVERROR_INVALIDDATA;
}
av_freep(>ham_buf);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Fri Jun 21 22:43:23 2019 +0200| [074f40608e19ce7ce44c320dda87836806991d59] |
committer: Michael Niedermayer
avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
Fixes: signed integer overflow: 6494225984479297536 - -6043795377581187040
cannot be represented in type 'long'
Fixes:
15285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5632780307791872
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit e9dd3c7126097d7c8d4f137db9957b81a219aa2c)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=074f40608e19ce7ce44c320dda87836806991d59
---
libavcodec/ffwavesynth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ffwavesynth.c b/libavcodec/ffwavesynth.c
index b2cc7c8fc1..793eada7a5 100644
--- a/libavcodec/ffwavesynth.c
+++ b/libavcodec/ffwavesynth.c
@@ -215,7 +215,7 @@ static void wavesynth_seek(struct wavesynth_context *ws,
int64_t ts)
ws->next_inter = i;
ws->next_ts = i < ws->nb_inter ? ws->inter[i].ts_start : INF_TS;
*last = -1;
-lcg_seek(>dither_state, ts - ws->cur_ts);
+lcg_seek(>dither_state, (uint32_t)ts - ws->cur_ts);
if (ws->pink_need) {
int64_t pink_ts_cur = (ws->cur_ts + PINK_UNIT - 1) & ~(PINK_UNIT - 1);
int64_t pink_ts_next = ts & ~(PINK_UNIT - 1);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check
ffmpeg | branch: release/4.1 | Michael Niedermayer | Sun Jun 16 11:26:57 2019 +0200| [523a47b3f6004352236ec46e9d870e236b1428f3] | committer: Michael Niedermayer avcodec/apedec: Add k < 24 check to the only k++ case which lacks such a check Fixes: 15255/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APE_fuzzer-5718831688843264 Fixes: left shift of 1 by 31 places cannot be represented in type 'int' Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 3d4f4f4a15e79c96c3613e5c252b2f5cc4190e18) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=523a47b3f6004352236ec46e9d870e236b1428f3 --- libavcodec/apedec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 15eb416ba4..eb31fd70c1 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -460,7 +460,7 @@ static inline void update_rice(APERice *rice, unsigned int x) if (rice->ksum < lim) rice->k--; -else if (rice->ksum >= (1 << (rice->k + 5))) +else if (rice->ksum >= (1 << (rice->k + 5)) && rice->k < 24) rice->k++; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/dxv: Initialize tex_funct to NULL
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Mon Jun 3 11:22:36 2019 +0200| [c697819aee7ff44181077859ca5f0962049272e2] |
committer: Michael Niedermayer
avcodec/dxv: Initialize tex_funct to NULL
Fixes: Various anomalies
Fixes:
14493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5071018000908288
Fixes:
14630/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5714888963391488
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit e96b7a8ba62c5e010328b80b647b64dd9cdbdc01)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c697819aee7ff44181077859ca5f0962049272e2
---
libavcodec/dxv.c | 4
1 file changed, 4 insertions(+)
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 7ae3315493..e28a6ba724 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -1055,6 +1055,10 @@ static int dxv_decode(AVCodecContext *avctx, void *data,
avctx->pix_fmt = AV_PIX_FMT_RGBA;
avctx->colorspace = AVCOL_SPC_RGB;
+ctx->tex_funct = NULL;
+ctx->tex_funct_planar[0] = NULL;
+ctx->tex_funct_planar[1] = NULL;
+
tag = bytestream2_get_le32(gbc);
switch (tag) {
case MKBETAG('D', 'X', 'T', '1'):
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Tue Jun 25 10:29:57 2019 +0200| [df61ec263faa1408a0a63bad2d3d5bf0462dadb2] |
committer: Michael Niedermayer
avcodec/hevc_ps: Change num_tile_rows/columns checks to sps->ctb_height/weight
Suggested-by: James Almer
Reviewed-by: James Almer
(cherry picked from commit 3b2082c663dac93fd722289a540c1b1e24a12564)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=df61ec263faa1408a0a63bad2d3d5bf0462dadb2
---
libavcodec/hevc_ps.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index 1e84fcf634..9b6cc49355 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -1591,14 +1591,14 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb,
AVCodecContext *avctx,
int num_tile_rows_minus1= get_ue_golomb(gb);
if (num_tile_columns_minus1 < 0 ||
-num_tile_columns_minus1 >= sps->width - 1) {
+num_tile_columns_minus1 >= sps->ctb_width - 1) {
av_log(avctx, AV_LOG_ERROR, "num_tile_columns_minus1 out of range:
%d\n",
num_tile_columns_minus1);
ret = num_tile_columns_minus1 < 0 ? num_tile_columns_minus1 :
AVERROR_INVALIDDATA;
goto err;
}
if (num_tile_rows_minus1 < 0 ||
-num_tile_rows_minus1 >= sps->height - 1) {
+num_tile_rows_minus1 >= sps->ctb_height - 1) {
av_log(avctx, AV_LOG_ERROR, "num_tile_rows_minus1 out of range:
%d\n",
num_tile_rows_minus1);
ret = num_tile_rows_minus1 < 0 ? num_tile_rows_minus1 :
AVERROR_INVALIDDATA;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/atrac9dec: Check q_unit_cnt in parse_band_ext()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Sun Jun 16 21:01:50 2019 +0200| [7daa138f6819ef5ec65fd6af52aeb2ebb0ed9486] |
committer: Michael Niedermayer
avcodec/atrac9dec: Check q_unit_cnt in parse_band_ext()
Fixes: global-buffer-overflow
Fixes:
15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit fb4a4557d15bce601e2462207648741600fa273f)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7daa138f6819ef5ec65fd6af52aeb2ebb0ed9486
---
libavcodec/atrac9dec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/atrac9dec.c b/libavcodec/atrac9dec.c
index 11b683d136..ff4991a573 100644
--- a/libavcodec/atrac9dec.c
+++ b/libavcodec/atrac9dec.c
@@ -202,6 +202,8 @@ static inline int parse_band_ext(ATRAC9Context *s,
ATRAC9BlockData *b,
int ext_band = 0;
if (b->has_band_ext) {
+if (b->q_unit_cnt < 13)
+return AVERROR_INVALIDDATA;
ext_band = at9_tab_band_ext_group[b->q_unit_cnt - 13][2];
if (stereo) {
b->channel[1].band_ext = get_bits(gb, 2);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/alsdec: Fix integer overflow with shifting samples
ffmpeg | branch: release/4.1 | Michael Niedermayer | Wed Jun 19 23:27:21 2019 +0200| [99745dc2f353be1eb97291bd501053709b7b2d61] | committer: Michael Niedermayer avcodec/alsdec: Fix integer overflow with shifting samples Fixes: signed integer overflow: -346039050 * 8 cannot be represented in type 'int' Fixes: 15283/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5692700268953600 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit a3bd4b260eb9f0d5817f9b3d672844f127c51a0b) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=99745dc2f353be1eb97291bd501053709b7b2d61 --- libavcodec/alsdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index e54440910c..420bcf835a 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -1033,7 +1033,7 @@ static int decode_block(ALSDecContext *ctx, ALSBlockData *bd) if (*bd->shift_lsbs) for (smp = 0; smp < bd->block_length; smp++) -bd->raw_samples[smp] <<= *bd->shift_lsbs; +bd->raw_samples[smp] = (unsigned)bd->raw_samples[smp] << *bd->shift_lsbs; return 0; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Thu Jun 13 15:05:54 2019 +0200| [3fa15bb096b1e64206f0307460c9b694e6d368d9] |
committer: Michael Niedermayer
avcodec/hevc_ps: Fix integer overflow with num_tile_rows and num_tile_columns
Fixes: signed integer overflow: -2147483648 - 1 cannot be represented in type
'int'
Fixes:
14880/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5130977304641536
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer
Signed-off-by: Michael Niedermayer
(cherry picked from commit c692051252693155c4eecd16f4f8a79caf66cd54)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3fa15bb096b1e64206f0307460c9b694e6d368d9
---
libavcodec/hevc_ps.c | 23 +--
libavcodec/hevc_ps.h | 4 ++--
2 files changed, 15 insertions(+), 12 deletions(-)
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index ea984af0a1..1e84fcf634 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -1587,22 +1587,25 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb,
AVCodecContext *avctx,
pps->entropy_coding_sync_enabled_flag = get_bits1(gb);
if (pps->tiles_enabled_flag) {
-pps->num_tile_columns = get_ue_golomb_long(gb) + 1;
-pps->num_tile_rows= get_ue_golomb_long(gb) + 1;
-if (pps->num_tile_columns <= 0 ||
-pps->num_tile_columns >= sps->width) {
+int num_tile_columns_minus1 = get_ue_golomb(gb);
+int num_tile_rows_minus1= get_ue_golomb(gb);
+
+if (num_tile_columns_minus1 < 0 ||
+num_tile_columns_minus1 >= sps->width - 1) {
av_log(avctx, AV_LOG_ERROR, "num_tile_columns_minus1 out of range:
%d\n",
- pps->num_tile_columns - 1);
-ret = AVERROR_INVALIDDATA;
+ num_tile_columns_minus1);
+ret = num_tile_columns_minus1 < 0 ? num_tile_columns_minus1 :
AVERROR_INVALIDDATA;
goto err;
}
-if (pps->num_tile_rows <= 0 ||
-pps->num_tile_rows >= sps->height) {
+if (num_tile_rows_minus1 < 0 ||
+num_tile_rows_minus1 >= sps->height - 1) {
av_log(avctx, AV_LOG_ERROR, "num_tile_rows_minus1 out of range:
%d\n",
- pps->num_tile_rows - 1);
-ret = AVERROR_INVALIDDATA;
+ num_tile_rows_minus1);
+ret = num_tile_rows_minus1 < 0 ? num_tile_rows_minus1 :
AVERROR_INVALIDDATA;
goto err;
}
+pps->num_tile_columns = num_tile_columns_minus1 + 1;
+pps->num_tile_rows= num_tile_rows_minus1+ 1;
pps->column_width = av_malloc_array(pps->num_tile_columns,
sizeof(*pps->column_width));
pps->row_height = av_malloc_array(pps->num_tile_rows,
sizeof(*pps->row_height));
diff --git a/libavcodec/hevc_ps.h b/libavcodec/hevc_ps.h
index 1fbda199e3..77e5fd83c7 100644
--- a/libavcodec/hevc_ps.h
+++ b/libavcodec/hevc_ps.h
@@ -344,8 +344,8 @@ typedef struct HEVCPPS {
uint8_t tiles_enabled_flag;
uint8_t entropy_coding_sync_enabled_flag;
-int num_tile_columns; ///< num_tile_columns_minus1 + 1
-int num_tile_rows; ///< num_tile_rows_minus1 + 1
+uint16_t num_tile_columns; ///< num_tile_columns_minus1 + 1
+uint16_t num_tile_rows; ///< num_tile_rows_minus1 + 1
uint8_t uniform_spacing_flag;
uint8_t loop_filter_across_tiles_enabled_flag;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/atrac9dec: Check that the reused block has succeeded initilization
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Sun Jun 16 20:56:20 2019 +0200| [3d1903acfee865935b73957e1b4df5ae090c93f9] |
committer: Michael Niedermayer
avcodec/atrac9dec: Check that the reused block has succeeded initilization
Fixes: global-buffer-overflow
Fixes:
15247/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ATRAC9_fuzzer-5671602181636096
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit ac9af7e9a5befa8a554bacbcc59ab2f11203d85e)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=3d1903acfee865935b73957e1b4df5ae090c93f9
---
libavcodec/atrac9dec.c | 8
1 file changed, 8 insertions(+)
diff --git a/libavcodec/atrac9dec.c b/libavcodec/atrac9dec.c
index 805d46f3b8..11b683d136 100644
--- a/libavcodec/atrac9dec.c
+++ b/libavcodec/atrac9dec.c
@@ -71,6 +71,8 @@ typedef struct ATRAC9BlockData {
int cpe_base_channel;
int is_signs[30];
+int reuseable;
+
} ATRAC9BlockData;
typedef struct ATRAC9Context {
@@ -668,6 +670,7 @@ static int atrac9_decode_block(ATRAC9Context *s,
GetBitContext *gb,
if (!reuse_params) {
int stereo_band, ext_band;
const int min_band_count = s->samplerate_idx > 7 ? 1 : 3;
+b->reuseable = 0;
b->band_count = get_bits(gb, 4) + min_band_count;
b->q_unit_cnt = at9_tab_band_q_unit_map[b->band_count];
@@ -699,6 +702,11 @@ static int atrac9_decode_block(ATRAC9Context *s,
GetBitContext *gb,
}
b->band_ext_q_unit = at9_tab_band_q_unit_map[ext_band];
}
+b->reuseable = 1;
+}
+if (!b->reuseable) {
+av_log(s->avctx, AV_LOG_ERROR, "invalid block reused!\n");
+return AVERROR_INVALIDDATA;
}
/* Calculate bit alloc gradient */
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/alsdec: Fixes signed integer overflow in LSB addition
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Fri Jun 21 00:47:16 2019 +0200| [ed8e191bfb1f64612d9a751e5003f985d9adb402] |
committer: Michael Niedermayer
avcodec/alsdec: Fixes signed integer overflow in LSB addition
Fixes: signed integer overflow: 8 * 536870912 cannot be represented in type
'int'
Fixes:
15281/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5744458785619968
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 7f527021df73b4792323f38f84a4bf2fbe5a2052)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ed8e191bfb1f64612d9a751e5003f985d9adb402
---
libavcodec/alsdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index 96cfbbf1fe..4b69775414 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -867,7 +867,7 @@ static int read_var_block_data(ALSDecContext *ctx,
ALSBlockData *bd)
res >>= 1;
if (cur_k) {
-res *= 1 << cur_k;
+res *= 1U << cur_k;
res |= get_bits_long(gb, cur_k);
}
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/vqf: Check header_size
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Tue Jun 18 23:17:23 2019 +0200| [5b8bce805c687e3558f0c77deea49aa97190e0ed] |
committer: Michael Niedermayer
avformat/vqf: Check header_size
Fixes:
15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type
'int'
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 7c30ff38880570377168096417f714b21102b343)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5b8bce805c687e3558f0c77deea49aa97190e0ed
---
libavformat/vqf.c | 5 -
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavformat/vqf.c b/libavformat/vqf.c
index d00fa5e08c..ff38a3d1ca 100644
--- a/libavformat/vqf.c
+++ b/libavformat/vqf.c
@@ -107,6 +107,9 @@ static int vqf_read_header(AVFormatContext *s)
header_size = avio_rb32(s->pb);
+if (header_size < 0)
+return AVERROR_INVALIDDATA;
+
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
st->codecpar->codec_id = AV_CODEC_ID_TWINVQ;
st->start_time = 0;
@@ -120,7 +123,7 @@ static int vqf_read_header(AVFormatContext *s)
len = avio_rb32(s->pb);
-if ((unsigned) len > INT_MAX/2) {
+if ((unsigned) len > INT_MAX/2 || header_size < 8) {
av_log(s, AV_LOG_ERROR, "Malformed header\n");
return -1;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/libvorbisdec: Check extradata size
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Mon Jun 17 21:26:45 2019 +0200| [1aa0c2a06f005cac6e2f310f368a38af91682c62] |
committer: Michael Niedermayer
avcodec/libvorbisdec: Check extradata size
Fixes: out of array read
Fixes:
15261/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBVORBIS_fuzzer-5764908467093504
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit cf3c245566e8a8d45ed2ad9fdff9ef50327ba2d3)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1aa0c2a06f005cac6e2f310f368a38af91682c62
---
libavcodec/libvorbisdec.c | 8
1 file changed, 8 insertions(+)
diff --git a/libavcodec/libvorbisdec.c b/libavcodec/libvorbisdec.c
index ecf690a553..89cbbb41b6 100644
--- a/libavcodec/libvorbisdec.c
+++ b/libavcodec/libvorbisdec.c
@@ -49,8 +49,16 @@ static int oggvorbis_decode_init(AVCodecContext *avccontext)
{
vorbis_comment_init(>vc) ;
if(p[0] == 0 && p[1] == 30) {
+int sizesum = 0;
for(i = 0; i < 3; i++){
hsizes[i] = bytestream_get_be16((const uint8_t **));
+sizesum += 2 + hsizes[i];
+if (sizesum > avccontext->extradata_size) {
+av_log(avccontext, AV_LOG_ERROR, "vorbis extradata too
small\n");
+ret = AVERROR_INVALIDDATA;
+goto error;
+}
+
headers[i] = p;
p += hsizes[i];
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ffwavesynth: Fix backward lcg_seek()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Fri Jun 21 22:08:27 2019 +0200| [24ea2679e2c93891a6a4c5fbddad6c27e459c140] |
committer: Michael Niedermayer
avcodec/ffwavesynth: Fix backward lcg_seek()
Signed-off-by: Michael Niedermayer
(cherry picked from commit cf2bd3ce79b12256d7d129b2ada5ee649b9a27eb)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=24ea2679e2c93891a6a4c5fbddad6c27e459c140
---
libavcodec/ffwavesynth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ffwavesynth.c b/libavcodec/ffwavesynth.c
index a66113972b..cf8c780f3e 100644
--- a/libavcodec/ffwavesynth.c
+++ b/libavcodec/ffwavesynth.c
@@ -122,7 +122,7 @@ static void lcg_seek(uint32_t *s, int64_t dt)
c = LCG_C;
} else { /* coefficients for a step backward */
a = LCG_AI;
-c = (uint32_t)(LCG_AI * LCG_C);
+c = (uint32_t)(-LCG_AI * LCG_C);
dt = -dt;
}
while (dt) {
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Fri Jun 21 00:47:19 2019 +0200| [c34512371e1d09a1862a3c7f53a17b3e9198729a] |
committer: Michael Niedermayer
avcodec/alsdec: Add FF_CODEC_CAP_INIT_CLEANUP
Fixes: multiple memleaks
Fixes:
15293/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5642409288925184
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit b7b6ddd59693008c35b3247496ecc946331d0856)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c34512371e1d09a1862a3c7f53a17b3e9198729a
---
libavcodec/alsdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index e38d7b21d3..5eb2a58aaf 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -2127,7 +2127,6 @@ static av_cold int decode_init(AVCodecContext *avctx)
return 0;
fail:
-decode_end(avctx);
return ret;
}
@@ -2153,4 +2152,5 @@ AVCodec ff_als_decoder = {
.decode = decode_frame,
.flush = flush,
.capabilities = AV_CODEC_CAP_SUBFRAMES | AV_CODEC_CAP_DR1,
+.caps_internal = FF_CODEC_CAP_INIT_CLEANUP,
};
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/m101: Fix off be 2 error
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Mon Jun 17 21:13:17 2019 +0200| [f3bfb0717982992959ac4ecd40f4d2ddcab25eb1] |
committer: Michael Niedermayer
avcodec/m101: Fix off be 2 error
Fixes: out of array read
Fixes:
15263/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_M101_fuzzer-5728999453491200
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 89b96900fa7c17d0770c9af26af7c3ae36ae0253)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f3bfb0717982992959ac4ecd40f4d2ddcab25eb1
---
libavcodec/m101.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/m101.c b/libavcodec/m101.c
index d2549668fd..70f1da4f45 100644
--- a/libavcodec/m101.c
+++ b/libavcodec/m101.c
@@ -61,7 +61,7 @@ static int m101_decode_frame(AVCodecContext *avctx, void
*data, int *got_frame,
stride = AV_RL32(avctx->extradata + 5*4);
if (avctx->pix_fmt == AV_PIX_FMT_YUV422P10)
-min_stride = (avctx->width + 15) / 16 * 20;
+min_stride = (avctx->width + 15) / 16 * 40;
if (stride < min_stride || avpkt->size < stride * (uint64_t)avctx->height)
{
av_log(avctx, AV_LOG_ERROR, "stride (%d) is invalid for packet sized
%d\n",
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/alac: Check lpc_quant
ffmpeg | branch: release/4.1 | Michael Niedermayer | Wed Jun 19 01:04:07 2019 +0200| [ac9d8e7c501cc1118d99b6226a7fbef4e0578c72] | committer: Michael Niedermayer avcodec/alac: Check lpc_quant lpc_quant of 0 produces undefined behavior, thus disallow this. If valid samples use this then such a sample would be quite usefull to confirm the correct handling of this. Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative Fixes: 15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5656388535058432 Fixes: 15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5761238417539072 Fixes: 15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5767260766994432 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit a6474b899c1153e3bb95e399b6605c3507aea0d0) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ac9d8e7c501cc1118d99b6226a7fbef4e0578c72 --- libavcodec/alac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/alac.c b/libavcodec/alac.c index 93cf198eea..19e62ddbe0 100644 --- a/libavcodec/alac.c +++ b/libavcodec/alac.c @@ -306,7 +306,7 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index, rice_history_mult[ch] = get_bits(>gb, 3); lpc_order[ch] = get_bits(>gb, 5); -if (lpc_order[ch] >= alac->max_samples_per_frame) +if (lpc_order[ch] >= alac->max_samples_per_frame || !lpc_quant[ch]) return AVERROR_INVALIDDATA; /* read the predictor table */ ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/alsdec: Check opt_order / sb_length in ra_block handling
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Fri Jun 21 00:47:15 2019 +0200| [75e838a6daa76a913361c7e725976b3b07a1312a] |
committer: Michael Niedermayer
avcodec/alsdec: Check opt_order / sb_length in ra_block handling
Fixes: out of array access
Fixes:
15277/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5184853437317120
Fixes:
15280/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5741062137577472
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 0794494c8f2f756e3c9384dba21c54f7d4ba9286)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=75e838a6daa76a913361c7e725976b3b07a1312a
---
libavcodec/alsdec.c | 10 --
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index 420bcf835a..96cfbbf1fe 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -789,14 +789,20 @@ static int read_var_block_data(ALSDecContext *ctx,
ALSBlockData *bd)
// read first value and residuals in case of a random access block
if (bd->ra_block) {
+start = FFMIN(opt_order, 3);
+av_assert0(sb_length <= sconf->frame_length);
+if (sb_length <= start) {
+// opt_order or sb_length may be corrupted, either way this is
unsupported and not well defined in the specification
+av_log(avctx, AV_LOG_ERROR, "Sub block length smaller or equal
start\n");
+return AVERROR_PATCHWELCOME;
+}
+
if (opt_order)
bd->raw_samples[0] = decode_rice(gb, avctx->bits_per_raw_sample -
4);
if (opt_order > 1)
bd->raw_samples[1] = decode_rice(gb, FFMIN(s[0] + 3, ctx->s_max));
if (opt_order > 2)
bd->raw_samples[2] = decode_rice(gb, FFMIN(s[0] + 1, ctx->s_max));
-
-start = FFMIN(opt_order, 3);
}
// read all residuals
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Sat Jun 15 23:28:25 2019 +0200| [4d7ee3b0ff12c79a84ec29f9b876760795ef3d5d] |
committer: Michael Niedermayer
avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes:
15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 79204a1fc8f1988f7d7e6cae2c3b68f513444d38)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4d7ee3b0ff12c79a84ec29f9b876760795ef3d5d
---
libavcodec/vc1_block.c | 34 ++
1 file changed, 26 insertions(+), 8 deletions(-)
diff --git a/libavcodec/vc1_block.c b/libavcodec/vc1_block.c
index 86320db959..ec5339d2f0 100644
--- a/libavcodec/vc1_block.c
+++ b/libavcodec/vc1_block.c
@@ -508,13 +508,15 @@ static inline int vc1_coded_block_pred(MpegEncContext *
s, int n,
* @param codingset set of VLC to decode data
* @see 8.1.3.4
*/
-static void vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip,
+static int vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip,
int *value, int codingset)
{
GetBitContext *gb = >s.gb;
int index, run, level, lst, sign;
index = get_vlc2(gb, ff_vc1_ac_coeff_table[codingset].table, AC_VLC_BITS,
3);
+if (index < 0)
+return index;
if (index != ff_vc1_ac_sizes[codingset] - 1) {
run = vc1_index_decode_table[codingset][index][0];
level = vc1_index_decode_table[codingset][index][1];
@@ -560,6 +562,8 @@ static void vc1_decode_ac_coeff(VC1Context *v, int *last,
int *skip,
*last = lst;
*skip = run;
*value = (level ^ -sign) + sign;
+
+return 0;
}
/** Decode intra block in intra frames - should be faster than
decode_intra_block
@@ -639,7 +643,9 @@ static int vc1_decode_i_block(VC1Context *v, int16_t
block[64], int n,
zz_table = v->zz_8x8[1];
while (!last) {
-vc1_decode_ac_coeff(v, , , , codingset);
+int ret = vc1_decode_ac_coeff(v, , , , codingset);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -812,7 +818,9 @@ static int vc1_decode_i_block_adv(VC1Context *v, int16_t
block[64], int n,
}
while (!last) {
-vc1_decode_ac_coeff(v, , , , codingset);
+int ret = vc1_decode_ac_coeff(v, , , , codingset);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -995,7 +1003,9 @@ static int vc1_decode_intra_block(VC1Context *v, int16_t
block[64], int n,
int k;
while (!last) {
-vc1_decode_ac_coeff(v, , , , codingset);
+int ret = vc1_decode_ac_coeff(v, , , , codingset);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -1161,7 +1171,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
last = 0;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -1189,7 +1201,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
off = (j & 1) * 4 + (j & 2) * 16;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 15)
break;
@@ -1216,7 +1230,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
off = j * 32;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 31)
break;
@@ -1243,7 +1259,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
off = j * 4;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 31)
break;
[FFmpeg-cvslog] avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Fri Jun 21 23:45:36 2019 +0200| [10880dd695daa1fb85ef96a15be5b46ce339d2fb] |
committer: Michael Niedermayer
avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
Fixes: out of array access
Fixes:
15360/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5653837190266880
Fixes:
15412/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5740537648250880
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 37708cbae8d6887b80f58a70a1dfa01af6ea2c85)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=10880dd695daa1fb85ef96a15be5b46ce339d2fb
---
libavcodec/flicvideo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c
index ba5bda48c4..c0e1e16bcd 100644
--- a/libavcodec/flicvideo.c
+++ b/libavcodec/flicvideo.c
@@ -900,7 +900,7 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
} else {
if (bytestream2_tell() + 2*byte_run >
stream_ptr_after_chunk)
break;
-CHECK_PIXEL_PTR(2 * byte_run);
+CHECK_PIXEL_PTR(3 * byte_run);
for (j = 0; j < byte_run; j++, pixel_countdown--) {
pixel = bytestream2_get_le24();
AV_WL24([pixel_ptr], pixel);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/alsdec: Fix integer overflow with buffer number
ffmpeg | branch: release/4.1 | Michael Niedermayer | Fri Jun 21 00:47:17 2019 +0200| [fa2dbcfd8f4b1ed7b62c464fb509a6b3b9bf4ab2] | committer: Michael Niedermayer avcodec/alsdec: Fix integer overflow with buffer number Fixes: signed integer overflow: 65313 * 65313 cannot be represented in type 'int' Fixes: 15290/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5738074249625600 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 5f64f6058e0c23641a68ce7dfe47b1f55efd401c) Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fa2dbcfd8f4b1ed7b62c464fb509a6b3b9bf4ab2 --- libavcodec/alsdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 4b69775414..e38d7b21d3 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -1993,6 +1993,8 @@ static av_cold int decode_init(AVCodecContext *avctx) // allocate quantized parcor coefficient buffer num_buffers = sconf->mc_coding ? avctx->channels : 1; +if (num_buffers * (uint64_t)num_buffers > INT_MAX) // protect chan_data_buffer allocation +return AVERROR_INVALIDDATA; ctx->quant_cof= av_malloc_array(num_buffers, sizeof(*ctx->quant_cof)); ctx->lpc_cof = av_malloc_array(num_buffers, sizeof(*ctx->lpc_cof)); ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/fitsdec: Check data_min/max
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Thu Jun 13 00:24:53 2019 +0200| [b5d6b509b1ce6c663c30d329d939ff13bfd4e280] |
committer: Michael Niedermayer
avcodec/fitsdec: Check data_min/max
Fixes: division by 0
Fixes:
15206/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FITS_fuzzer-5657260212092928
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit eb82d19f035f59edf0aee215f02baaea908875de)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b5d6b509b1ce6c663c30d329d939ff13bfd4e280
---
libavcodec/fitsdec.c | 8
1 file changed, 8 insertions(+)
diff --git a/libavcodec/fitsdec.c b/libavcodec/fitsdec.c
index 67a8bd71f4..4f452422ef 100644
--- a/libavcodec/fitsdec.c
+++ b/libavcodec/fitsdec.c
@@ -168,6 +168,14 @@ static int fits_read_header(AVCodecContext *avctx, const
uint8_t **ptr, FITSHead
header->data_min = (header->data_min - header->bzero) / header->bscale;
header->data_max = (header->data_max - header->bzero) / header->bscale;
}
+if (!header->rgb && header->data_min >= header->data_max) {
+if (header->data_min > header->data_max) {
+av_log(avctx, AV_LOG_ERROR, "data min/max (%g %g) is invalid\n",
header->data_min, header->data_max);
+return AVERROR_INVALIDDATA;
+}
+av_log(avctx, AV_LOG_WARNING, "data min/max indicates a blank
image\n");
+header->data_max ++;
+}
return 0;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and INTERLEAVE_OUTPUT()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Wed Jun 19 21:53:43 2019 +0200| [10562175405277ac24f02ee2d29455169b1b54e0] |
committer: Michael Niedermayer
avcodec/alsdec: Fixes invalid shifts in read_var_block_data() and
INTERLEAVE_OUTPUT()
Fixes: left shift of negative value -6
Fixes:
15275/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5742361767837696
Fixes: signed integer overflow: 41582592 * 256 cannot be represented in type
'int'
Fixes:
15296/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5739558227935232
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit e131568752ad41222946304c61eadb87b0a24791)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=10562175405277ac24f02ee2d29455169b1b54e0
---
libavcodec/alsdec.c | 12 ++--
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index 891f742e7e..2660747472 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -767,8 +767,8 @@ static int read_var_block_data(ALSDecContext *ctx,
ALSBlockData *bd)
if (*bd->use_ltp) {
int r, c;
-bd->ltp_gain[0] = decode_rice(gb, 1) << 3;
-bd->ltp_gain[1] = decode_rice(gb, 2) << 3;
+bd->ltp_gain[0] = decode_rice(gb, 1) * 8;
+bd->ltp_gain[1] = decode_rice(gb, 2) * 8;
r = get_unary(gb, 0, 4);
c = get_bits(gb, 2);
@@ -779,8 +779,8 @@ static int read_var_block_data(ALSDecContext *ctx,
ALSBlockData *bd)
bd->ltp_gain[2] = ltp_gain_values[r][c];
-bd->ltp_gain[3] = decode_rice(gb, 2) << 3;
-bd->ltp_gain[4] = decode_rice(gb, 1) << 3;
+bd->ltp_gain[3] = decode_rice(gb, 2) * 8;
+bd->ltp_gain[4] = decode_rice(gb, 1) * 8;
*bd->ltp_lag = get_bits(gb, ctx->ltp_lag_length);
*bd->ltp_lag += FFMAX(4, opt_order + 1);
@@ -1799,11 +1799,11 @@ static int decode_frame(AVCodecContext *avctx, void
*data, int *got_frame_ptr,
if (!ctx->cs_switch) {
\
for (sample = 0; sample < ctx->cur_frame_length; sample++)
\
for (c = 0; c < avctx->channels; c++)
\
-*dest++ = ctx->raw_samples[c][sample] << shift;
\
+*dest++ = ctx->raw_samples[c][sample] * (1U << shift);
\
} else {
\
for (sample = 0; sample < ctx->cur_frame_length; sample++)
\
for (c = 0; c < avctx->channels; c++)
\
-*dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] <<
shift; \
+*dest++ = ctx->raw_samples[sconf->chan_pos[c]][sample] *
(1U << shift); \
}
\
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/qdm2: Move fft_order check up
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Mon Jun 17 20:58:47 2019 +0200| [423d0bbc556721849847d6dc9143d41d97b9a03c] |
committer: Michael Niedermayer
avcodec/qdm2: Move fft_order check up
This avoids undefined computations with unchecked values
Fixes: shift exponent -21 is negative
Fixes:
15262/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5651261753393152
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 8d8b8c4ac6fb5b5d40bd131f2d2ea9d85b8759a6)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=423d0bbc556721849847d6dc9143d41d97b9a03c
---
libavcodec/qdm2.c | 11 ++-
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 88b6b19d11..1397218bdd 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -1702,6 +1702,12 @@ static av_cold int qdm2_decode_init(AVCodecContext
*avctx)
s->fft_order = av_log2(s->fft_size) + 1;
+// Fail on unknown fft order
+if ((s->fft_order < 7) || (s->fft_order > 9)) {
+avpriv_request_sample(avctx, "Unknown FFT order %d", s->fft_order);
+return AVERROR_PATCHWELCOME;
+}
+
// something like max decodable tones
s->group_order = av_log2(s->group_size) + 1;
s->frame_size = s->group_size / 16; // 16 iterations per super block
@@ -1735,11 +1741,6 @@ static av_cold int qdm2_decode_init(AVCodecContext
*avctx)
else
s->coeff_per_sb_select = 2;
-// Fail on unknown fft order
-if ((s->fft_order < 7) || (s->fft_order > 9)) {
-avpriv_request_sample(avctx, "Unknown FFT order %d", s->fft_order);
-return AVERROR_PATCHWELCOME;
-}
if (s->fft_size != (1 << (s->fft_order - 1))) {
av_log(avctx, AV_LOG_ERROR, "FFT size %d not power of 2.\n",
s->fft_size);
return AVERROR_INVALIDDATA;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/alsdec: Fix undefined behavior in decode_rice()
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Wed Jun 19 23:17:31 2019 +0200| [dcef55b5ff8e36d30100df956102ce190b835840] |
committer: Michael Niedermayer
avcodec/alsdec: Fix undefined behavior in decode_rice()
Fixes: left shift of 72 by 26 places cannot be represented in type 'int'
Fixes:
15279/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALS_fuzzer-5700665621348352
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
(cherry picked from commit 51f6870c37cc29e1ea7e0c66df2fe505938b7561)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dcef55b5ff8e36d30100df956102ce190b835840
---
libavcodec/alsdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index 2660747472..e54440910c 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -487,7 +487,7 @@ static void parse_bs_info(const uint32_t bs_info, unsigned
int n,
static int32_t decode_rice(GetBitContext *gb, unsigned int k)
{
int max = get_bits_left(gb) - k;
-int q = get_unary(gb, 0, max);
+unsigned q = get_unary(gb, 0, max);
int r = k ? get_bits1(gb) : !(q & 1);
if (k > 1) {
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/aviobuf: Delay buffer downsizing until asserts are met
ffmpeg | branch: release/4.1 | Michael Niedermayer |
Sun Jun 9 22:04:16 2019 +0200| [7d075c5f337f76bbefee8fbcff7e3cc8d9f14a24] |
committer: Michael Niedermayer
avformat/aviobuf: Delay buffer downsizing until asserts are met
Fixes: Assertion failure
Fixes:
15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
Fixes:
15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432
May fix: Ticket7094
Signed-off-by: Michael Niedermayer
(cherry picked from commit 0334632d5c02720f1829d59cd20c009584b5b163)
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7d075c5f337f76bbefee8fbcff7e3cc8d9f14a24
---
libavformat/aviobuf.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index 5a33f82950..6a5cd97b0a 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -570,7 +570,7 @@ static void fill_buffer(AVIOContext *s)
}
/* make buffer smaller in case it ended up large after probing */
-if (s->read_packet && s->orig_buffer_size && s->buffer_size >
s->orig_buffer_size) {
+if (s->read_packet && s->orig_buffer_size && s->buffer_size >
s->orig_buffer_size && len >= s->orig_buffer_size) {
if (dst == s->buffer && s->buf_ptr != dst) {
int ret = ffio_set_buf_size(s, s->orig_buffer_size);
if (ret < 0)
@@ -578,7 +578,6 @@ static void fill_buffer(AVIOContext *s)
s->checksum_ptr = dst = s->buffer;
}
-av_assert0(len >= s->orig_buffer_size);
len = s->orig_buffer_size;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/tta: Limit decoder to 16 channels
ffmpeg | branch: master | Michael Niedermayer | Fri
Jun 28 20:02:32 2019 +0200| [17209e48e28d6c05c6fa78ec7630c368a6201fe8] |
committer: Michael Niedermayer
avcodec/tta: Limit decoder to 16 channels
libtta 2.3 has a limit of 6 channels, so 16 is substantially above the
"official" already
Fixes: OOM
Fixes:
15249/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TTA_fuzzer-5643988125614080
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=17209e48e28d6c05c6fa78ec7630c368a6201fe8
---
libavcodec/tta.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/tta.c b/libavcodec/tta.c
index c7702610b6..4d27fcd555 100644
--- a/libavcodec/tta.c
+++ b/libavcodec/tta.c
@@ -163,7 +163,7 @@ static av_cold int tta_decode_init(AVCodecContext * avctx)
s->data_length = get_bits_long(, 32);
skip_bits_long(, 32); // CRC32 of header
-if (s->channels == 0) {
+if (s->channels == 0 || s->channels > 16) {
av_log(avctx, AV_LOG_ERROR, "Invalid number of channels\n");
return AVERROR_INVALIDDATA;
} else if (avctx->sample_rate == 0) {
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/dxv: Initialize tex_funct to NULL
ffmpeg | branch: master | Michael Niedermayer | Mon
Jun 3 11:22:36 2019 +0200| [e96b7a8ba62c5e010328b80b647b64dd9cdbdc01] |
committer: Michael Niedermayer
avcodec/dxv: Initialize tex_funct to NULL
Fixes: Various anomalies
Fixes:
14493/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5071018000908288
Fixes:
14630/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_DXV_fuzzer-5714888963391488
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e96b7a8ba62c5e010328b80b647b64dd9cdbdc01
---
libavcodec/dxv.c | 4
1 file changed, 4 insertions(+)
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c
index 5fd1844094..ae79de981f 100644
--- a/libavcodec/dxv.c
+++ b/libavcodec/dxv.c
@@ -1057,6 +1057,10 @@ static int dxv_decode(AVCodecContext *avctx, void *data,
avctx->pix_fmt = AV_PIX_FMT_RGBA;
avctx->colorspace = AVCOL_SPC_RGB;
+ctx->tex_funct = NULL;
+ctx->tex_funct_planar[0] = NULL;
+ctx->tex_funct_planar[1] = NULL;
+
tag = bytestream2_get_le32(gbc);
switch (tag) {
case MKBETAG('D', 'X', 'T', '1'):
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/sanm: Optimize fill_frame() with av_memcpy_backptr()
ffmpeg | branch: master | Michael Niedermayer | Fri
Jun 28 20:38:56 2019 +0200| [936ca7f1012ebb52233cc0a5acad3febfdbe9ec3] |
committer: Michael Niedermayer
avcodec/sanm: Optimize fill_frame() with av_memcpy_backptr()
Fixes: Timeout (76 sec -> 24 sec)
Fixes:
15043/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SANM_fuzzer-5699856238116864
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=936ca7f1012ebb52233cc0a5acad3febfdbe9ec3
---
libavcodec/sanm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index 811fd2188e..25aee7220f 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -1358,8 +1358,10 @@ static int read_frame_header(SANMVideoContext *ctx,
SANMFrameHeader *hdr)
static void fill_frame(uint16_t *pbuf, int buf_size, uint16_t color)
{
-while (buf_size--)
+if (buf_size--) {
*pbuf++ = color;
+av_memcpy_backptr((uint8_t*)pbuf, 2, 2*buf_size);
+}
}
static int copy_output(SANMVideoContext *ctx, SANMFrameHeader *hdr)
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/simple_idct_template: Fix integer overflow in idctSparseCol()
ffmpeg | branch: master | Michael Niedermayer | Wed
Jun 26 00:03:01 2019 +0200| [b5f2cfd2ad2b269d3de79083dbb9162a632b69bb] |
committer: Michael Niedermayer
avcodec/simple_idct_template: Fix integer overflow in idctSparseCol()
Fixes: signed integer overflow: -1027919784 + -1120041624 cannot be represented
in type 'int'
Fixes:
15406/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3_fuzzer-5700646528876544
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b5f2cfd2ad2b269d3de79083dbb9162a632b69bb
---
libavcodec/simple_idct_template.c | 18 +-
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/libavcodec/simple_idct_template.c
b/libavcodec/simple_idct_template.c
index 35c31321c6..90d1c21355 100644
--- a/libavcodec/simple_idct_template.c
+++ b/libavcodec/simple_idct_template.c
@@ -312,18 +312,18 @@ static inline void FUNC6(idctSparseColAdd)(pixel *dest,
ptrdiff_t line_size,
static inline void FUNC6(idctSparseCol)(idctin *col)
#endif
{
-int a0, a1, a2, a3, b0, b1, b2, b3;
+unsigned a0, a1, a2, a3, b0, b1, b2, b3;
IDCT_COLS;
-col[0 ] = ((a0 + b0) >> COL_SHIFT);
-col[8 ] = ((a1 + b1) >> COL_SHIFT);
-col[16] = ((a2 + b2) >> COL_SHIFT);
-col[24] = ((a3 + b3) >> COL_SHIFT);
-col[32] = ((a3 - b3) >> COL_SHIFT);
-col[40] = ((a2 - b2) >> COL_SHIFT);
-col[48] = ((a1 - b1) >> COL_SHIFT);
-col[56] = ((a0 - b0) >> COL_SHIFT);
+col[0 ] = ((int)(a0 + b0) >> COL_SHIFT);
+col[8 ] = ((int)(a1 + b1) >> COL_SHIFT);
+col[16] = ((int)(a2 + b2) >> COL_SHIFT);
+col[24] = ((int)(a3 + b3) >> COL_SHIFT);
+col[32] = ((int)(a3 - b3) >> COL_SHIFT);
+col[40] = ((int)(a2 - b2) >> COL_SHIFT);
+col[48] = ((int)(a1 - b1) >> COL_SHIFT);
+col[56] = ((int)(a0 - b0) >> COL_SHIFT);
}
#ifndef EXTRA_SHIFT
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/vividas: Check for input length in get_v()
ffmpeg | branch: master | Michael Niedermayer | Thu
Jun 27 00:02:31 2019 +0200| [e69106e70c89ed4864f504891d28886df6b15441] |
committer: Michael Niedermayer
avformat/vividas: Check for input length in get_v()
Fixes: out of array read
Fixes:
15286/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5658245101780992
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e69106e70c89ed4864f504891d28886df6b15441
---
libavformat/vividas.c | 11 ++-
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/libavformat/vividas.c b/libavformat/vividas.c
index 753328245d..350c7aa70a 100644
--- a/libavformat/vividas.c
+++ b/libavformat/vividas.c
@@ -178,12 +178,13 @@ static void decode_block(uint8_t *src, uint8_t *dest,
unsigned size,
}
}
-static uint32_t get_v(uint8_t *p)
+static uint32_t get_v(uint8_t *p, int len)
{
uint32_t v = 0;
+const uint8_t *end = p + len;
do {
-if (v >= UINT_MAX / 128 - *p)
+if (p >= end || v >= UINT_MAX / 128 - *p)
return v;
v <<= 7;
v += *p & 0x7f;
@@ -204,7 +205,7 @@ static uint8_t *read_vblock(AVIOContext *src, uint32_t
*size,
decode_block(tmp, tmp, 4, key, k2, align);
-n = get_v(tmp);
+n = get_v(tmp, 4);
if (n < 4)
return NULL;
@@ -241,13 +242,13 @@ static uint8_t *read_sb_block(AVIOContext *src, unsigned
*size,
k2 = *key;
decode_block(ibuf, sbuf, 8, *key, , 0);
-n = get_v(sbuf+2);
+n = get_v(sbuf+2, 6);
if (sbuf[0] != 'S' || sbuf[1] != 'B' || (expected_size>0 && n !=
expected_size)) {
uint32_t tmpkey = recover_key(ibuf, expected_size);
k2 = tmpkey;
decode_block(ibuf, sbuf, 8, tmpkey, , 0);
-n = get_v(sbuf+2);
+n = get_v(sbuf+2, 6);
if (sbuf[0] != 'S' || sbuf[1] != 'B' || expected_size != n)
return NULL;
*key = tmpkey;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/qdm2: Do not read out of array in fix_coding_method_array()
ffmpeg | branch: master | Michael Niedermayer | Mon
Jun 24 01:01:02 2019 +0200| [ae021c1239ec3bc0a30dc5a4720569071599ece4] |
committer: Michael Niedermayer
avcodec/qdm2: Do not read out of array in fix_coding_method_array()
Instead we ask for a sample, its unclear what to do in this case.
Fixes: index 30 out of bounds for type 'int8_t [30][64]'
Fixes:
15339/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5749441484554240
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ae021c1239ec3bc0a30dc5a4720569071599ece4
---
libavcodec/qdm2.c | 7 ++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 1397218bdd..44ff4fa6c6 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -408,7 +408,12 @@ static int fix_coding_method_array(int sb, int channels,
}
for (k = 0; k < run; k++) {
if (j + k < 128) {
-if (coding_method[ch][sb + (j + k) / 64][(j + k) % 64] >
coding_method[ch][sb][j]) {
+int sbjk = sb + (j + k) / 64;
+if (sbjk > 29) {
+SAMPLES_NEEDED
+continue;
+}
+if (coding_method[ch][sbjk][(j + k) % 64] >
coding_method[ch][sb][j]) {
if (k > 0) {
SAMPLES_NEEDED
//not debugged, almost never used
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
ffmpeg | branch: master | Michael Niedermayer | Fri
Jun 21 23:45:36 2019 +0200| [37708cbae8d6887b80f58a70a1dfa01af6ea2c85] |
committer: Michael Niedermayer
avcodec/flicvideo: Fix off by 1 error in flic_decode_frame_24BPP()
Fixes: out of array access
Fixes:
15360/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5653837190266880
Fixes:
15412/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FLIC_fuzzer-5740537648250880
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=37708cbae8d6887b80f58a70a1dfa01af6ea2c85
---
libavcodec/flicvideo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c
index ba5bda48c4..c0e1e16bcd 100644
--- a/libavcodec/flicvideo.c
+++ b/libavcodec/flicvideo.c
@@ -900,7 +900,7 @@ static int flic_decode_frame_24BPP(AVCodecContext *avctx,
} else {
if (bytestream2_tell() + 2*byte_run >
stream_ptr_after_chunk)
break;
-CHECK_PIXEL_PTR(2 * byte_run);
+CHECK_PIXEL_PTR(3 * byte_run);
for (j = 0; j < byte_run; j++, pixel_countdown--) {
pixel = bytestream2_get_le24();
AV_WL24([pixel_ptr], pixel);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
ffmpeg | branch: master | Michael Niedermayer | Mon
Jun 24 01:01:03 2019 +0200| [694be24bd6c4cc9c6f4583260bf79056e4c1] |
committer: Michael Niedermayer
avcodec/qdm2: error out of qdm2_fft_decode_tones() before entering endless loop
Fixes: signed integer overflow: 2147483646 + 2 cannot be represented in type
'int'
Fixes: infinite loop
Fixes:
15396/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5116605501014016
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=694be24bd6c4cc9c6f4583260bf79056e4c1
---
libavcodec/qdm2.c | 4
1 file changed, 4 insertions(+)
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 44ff4fa6c6..1e91f477e8 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -1289,6 +1289,10 @@ static void qdm2_fft_decode_tones(QDM2Context *q, int
duration,
}
offset += (n - 2);
} else {
+if (local_int_10 <= 2) {
+av_log(NULL, AV_LOG_ERROR, "qdm2_fft_decode_tones() stuck\n");
+return;
+}
offset += qdm2_get_vlc(gb, _tab_fft_tone_offset[local_int_8],
1, 2);
while (offset >= (local_int_10 - 1)) {
offset += (1 - (local_int_10 - 1));
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/svq3: Use ff_set_dimension()
ffmpeg | branch: master | Michael Niedermayer | Tue
Jun 25 23:42:43 2019 +0200| [7b114d76878f1a542bcb75456492cc43e6414f8b] |
committer: Michael Niedermayer
avcodec/svq3: Use ff_set_dimension()
Fixes: OOM
Fixes:
15410/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SVQ3_fuzzer-5659464805384192
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7b114d76878f1a542bcb75456492cc43e6414f8b
---
libavcodec/svq3.c | 36
1 file changed, 20 insertions(+), 16 deletions(-)
diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index 18a4448ffa..9cea9ac840 100644
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -1183,6 +1183,7 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
GetBitContext gb;
int frame_size_code;
int unk0, unk1, unk2, unk3, unk4;
+int w,h;
size = AV_RB32([4]);
if (size > extradata_end - extradata - 8) {
@@ -1195,38 +1196,41 @@ static av_cold int svq3_decode_init(AVCodecContext
*avctx)
frame_size_code = get_bits(, 3);
switch (frame_size_code) {
case 0:
-avctx->width = 160;
-avctx->height = 120;
+w = 160;
+h = 120;
break;
case 1:
-avctx->width = 128;
-avctx->height = 96;
+w = 128;
+h = 96;
break;
case 2:
-avctx->width = 176;
-avctx->height = 144;
+w = 176;
+h = 144;
break;
case 3:
-avctx->width = 352;
-avctx->height = 288;
+w = 352;
+h = 288;
break;
case 4:
-avctx->width = 704;
-avctx->height = 576;
+w = 704;
+h = 576;
break;
case 5:
-avctx->width = 240;
-avctx->height = 180;
+w = 240;
+h = 180;
break;
case 6:
-avctx->width = 320;
-avctx->height = 240;
+w = 320;
+h = 240;
break;
case 7:
-avctx->width = get_bits(, 12);
-avctx->height = get_bits(, 12);
+w = get_bits(, 12);
+h = get_bits(, 12);
break;
}
+ret = ff_set_dimensions(avctx, w, h);
+if (ret < 0)
+goto fail;
s->halfpel_flag = get_bits1();
s->thirdpel_flag = get_bits1();
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/alac: Check lpc_quant
ffmpeg | branch: master | Michael Niedermayer | Wed Jun 19 01:04:07 2019 +0200| [a6474b899c1153e3bb95e399b6605c3507aea0d0] | committer: Michael Niedermayer avcodec/alac: Check lpc_quant lpc_quant of 0 produces undefined behavior, thus disallow this. If valid samples use this then such a sample would be quite usefull to confirm the correct handling of this. Fixes: libavcodec/alac.c:218:25: runtime error: shift exponent -1 is negative Fixes: 15273/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5656388535058432 Fixes: 15276/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5761238417539072 Fixes: 15315/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ALAC_fuzzer-5767260766994432 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a6474b899c1153e3bb95e399b6605c3507aea0d0 --- libavcodec/alac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/alac.c b/libavcodec/alac.c index 2f44340661..c234d7153b 100644 --- a/libavcodec/alac.c +++ b/libavcodec/alac.c @@ -306,7 +306,7 @@ static int decode_element(AVCodecContext *avctx, AVFrame *frame, int ch_index, rice_history_mult[ch] = get_bits(>gb, 3); lpc_order[ch] = get_bits(>gb, 5); -if (lpc_order[ch] >= alac->max_samples_per_frame) +if (lpc_order[ch] >= alac->max_samples_per_frame || !lpc_quant[ch]) return AVERROR_INVALIDDATA; /* read the predictor table */ ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/iff: Check ham vs bpp
ffmpeg | branch: master | Michael Niedermayer | Sat
Jun 22 19:21:50 2019 +0200| [f76d7352e05526fde7c607b9a9db536a5760af29] |
committer: Michael Niedermayer
avcodec/iff: Check ham vs bpp
This checks the ham value much stricter and avoids hitting cases which cannot
be reached
with data from the libavformat demuxer.
Fixes: out of array access
Fixes:
15320/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5080476840099840
Fixes:
15423/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_IFF_ILBM_fuzzer-5630765833912320
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f76d7352e05526fde7c607b9a9db536a5760af29
---
libavcodec/iff.c | 13 ++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index 4099d118e4..c6e2359b00 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -280,6 +280,16 @@ static int extract_header(AVCodecContext *const avctx,
for (i = 0; i < 16; i++)
s->tvdc[i] = bytestream_get_be16();
+if (s->ham) {
+if (s->bpp > 8) {
+av_log(avctx, AV_LOG_ERROR, "Invalid number of hold bits for
HAM: %u\n", s->ham);
+return AVERROR_INVALIDDATA;
+} if (s->ham != (s->bpp > 6 ? 6 : 4)) {
+av_log(avctx, AV_LOG_ERROR, "Invalid number of hold bits for
HAM: %u, BPP: %u\n", s->ham, s->bpp);
+return AVERROR_INVALIDDATA;
+}
+}
+
if (s->masking == MASK_HAS_MASK) {
if (s->bpp >= 8 && !s->ham) {
avctx->pix_fmt = AV_PIX_FMT_RGB32;
@@ -307,9 +317,6 @@ static int extract_header(AVCodecContext *const avctx,
if (!s->bpp || s->bpp > 32) {
av_log(avctx, AV_LOG_ERROR, "Invalid number of bitplanes: %u\n",
s->bpp);
return AVERROR_INVALIDDATA;
-} else if (s->ham >= 8) {
-av_log(avctx, AV_LOG_ERROR, "Invalid number of hold bits for HAM:
%u\n", s->ham);
-return AVERROR_INVALIDDATA;
}
av_freep(>ham_buf);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/hq_hqa: Use ff_set_dimensions()
ffmpeg | branch: master | Michael Niedermayer | Sat Jun 29 21:53:09 2019 +0200| [a6229fcd405d4135848c83df73634871260de59c] | committer: Michael Niedermayer avcodec/hq_hqa: Use ff_set_dimensions() Fixes: 15530/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HQ_HQA_fuzzer-5637370344374272 Fixes: signed integer overflow: 65312 * 65312 cannot be represented in type 'int' Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a6229fcd405d4135848c83df73634871260de59c --- libavcodec/hq_hqa.c | 6 -- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/hq_hqa.c b/libavcodec/hq_hqa.c index 90bafdc72a..eec2e980b3 100644 --- a/libavcodec/hq_hqa.c +++ b/libavcodec/hq_hqa.c @@ -254,10 +254,12 @@ static int hqa_decode_frame(HQContext *ctx, AVFrame *pic, size_t data_size) width = bytestream2_get_be16(>gbc); height = bytestream2_get_be16(>gbc); +ret = ff_set_dimensions(ctx->avctx, width, height); +if (ret < 0) +return ret; + ctx->avctx->coded_width = FFALIGN(width, 16); ctx->avctx->coded_height= FFALIGN(height, 16); -ctx->avctx->width = width; -ctx->avctx->height = height; ctx->avctx->bits_per_raw_sample = 8; ctx->avctx->pix_fmt = AV_PIX_FMT_YUVA422P; ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/rv10: Fix integer overflow in aspect ratio compare
ffmpeg | branch: master | Michael Niedermayer | Fri
Jun 28 19:20:43 2019 +0200| [14fcf42958608223a0be6558fb6e323419c9fc27] |
committer: Michael Niedermayer
avcodec/rv10: Fix integer overflow in aspect ratio compare
Fixes: signed integer overflow: 2040 * 1187872 cannot be represented in type
'int'
Fixes:
15368/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_RV20_fuzzer-5681657136283648
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=14fcf42958608223a0be6558fb6e323419c9fc27
---
libavcodec/rv10.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c
index 8f4497b9e0..729e4a8d2c 100644
--- a/libavcodec/rv10.c
+++ b/libavcodec/rv10.c
@@ -388,9 +388,9 @@ static int rv20_decode_picture_header(RVDecContext *rv)
// attempt to keep aspect during typical resolution switches
if (!old_aspect.num)
old_aspect = (AVRational){1, 1};
-if (2 * new_w * s->height == new_h * s->width)
+if (2 * (int64_t)new_w * s->height == (int64_t)new_h * s->width)
s->avctx->sample_aspect_ratio = av_mul_q(old_aspect,
(AVRational){2, 1});
-if (new_w * s->height == 2 * new_h * s->width)
+if ((int64_t)new_w * s->height == 2 * (int64_t)new_h * s->width)
s->avctx->sample_aspect_ratio = av_mul_q(old_aspect,
(AVRational){1, 2});
ret = ff_set_dimensions(s->avctx, new_w, new_h);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avformat/utils: Check timebase before use in estimate_timings()
ffmpeg | branch: master | Michael Niedermayer | Sat
Jun 29 23:23:25 2019 +0200| [f57e97dfd9539bc3f4f97a76ebc001f0b055cb88] |
committer: Michael Niedermayer
avformat/utils: Check timebase before use in estimate_timings()
Fixes: division by 0
Fixes:
15480/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5746727434321920
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f57e97dfd9539bc3f4f97a76ebc001f0b055cb88
---
libavformat/utils.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavformat/utils.c b/libavformat/utils.c
index 886cd6fd83..180df782f0 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -2953,6 +2953,7 @@ static void estimate_timings(AVFormatContext *ic, int64_t
old_offset)
AVStream av_unused *st;
for (i = 0; i < ic->nb_streams; i++) {
st = ic->streams[i];
+if (st->time_base.den)
av_log(ic, AV_LOG_TRACE, "stream %d: start_time: %0.3f duration:
%0.3f\n", i,
(double) st->start_time * av_q2d(st->time_base),
(double) st->duration * av_q2d(st->time_base));
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
ffmpeg | branch: master | Michael Niedermayer | Sun
Jun 30 17:54:45 2019 +0200| [1bb3b3f11c6960e90bcfe685c0ad1e355a3e787e] |
committer: Michael Niedermayer
avcodec/golomb: Correct the doxy about get_ue_golomb() and errors
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1bb3b3f11c6960e90bcfe685c0ad1e355a3e787e
---
libavcodec/golomb.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h
index fcc78f44c1..5cdfa0945d 100644
--- a/libavcodec/golomb.h
+++ b/libavcodec/golomb.h
@@ -49,6 +49,8 @@ extern const uint8_t
ff_interleaved_dirac_golomb_vlc_code[256];
/**
* Read an unsigned Exp-Golomb code in the range 0 to 8190.
+ *
+ * @returns the read value or a negative error code.
*/
static inline int get_ue_golomb(GetBitContext *gb)
{
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ffwavesynth: Fix backward lcg_seek()
ffmpeg | branch: master | Michael Niedermayer | Fri
Jun 21 22:08:27 2019 +0200| [cf2bd3ce79b12256d7d129b2ada5ee649b9a27eb] |
committer: Michael Niedermayer
avcodec/ffwavesynth: Fix backward lcg_seek()
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cf2bd3ce79b12256d7d129b2ada5ee649b9a27eb
---
libavcodec/ffwavesynth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ffwavesynth.c b/libavcodec/ffwavesynth.c
index a66113972b..cf8c780f3e 100644
--- a/libavcodec/ffwavesynth.c
+++ b/libavcodec/ffwavesynth.c
@@ -122,7 +122,7 @@ static void lcg_seek(uint32_t *s, int64_t dt)
c = LCG_C;
} else { /* coefficients for a step backward */
a = LCG_AI;
-c = (uint32_t)(LCG_AI * LCG_C);
+c = (uint32_t)(-LCG_AI * LCG_C);
dt = -dt;
}
while (dt) {
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
ffmpeg | branch: master | Michael Niedermayer | Fri
Jun 21 22:43:23 2019 +0200| [e9dd3c7126097d7c8d4f137db9957b81a219aa2c] |
committer: Michael Niedermayer
avcodec/ffwavesynth: use uint32_t to compute difference, it is enough
Fixes: signed integer overflow: 6494225984479297536 - -6043795377581187040
cannot be represented in type 'long'
Fixes:
15285/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5632780307791872
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e9dd3c7126097d7c8d4f137db9957b81a219aa2c
---
libavcodec/ffwavesynth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/ffwavesynth.c b/libavcodec/ffwavesynth.c
index b2cc7c8fc1..793eada7a5 100644
--- a/libavcodec/ffwavesynth.c
+++ b/libavcodec/ffwavesynth.c
@@ -215,7 +215,7 @@ static void wavesynth_seek(struct wavesynth_context *ws,
int64_t ts)
ws->next_inter = i;
ws->next_ts = i < ws->nb_inter ? ws->inter[i].ts_start : INF_TS;
*last = -1;
-lcg_seek(>dither_state, ts - ws->cur_ts);
+lcg_seek(>dither_state, (uint32_t)ts - ws->cur_ts);
if (ws->pink_need) {
int64_t pink_ts_cur = (ws->cur_ts + PINK_UNIT - 1) & ~(PINK_UNIT - 1);
int64_t pink_ts_next = ts & ~(PINK_UNIT - 1);
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ilbcdec: Simplify use of unsigned and fix more undefined overflows
ffmpeg | branch: master | Michael Niedermayer | Sun
Jun 30 23:28:13 2019 +0200| [019d729039aaa164152035864d65d77e53df1c98] |
committer: Michael Niedermayer
avcodec/ilbcdec: Simplify use of unsigned and fix more undefined overflows
Fixes: signed integer overflow: 2147475672 + 8192 cannot be represented in type
'int'
Fixes:
15415/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ILBC_fuzzer-5712074128228352
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=019d729039aaa164152035864d65d77e53df1c98
---
libavcodec/ilbcdec.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/ilbcdec.c b/libavcodec/ilbcdec.c
index bba83a5896..a82a27525c 100644
--- a/libavcodec/ilbcdec.c
+++ b/libavcodec/ilbcdec.c
@@ -724,7 +724,7 @@ static void construct_vector (
int16_t cbvec0[SUBL];
int16_t cbvec1[SUBL];
int16_t cbvec2[SUBL];
-int32_t a32;
+unsigned a32;
int16_t *gainPtr;
int j;
@@ -745,9 +745,9 @@ static void construct_vector (
for (j = 0; j < veclen; j++) {
a32 = SPL_MUL_16_16(*gainPtr++, cbvec0[j]);
a32 += SPL_MUL_16_16(*gainPtr++, cbvec1[j]);
-a32 += (unsigned)SPL_MUL_16_16(*gainPtr, cbvec2[j]);
+a32 += SPL_MUL_16_16(*gainPtr, cbvec2[j]);
gainPtr -= 2;
-decvector[j] = (a32 + 8192) >> 14;
+decvector[j] = (int)(a32 + 8192) >> 14;
}
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/4xm: Fix signed integer overflows in idct()
ffmpeg | branch: master | Michael Niedermayer | Thu
Jun 27 00:15:03 2019 +0200| [2bbea155bf7c6ce6d5ae53cc41e44798cad2f39c] |
committer: Michael Niedermayer
avcodec/4xm: Fix signed integer overflows in idct()
Fixes: signed integer overflow: 20242 * 121095 cannot be represented in type
'int'
Fixes:
15310/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FOURXM_fuzzer-5737051745419264
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2bbea155bf7c6ce6d5ae53cc41e44798cad2f39c
---
libavcodec/4xm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index 89120aa8fb..8382159bde 100644
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -158,7 +158,7 @@ typedef struct FourXContext {
#define FIX_1_847759065 121095
#define FIX_2_613125930 171254
-#define MULTIPLY(var, const) (((var) * (const)) >> 16)
+#define MULTIPLY(var, const) ((int)((var) * (unsigned)(const)) >> 16)
static void idct(int16_t block[64])
{
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/simple_idct_template: Fix integer overflow in idctSparseColAdd()
ffmpeg | branch: master | Michael Niedermayer | Wed
Jun 26 00:23:47 2019 +0200| [85cbd042ff801b4c4e13fca637d2dd25b7a312ff] |
committer: Michael Niedermayer
avcodec/simple_idct_template: Fix integer overflow in idctSparseColAdd()
Fixes: signed integer overflow: 1106434976 + 1041773512 cannot be represented
in type 'int'
Fixes:
15421/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV2_fuzzer-5669209314426880
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=85cbd042ff801b4c4e13fca637d2dd25b7a312ff
---
libavcodec/simple_idct_template.c | 18 +-
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/libavcodec/simple_idct_template.c
b/libavcodec/simple_idct_template.c
index 90d1c21355..d8fcfd7c53 100644
--- a/libavcodec/simple_idct_template.c
+++ b/libavcodec/simple_idct_template.c
@@ -288,25 +288,25 @@ static inline void FUNC6(idctSparseColPut)(pixel *dest,
ptrdiff_t line_size,
static inline void FUNC6(idctSparseColAdd)(pixel *dest, ptrdiff_t line_size,
idctin *col)
{
-int a0, a1, a2, a3, b0, b1, b2, b3;
+unsigned a0, a1, a2, a3, b0, b1, b2, b3;
IDCT_COLS;
-dest[0] = av_clip_pixel(dest[0] + ((a0 + b0) >> COL_SHIFT));
+dest[0] = av_clip_pixel(dest[0] + ((int)(a0 + b0) >> COL_SHIFT));
dest += line_size;
-dest[0] = av_clip_pixel(dest[0] + ((a1 + b1) >> COL_SHIFT));
+dest[0] = av_clip_pixel(dest[0] + ((int)(a1 + b1) >> COL_SHIFT));
dest += line_size;
-dest[0] = av_clip_pixel(dest[0] + ((a2 + b2) >> COL_SHIFT));
+dest[0] = av_clip_pixel(dest[0] + ((int)(a2 + b2) >> COL_SHIFT));
dest += line_size;
-dest[0] = av_clip_pixel(dest[0] + ((a3 + b3) >> COL_SHIFT));
+dest[0] = av_clip_pixel(dest[0] + ((int)(a3 + b3) >> COL_SHIFT));
dest += line_size;
-dest[0] = av_clip_pixel(dest[0] + ((a3 - b3) >> COL_SHIFT));
+dest[0] = av_clip_pixel(dest[0] + ((int)(a3 - b3) >> COL_SHIFT));
dest += line_size;
-dest[0] = av_clip_pixel(dest[0] + ((a2 - b2) >> COL_SHIFT));
+dest[0] = av_clip_pixel(dest[0] + ((int)(a2 - b2) >> COL_SHIFT));
dest += line_size;
-dest[0] = av_clip_pixel(dest[0] + ((a1 - b1) >> COL_SHIFT));
+dest[0] = av_clip_pixel(dest[0] + ((int)(a1 - b1) >> COL_SHIFT));
dest += line_size;
-dest[0] = av_clip_pixel(dest[0] + ((a0 - b0) >> COL_SHIFT));
+dest[0] = av_clip_pixel(dest[0] + ((int)(a0 - b0) >> COL_SHIFT));
}
static inline void FUNC6(idctSparseCol)(idctin *col)
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
ffmpeg | branch: master | Michael Niedermayer | Fri
Jun 21 22:41:25 2019 +0200| [8c022099351c04ae21e0b8696ea71a690ed03cd2] |
committer: Michael Niedermayer
avcodec/ffwavesynth: Simplify lcg_seek(), avoid negative case
Fixes: negation of -9223372036854775808 cannot be represented in type 'int64_t'
(aka 'long'); cast to an unsigned type to negate this value to itself
Fixes:
15289/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_FFWAVESYNTH_fuzzer-5709034499342336
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8c022099351c04ae21e0b8696ea71a690ed03cd2
---
libavcodec/ffwavesynth.c | 12 +++-
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/libavcodec/ffwavesynth.c b/libavcodec/ffwavesynth.c
index cf8c780f3e..b2cc7c8fc1 100644
--- a/libavcodec/ffwavesynth.c
+++ b/libavcodec/ffwavesynth.c
@@ -113,18 +113,12 @@ static uint32_t lcg_next(uint32_t *s)
return *s;
}
-static void lcg_seek(uint32_t *s, int64_t dt)
+static void lcg_seek(uint32_t *s, uint32_t dt)
{
uint32_t a, c, t = *s;
-if (dt >= 0) {
-a = LCG_A;
-c = LCG_C;
-} else { /* coefficients for a step backward */
-a = LCG_AI;
-c = (uint32_t)(-LCG_AI * LCG_C);
-dt = -dt;
-}
+a = LCG_A;
+c = LCG_C;
while (dt) {
if (dt & 1)
t = a * t + c;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
ffmpeg | branch: master | Michael Niedermayer | Sat
Jun 15 23:28:25 2019 +0200| [79204a1fc8f1988f7d7e6cae2c3b68f513444d38] |
committer: Michael Niedermayer
avcodec/vc1_block: Check for vlc error in vc1_decode_ac_coeff()
Fixes: index -1 out of bounds for type 'const uint8_t [185][2]'
Fixes:
15250/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WMV3IMAGE_fuzzer-5648992869810176
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=79204a1fc8f1988f7d7e6cae2c3b68f513444d38
---
libavcodec/vc1_block.c | 34 ++
1 file changed, 26 insertions(+), 8 deletions(-)
diff --git a/libavcodec/vc1_block.c b/libavcodec/vc1_block.c
index 86320db959..ec5339d2f0 100644
--- a/libavcodec/vc1_block.c
+++ b/libavcodec/vc1_block.c
@@ -508,13 +508,15 @@ static inline int vc1_coded_block_pred(MpegEncContext *
s, int n,
* @param codingset set of VLC to decode data
* @see 8.1.3.4
*/
-static void vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip,
+static int vc1_decode_ac_coeff(VC1Context *v, int *last, int *skip,
int *value, int codingset)
{
GetBitContext *gb = >s.gb;
int index, run, level, lst, sign;
index = get_vlc2(gb, ff_vc1_ac_coeff_table[codingset].table, AC_VLC_BITS,
3);
+if (index < 0)
+return index;
if (index != ff_vc1_ac_sizes[codingset] - 1) {
run = vc1_index_decode_table[codingset][index][0];
level = vc1_index_decode_table[codingset][index][1];
@@ -560,6 +562,8 @@ static void vc1_decode_ac_coeff(VC1Context *v, int *last,
int *skip,
*last = lst;
*skip = run;
*value = (level ^ -sign) + sign;
+
+return 0;
}
/** Decode intra block in intra frames - should be faster than
decode_intra_block
@@ -639,7 +643,9 @@ static int vc1_decode_i_block(VC1Context *v, int16_t
block[64], int n,
zz_table = v->zz_8x8[1];
while (!last) {
-vc1_decode_ac_coeff(v, , , , codingset);
+int ret = vc1_decode_ac_coeff(v, , , , codingset);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -812,7 +818,9 @@ static int vc1_decode_i_block_adv(VC1Context *v, int16_t
block[64], int n,
}
while (!last) {
-vc1_decode_ac_coeff(v, , , , codingset);
+int ret = vc1_decode_ac_coeff(v, , , , codingset);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -995,7 +1003,9 @@ static int vc1_decode_intra_block(VC1Context *v, int16_t
block[64], int n,
int k;
while (!last) {
-vc1_decode_ac_coeff(v, , , , codingset);
+int ret = vc1_decode_ac_coeff(v, , , , codingset);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -1161,7 +1171,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
last = 0;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 63)
break;
@@ -1189,7 +1201,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
off = (j & 1) * 4 + (j & 2) * 16;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 15)
break;
@@ -1216,7 +1230,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
off = j * 32;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 31)
break;
@@ -1243,7 +1259,9 @@ static int vc1_decode_p_block(VC1Context *v, int16_t
block[64], int n,
i= 0;
off = j * 4;
while (!last) {
-vc1_decode_ac_coeff(v, , , , v->codingset2);
+int ret = vc1_decode_ac_coeff(v, , , ,
v->codingset2);
+if (ret < 0)
+return ret;
i += skip;
if (i > 31)
break;
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
[FFmpeg-cvslog] avcodec/qdm2: Check checksum_size for 0
ffmpeg | branch: master | Michael Niedermayer | Mon
Jun 24 01:01:04 2019 +0200| [7b2ebf89a411d957ca999f1e7a919ff617fbfd56] |
committer: Michael Niedermayer
avcodec/qdm2: Check checksum_size for 0
Fixes: Infinite loop
Fixes:
15337/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QDM2_fuzzer-5757428949319680
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7b2ebf89a411d957ca999f1e7a919ff617fbfd56
---
libavcodec/qdm2.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 1e91f477e8..eaffb36dcc 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -1704,8 +1704,8 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
s->group_size = bytestream2_get_be32();
s->fft_size = bytestream2_get_be32();
s->checksum_size = bytestream2_get_be32();
-if (s->checksum_size >= 1U << 28) {
-av_log(avctx, AV_LOG_ERROR, "data block size too large (%u)\n",
s->checksum_size);
+if (s->checksum_size >= 1U << 28 || !s->checksum_size) {
+av_log(avctx, AV_LOG_ERROR, "data block size invalid (%u)\n",
s->checksum_size);
return AVERROR_INVALIDDATA;
}
___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
